In-house privacy counsel from several companies sounded off on their work during the Women, Influence and Power in Law conference on Wednesday.
Put yourself in the consumer’s shoes. It may sound trite, but it is a running theme for in-house privacy counsel when making decisions about their companies—whether the company is Walmart Stores Inc., Nike Inc. or Intact Financial Corp.
At the Women, Influence and Power in Law annual conference in Washington DC on Tuesday, privacy lawyers shared real-life examples from the work they do at their companies as it relates to the foundational principles of privacy by design.
Here’s how the attorneys are implementing these principles:
Be proactive instead of reactive. Be preventative, not remedial.
Maryann Besharat, VP of legal and compliance at Intact Financial, said privacy by design is a team sport. Therefore, lawyers need to keep IT and customer service employees in the loop by having conversations early and often.
Besharat said her company’s employees are constantly thinking of ways to make their insurance products faster to use and more user-friendly. So, for instance, the lawyers schedule regular meetings with employees involved in the company’s data lab, which is focused on innovation. When lawyers are in the meetings they are able to flag potential privacy issues for employees upfront, said Besharat, who noted that this helps so “you’re not the sad person who’s saying no at the end to this wonderful product.”
Make privacy a default setting.
When it comes to this principle, Walmart’s director of privacy Rebecca Davis has a lot of experience. “One of our core tenets is respecting the individual,” she said.
At Walmart, Davis said, the company has a clearly defined approach to individuals’ privacy. Lawyers with the retail giant frequently ask, not only ‘Could we?’ but ‘Should We?’
For example, retailers that sell products online with Walmart can offer a guest checkout versus requiring a sign-in, so that users only have to share the minimum amount of personal information in order to make a purchase.
Privacy embedded into design
Davis said facial recognition technology is one area where Walmart has built privacy into the product. Naturally, the company wants to better understand shopper habits in order to attract more customers.
Walmart stores use facial recognition technology essentially to identify a person’s age and gender, but the company declines to collect further data points that would allow shoppers to be identified too easily.
Davis summed up the company’s lines in the sand around customer privacy: “Just because tech has the capability doesn’t mean we should use it,” she said.
Come up with a full-functionality positive sum, not zero sum.
Company lawyers should think of ways to find beneficial outcomes for multiple internal stakeholders when it comes to privacy.
Anne Bradley, chief privacy counsel at Nike, said she seeks alliances with non-lawyers at the company to make it easier to convince management that a specific security or privacy measure should be considered. For instance, she wants to keep less data so the company has fewer liabilities and her colleague, who is a technology officer, wants to store less data at Nike because of the high costs of collecting and storing that consumer data. This is one scenario where lawyers and non-lawyers’ interests are aligned, intentionally or not, but united they can work toward better privacy practices.
Value visibility and transparency. Keep it open.
Bradley said she understands most users don’t read a company’s online privacy policies. Even as a privacy attorney herself, she admitted she frequently skips over these policies when using other websites.
So Nike looks for ways to show customers the data that the company has collected. For example, online shoppers can see their purchase history on the dashboard of their profiles. According to Bradley, steps like this help the company’s case in front of regulators, by taking part of the information customers may miss in a privacy agreement and putting it in plain sight.
“We’re doing disclosures in a way that’s really functional,” Bradley said.
Consider end-to-end security, full lifecycle protection.
Intact’s Besharat said there are many questions to ask around defending data. She said that companies need to assess: What are you doing with this data? How long will you use it for? How long will you store it? What happens in the event of loss or theft? If we were hacked, what would we do?
She noted that when it comes to hackers, companies have historically had a mindset of “we don’t negotiate with terrorists” but “minds are changing” in this area. “I don’t know if this is right or wrong,” Besharat said. She recently heard a “privacy guru” suggest companies set up bitcoin accounts because hackers prefer to be paid in bitcoin.
One of her colleagues at a “food company in New York” was threatened by hackers recently, she said, and the hackers asked for $2,000. When the company did not pay up, they were hacked again and were asked to give an additional amount. She said in-house lawyers need to be aware that incidents like this can happen.
Stephanie Forshee is based in New York. She covers retail, fintech and in-house legal departments.