Designing a workable privacy policy
By Jenny C. McCune • Bankrate.com

Many businesses find they can improve services and the bottom line by gathering information on customers.

Most consumers, however, share Greta Garbo's wish to be left alone. They don't want a company sharing their private information with others and they definitely don't want to end up on a spam e-mail list.

It is possible to be the business good guy and grant customer wishes while simultaneously collecting data that helps your company. The key is creating and implementing a privacy policy.

"It's absolutely necessary," says Mark Mekow, Tucson, Ariz.-based co-author of The E-Privacy Imperative. "A privacy policy builds trust and upholding it lets people know that they can trust you. It's also the right thing to do."

Basically, a privacy policy explains what information you're gathering from customers or prospects and how it will be used. For example, do you share the information with vendors or is it intended only for internal use? What about selling an e-mail list? And just how long does your company hold onto client information?

Offer opt in or out
Another critical customer concern is whether they have a choice about participation in your company's collection of personal data.

Giving customers a choice is known as opt-in or opt-out policy. Customers can agree to receive a client newsletter for your company (opt in) or they can ask to be taken off the newsletter mailing list (opt out).

When customers opt out, whether it's removal from e-mail, snail mail or phone solicitations, your company needs an in-house suppression file that allows you to keep track of and honor such requests.

Follow through is imperative. Your company should move quickly to comply with the requests of people who wish to be removed from your contact list, says Philippa Gamse, the Santa Cruz, Calif.-based CyberSpeaker, a consultant on e-business strategy.

Make sure everyone knows
Of course, a privacy policy is worthless if no one knows about it.

"A privacy policy is only as good as the recipient reading it and paying attention to it," says Kathleen Goodwin, CEO of iMakeNews, a permission-based electronic newsletter publisher based in Newton, Mass.

Your company's privacy protection effort is more likely to be read if it's easy to understand. "Mine simply says that I don't sell, rent or loan my mailing list to any third party," says Gamse.

To further encourage familiarity among your customers, post the policy prominently at your work place. If you have a Web site, consider putting links to the policy on each page. Include it in your direct mail pieces and put a summary of your e-mail policy at the bottom of all electronic customer communications.

Internally, don't assume your employees automatically know the company's guidelines. A small-business owner must make sure workers are educated on the privacy policy specifics and how to follow them.

"There's a need not only to have a privacy policy but to also live it up to it," Mekow explains.

Don't forget to check on the policies of any companies with whom you may contract. For example, if your company uses a third party to host your Web site, ask the host what its privacy policies are.

You also should secure customer information so that it doesn't fall into the wrong hands. Electronically, this can be accomplished by using encryption software during sensitive transactions. When gathering data the old-fashioned way, make sure your paper copies of customer records are safe by using a security system at your office.

Letting your customers look
All your efforts to safeguard customer privacy could be undermined, however, if the data you're collecting is wrong. In such cases, the information won't do your business any good and it could antagonize your customers.

To prevent erroneous information, include assurance of accessibility in your privacy policy. Let customers see the information you collect on them, says Mekow. If they find something wrong, let them correct it.

Goodwin recommends listing a phone number so that people can talk to a person about privacy concerns.

You also can boost the credibility of your company's privacy policy by getting an endorsement from Web site privacy auditors, such as the Better Business Bureau Online, TRUSTe or the Direct Marketing Association's Privacy Promise.

"It's like getting the Good Housekeeping seal of approval for your Web site and your privacy policies," Mekow says. Participating companies earn the right to display a privacy seal and must agree to submit to the program's dispute resolution process.

Finally, consider limiting what you ask for in the first place, particularly when your company begins working with a customer. "I suggest asking for a minimum of information, especially on the first contact," says consultant Gamse. "It's a great trust builder."

Jenny C. McCune is a contributing editor based in Montana.

-- Posted: Aug. 21, 2002