The following is based on the notes I prepared for a recent panel discussion at the 2011 American Business Media conference (webcast available here beginning at minute 18).

There are at least three things to consider when talking about privacy

1. The law, and potential laws. What’s important to the people who make law
2. The practical: customer’s perceptions and expectations of privacy when they interact with our brands. Privacy is subjective, and it’s personal
3. The emotional. Privacy is about control and who determines what information about a person is shared: them, or a third-party.

Unpacking ‘Privacy’ and why business media companies should care:

• Most trade publishing is based on a ‘give/get.’ A reader gives data to a publisher and gets access to information. The publisher ‘sells’ that data directly (in the case of research and data products), or indirectly as a measure of audience composition. Increasingly sought-after is data and information specifically tied to an individual reader/user customer. Sometimes anonymously, but more often now not
• Privacy is about meeting a customer’s expectations about what information you collect, combine and store about the and how you use it
• Can customers trust that you have complete control over the data and information you maintain
• Is the data being used in a way that is consistent with the relationship they perceive they have established with you
• Is the data being used to benefit the customer’s experience with your products or brands
• Security. Some of the information we collect can be combined with other information to characterize the business activities of our user’s organizations, or their roles within their organizations that could be used for bad purposes. Leaks of such information might also cause organizations where our readers work to bar them from interacting with our brands.

Why Trust and Expectation-Setting Make Transparency a Business Imperative

As an example of trust and expectation setting: take for example lead generation — a business many of us are in. In some cases, we have brands specifically built for lead generation. It’s very clear to users that when they opt-in their data will be provided to a sponsoring company.

What is probably not clear to them, is that we may be combining the information collected in that transaction with information collected through our other editorial brands about what they read, eseminars they’ve attended, and perhaps even responses to polling you’ve done.

And to push it one step further, our data may be combined with data from third-parties — and distributed externally.

The stakes are very high because data is indelible. One large data ‘leak’ through a vendor is your data supply chain cannot be erased. Once the data is out, it is not coming back.

Disclose what you know about your customers. Privacy is subjective. Let them decide what they are comfortable with, and give them opportunities to tell you what additional value you can provide that satisfies them that they are getting an equitable exchange for the data they are providing.

Create incentives that directly benefit users to keep their data accurate and up to date. Make that transparent. Show how more accurate and detailed data benefits them.

All of us need to really get our arms around what is happening data we have supplied to 3rd-party data aggregators. Just because a person has voluntarily given us and three other organizations data about themselves, does not mean they have opted-in the have that data combined and acted on in some unexpected way. In some ways this is the thorniest issue we will be dealing with in the future. Not only figuring out how aggregators are using our data, but how to properly disclose to our customers how it is being used in a way that meets THEIR expectations of transparency about our privacy policies.

In the digital world, customers will always eventually figure out and broadcast your business practices to peers. This is a conversation you want to control by being transparent. Remember privacy is emotional. If you lose control of the conversation about your data-handling practices you will lose the ability to collect data because your readers will not trust you.

While existing law, and pending legislation generally makes exceptions for information collect in the course of business to business transactions, we do need to be wary of the increasingly blurry line between people’s business and recreational persona’s.

In the my early days as computer magazine publisher, we had many people receiving Dr. Dobb’s Journal at home. It was an advanced programming magazine, and many companies did not allow programmers to disclose where they worked. The analogy today is these folks use personal email addresses, and that allows marketers to append large amounts of actionable data to their business profiles — and use it to communicate with them.

We also need to begin considering that the information that is the life-blood of our businesses: knowledge about the products and services consumed or resold by our reader’s companies can be combined in new ways that create competitive threats to their businesses. If we are seen to be aiding corporate competitive intelligence through our data collection and sharing policies, we will find ourselves locked out businesses we need to reach.

Your first step in getting your arms around where your company stands, is to break this down into digestible pieces. You need to have a comprehensive understanding of:

• Your customer’s expectations about how you will use data they provide — or that you generate about them
• Your businesses’ data collection practices including storage, transfer and security
• Your business partner’s security practices. How do your vendors handle personal information? Who has access to their data? Who is it shared with? Have they documented their data security practices for you?

Some additional practical things you should be doing now:

Inventory of all the data collected across your organization:

• What is data collected?
• How is it stored?
• Who has access to it?
• What is it used for internally?
• What data is it combined with internally?
• How is it distributed externally?
• Audit all vendors — how are they using the data?
• Do you really understand how data is propagating through your vendor eco-system?
• Is there any place you have data bleeding out?
• Create a preference center where users can see what info you have collected about them, and give them opt-out options
• Clearly explain the value to the customer in letting you keep and maintain this information