Seamless Customer Experience: What Will It Take? Offering Security and Privacy

1. Seamless Customer Experience: What Will It Take?Offering Security and Privacy Ann Cavoukian, Ph.D. Information & Privacy Commissioner/Ontario The Access Group Toronto, Ontario March 3, 2005

2. Growth of Privacy as a Global Issue EU Directive on Data Protection Increasing amounts of personal data collected, consolidated, aggregated Consumer Backlash; heightened consumer expectations Impetusfor Change

3. It’s business as usual: Clear distinction between public safety and business issues – make no mistake No reduction in consumer expectations Increased value of trusted relationships The New Debate:Privacy After 9/11

4. Business is not a beneficiary of the post-9/11 “Trust Mood” Increased trust in government has not been paralleled by increased trust in business handling of personal information Privacy On and Off the Internet: What Consumers Want Harris Interactive, November 2001 Dr. Alan Westin Consumer Attitudes

5. Information Privacy: Data Protection Freedom of choice; control; informational self-determination Personal control over the collection, use and disclosure of any recorded information about an identifiable individual Information Privacy Defined

6. Security  Privacy What Privacy is Not

7. The control of information on the part of data holders or their surrogates Functions: Authentication Authorization Confidentiality Data Integrity Non-repudiation Availability The Foundation of Information Security

8. Privacy relates to personal control over one’s personal information Security relates to organizational control over information These represent two overlapping, but distinct activities The Privacy/Security Relationship

9. Security Risk Management Owner of the data is assumed to be trusted System design is trusted Privacy Risk Management Custodian of data not considered trusted System design not to be trusted - Eg. CAPPS II Risk Management

10. Authentication Data Integrity Confidentiality Non-repudiation Privacy; Data Protection Fair Information Practices Security: Organizational control of information through information systems Privacy and Security: The Difference

11. Accountability Identifying Purposes Consent Limiting Collection Limiting Use, Disclosure, Retention Accuracy Summary of Fair Information Practices • Safeguards • Openness • Individual Access • Challenging Compliance

12. Privacy should be viewed as a business strategy, not a compliance issue The Bottom Line

13. Electronic Commerce projected to reach $220billion by 2001 WTO, 1998 Electronic Commerce projected to reach $133 billion by 2004 Wharton Forum on E-Commerce, 1999 The Promise Estimates revised downward to reflect lower expectations

14. United States: e-commerce sales were only 1.6% of total sales -- $54.9 billion in 2003 U.S. Dept. of Commerce, Census Bureau, February 2004 Canada: Online sales were only 0.8% of total revenues -- $18.6 billion in 2003 Statistics Canada, April 2004 The Reality of E-Commerce

15. “Consumer privacy apprehensions continue to plague the Web. These fears will hold back roughly $15 billion in e-commerce revenue.” Forrester Research, September 2001 “Privacy and security concerns could cost online sellers almost $25 billion by 2006.” Jupiter Research, May 2002 Lack of Privacy = Lack of Sales

16. “Our research shows that 80% of our customers would walk away if we mishandled their personal information.” CPO, Royal Bank of Canada, 2003 Nearly 90% of online consumers want the right to control how their personal information is used after it is collected. The Business Case

17. The Information Security Forum reported that a company’s privacy breaches can cause major damage to brand and reputation: 25% of companies surveyed experienced some adverse publicity due to privacy 1 in 10 had experienced civil litigation, lost business or broken contracts Robust privacy policies and staff training were viewed as keys to avoiding privacy problems The Information Security Forum, July 7, 2004 ISF Highlights Damage done by Privacy Breaches

18. “Trust is more important than ever online … Price does not rule the Web … Trust does.” Frederick F. Reichheld, Loyalty Rules: How Today’s Leaders Build Lasting Relationships It’s all about Trust

19. “When customers DO trust an online vendor, they are much more likely to share personal information. This information then enables the company to form a more intimate relationship with its customers.” Frederick F. Reichheld, Loyalty Rules: How Today’s Leaders Build Lasting Relationships The High Road

