Putting Privacy Into Employees' Hands

Companies have always protected data in different ways, whether it's customer records, intellectual property, or personnel data. But increasing incidences of identify theft and consumer fraud, combined with recent federal and state legislation, are forcing businesses to evaluate their information stewardship.

Privacy protection requires more than enabling technology to protect data files stored on a server or transmitted between trusted partners, and more than privacy policies, periodic assessment tests, or appointing privacy and compliance personnel. A grassroots approach that provides employees with adequate training to correctly handle sensitive information is necessary.

To understand how pervasive privacy training has become, InformationWeek Research surveyed companies about their privacy procedures. The online study of 150 business-technology professionals reveals that approximately half have received training in how to handle confidential information.

The types of information most frequently managed as sensitive and restricted data includes personnel records, Social Security numbers, and financial data, including banking and credit information.

The methods that surveyed sites use to communicate how sensitive information should be treated vary. Few rely on online instruction to promote privacy awareness. Instead, nearly 70% of the companies providing privacy training to workers distribute printed materials. Company-paid classes are another popular method; 52% of survey participants have attended in-house company-paid classes, while 14% attend outside training.

What investments does your company plan to make to ensure the safekeeping of customer records, intellectual property, or personnel information? Share your strategies with InformationWeek columnist Parry Aftab at informationweek.com/LP /columnists/parry aftab.jhtml.

Helen D'Antoni
Senior Editor, Research
[email protected]

Staff Training

How were you trained to handle company information that's sensitive data?

Employee training can be a significant expense. Travel costs, session fees, and the price of having people out of the office add up. Online instruction offers a cost-effective, convenient alternative for giving employees the information they need. Of the 73 sites offering training in InformationWeek Research's privacy study, nearly two in five train online.

Privacy Gauge

What priority does concern for privacy have in your company?

As businesses look for ways to converge knowledge management and the safekeeping of corporate information, privacy is becoming a core business-technology function, especially in highly regulated industries such as health care and financial services. Yet according to survey results, privacy is hardly a corporate mission just yet. Of the full 150 sites surveyed, 46% consider privacy a high priority, 42% consider it of moderate importance, and 12% consider it a low priority.

Data Concerns

Which information is managed as sensitive data at your company?

Government regulations such as HIPAA are making patients and employees more aware of their rights in the use and sharing of personal information. Despite procedures aimed at data integration and proper retention of critical information, companies continue to struggle in achieving complete views of the information on hand (see "Complete Customer Profiling Remains Elusive," April 5,2004). Still, businesses understand the importance of health-related information, and more than half of those surveyed classify such information as sensitive data.

Personal Apprehension

How important is privacy to you personally?

Privacy concerns also touch people on a personal level. Despite seeing their businesses invest in privacy-related tools and services, company personnel worry about how their own information is being used and by whom. For a majority of the business-technology professionals surveyed, privacy is of personal importance, with 84% of IT and 81% of business staff and managers saying privacy is extremely important to them personally.