Companies creating more chief privacy officer jobs |
 |
By Edward Hurley, News Writer
15 Jan 2003 | SearchSecurity.com |
|
|
The chief security officer (CSO) position has matured to the point where the title isn't particularly jarring when you see it on a business card. However, the same probably cannot be said for the chief privacy officer (CPO) job.
Yet as companies face increasing pressure from the public to keep data protected, they are creating CPO positions. The move has both organizational and public relations value. For example, IBM Corp. got a lot of coverage in 2000 when it named Harriet Pearson CPO in order to, in the company's words, "lead initiatives across IBM that will strengthen consumer privacy protection."
CPOs are the public point people for a company's privacy initiatives. In other words, they function as the human face that is responsible for protecting the customer data that's collected and stored by companies.
Some companies may be tempted to create a position with combined security and privacy duties because the areas are undoubtedly interlinked. However, the CPO position has a different posture than the CSO job. CPOs tend to be more outward facing, while CSOs look more inward. For example, a CPO may argue against selling customer data to another company because of privacy concerns. "They function as the customer advocate within a company," said Peter H. Gregory, a consultant with the Woodinville, Wash.-based HartGregory Group.
By contrast, CSOs probably wouldn't question selling customer data. Their concern would be about safely transmitting the data to ensure security. "Their job is to protect company information and assets," Gregory said.
CPOs need to know technology, but they also need good public relations and policy skills. Federal regulations such as the Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act (HIPAA) have forced companies to face privacy head-on.
Gregory, however, sees identity theft as one of the prime influencers for the CPO position. People want to know how companies are protecting their sensitive information from the scourge, he said.
Additionally, the late '90s saw several high-profile incidents in which hackers broke into Web sites and stole tens of thousands of credit card numbers. Consumers really started to worry about the data they were transmitting digitally when doing e-business. Technologies such as data warehousing and business intelligence allowed companies to learn much from the data they collected, but there were fears from consumers over how such data would be used. "These are legitimate and very real concerns, and they must be addressed if the world of e-business is to reach its full potential," said Louis V. Gerstner Jr., IBM's chairman and CEO, when naming Pearson to her position.
The CPO position does have something in common with the CSO job: confusion over where they fit in the organizational structure. Do they answer to the CEO and the board of directors? Should they report to the CIO? The way a company answers such questions often says something about how much it truly values privacy (or security, for that matter).
To be truly effective, a CPO shouldn't answer to the CIO, Gregory said. Such an arrangement would lessen the CPO's value because the CIO's main concern is business operations, not privacy. A model arrangement would entail the CPO, CIO and CSO all being on about the same level. "They would have to use their negotiating skills to get the best thing for the business," he said. "In essence, you would have a quasi-balance of power under that arrangement."
FOR MORE INFORMATION:
Search Security.com technical tip: "Enterprise privacy issues"
Best Web Links on security career information
- FEEDBACK: Does your company have a CPO? Let News Writer Edward Hurley know.
|
|
|
|