20. Translating Privacy Requirements into Technology

21. “The most effective means to counter technology’s erosion of privacy is technology itself.” Technology and Privacy Alan Greenspan, Federal Reserve Chairman

23. CIBC Privacy Breach Government of Ontario Privacy Breach Identity Theft Hot Topics

24. West Virginia scrap yard operator alleges that since 2001, his telephone system has been deluged with confidential CIBC customer data (e.g. SSN, account no., client signature) Toll-free number was one digit different from an internal bank fax number Filed a lawsuit against CIBC claiming his business was ruined CIBC filed a court action accusing him of deliberately leaking customer data CIBC Privacy Breach

25. Bank acknowledges reports of the misdirected faxes dating back to February 2002 An e-mail message was sent to staff to check their fax machines The matter was not otherwise investigated or escalated to senior levels CIBC issued a formal apology and took remedial action (e.g. notification of individuals; fax number taken out of service) Federal Privacy Commissioner investigating CIBC Privacy Breach (cont’d)

26. Dec 16, 2004, IPC tabled Special Report to the Legislative Assembly of Ontario on the Disclosure of Personal Information by the Shared Services Bureau, Management Board Secretariat, and the Ministry of Finance 27,258 cheques, mailed under the Ontario Child Care Supplement Program, included the personal information of another recipient Government has committed to implementing all recommendations made by IPC Privacy Breach:Government of Ontario

27. Independent end-to-end audit of all functions, operations and privacy practices of the Shared Services Bureau Discontinue use of the SIN number and create a purpose-specific unique identifier Trial run printing of several sample cheques and manual examination, before each monthly printing of cheques and stubs Recommendations

28. Identity theft occurs when someone uses your personal information such as your name, Social Insurance Number or credit card number without your permission to commit fraud or other crimes In 2003, more than 13,000 Canadians reported to Phonebusters that they were victims of identity theft but the actual, unreported numbers are probably much higher The Canadian Council of Better Business Bureaus estimates that identity theft costs the Canadian economy about $2.5 billion annually Identity Theft

29. Businesses must continue to educate consumers about identity theft A study released by the Ponemon Institute in November 2004 found that: 70% of consumers are willing to share their personal information or give the answer to a security question in response to an unsolicited phone call or email 61% don’t want to be forced to change their passwords to access their accounts 57% don’t want their accounts locked down after three failed attempts Consumer Education

30. “Spoofed” emails or pop-up messages are used to lure consumers to fraudulent Web sites which mimic actual banks or credit card companies and attempt to trick them into divulging personal information such as their names, account numbers and passwords In November 2004, more than 1,500 fraudulent Web sites were reported to the Anti-Phishing Working Group From July to November 2004, there was a 28% average monthly growth rate in such Web sites Online Identity Theft:“Phishing”

31. Phishers are targeting Canadian financial institutions and consumers but most Canadians are unfamiliar with “phishing” A survey released by Visa in November 2004 found that: Only 16% of Canadians with a personal email account and Internet access were familiar with the term “phishing” Nearly 60% admitted that they would likely provide personal information if requested through an email from their bank or credit card company 4% reported that they had actually been a victim of phishing “Phishing” in Canada

32. The growth of the digital economy will ultimately be linked to how effective organizations can be in dispelling consumers’ privacy fears Protecting consumer privacy does not mean severing relationships with those customers. On the contrary it will help put customers at ease and will open up a world of valuable information that can only help in a competitive environment. The Bottom Line

33. Final Thought “Anyone today who thinks the privacy issue has peaked is greatly mistaken…we are in the early stages of a sweeping change in attitudes that will fuel political battles and put once-routine business practices under the microscope.” Forrester Research, March 5, 2001

34. How to Contact Us Ann Cavoukian, Ph.D. Information & Privacy Commissioner/Ontario 2 Bloor Street East, Suite 1400 Toronto, Ontario M4W 1A8 Phone: (416) 326-3333 Web: www.ipc.on.ca E-mail: commissioner@ipc.on.ca