tag:blogger.com,1999:blog-43617422691196224262011-04-21T19:19:02.557+01:00Tim Williams blogs on current and future trends in Information Security.Tim D Williamshttp://www.blogger.com/profile/14377948130159867436noreply@blogger.comBlogger21100tag:blogger.com,1999:blog-4361742269119622426.post-46638976224891457872009-03-22T00:22:00.004Z2009-03-22T00:39:42.401Z<span style="font-family:arial;color:#000066;">Right now, even if you live in a European country (so compared with many other countries, you benefit from above-average data protection legislation), in reality you have very little control over what companies actually do with your data.</span><br /><span style="font-family:arial;"><br /><span style="color:#000066;">Once companies have your data, in most cases they control: </span><br /><ul><li><span style="color:#000066;">why your data is used? for what purposes?</span></li><br /><li><span style="color:#000066;">how your data is used? what is it linked to? how is it processed? how is it presented?</span></li><br /><li><span style="color:#000066;">whether it is backed up? when it is deleted i.e how long they keep it ?</span></li><br /><li><span style="color:#000066;">which fields they change?</span></li><br /><li><span style="color:#000066;">who can access it internally? which departments/roles/individuals?</span></li><br /><li><span style="color:#000066;">who they share it with externally? which companies? which government departments?</span></li><br /><li><span style="color:#000066;">where it is stored? where they share it? which countries it is exported to?#</span></li><br /><li><span style="color:#000066;">what level of protection is applied? </span></li><br /><li><span style="color:#000066;">what level of auditing is done?</span></li></ul><p><span style="color:#000066;">The current state of affairs is clearly not good for individuals/consumers ... but I happen to think it is not good for business either...</span></p><p><span style="color:#000066;">If individuals have no control over what happens to their data then it is difficult for them to trust the companies they are dealing with. If they don't trust who they are dealing with then they probably do less business with them than they would do if trust was there.</span><br /></p><p><span style="color:#000066;">What I am proposing in this blog is that far-sighted companies who want to build maximum levels of trust with their customers (thereby positioning the company to sell a broader range of products and services to their customers) will start to provide their customers with more control over what happens to their personal data.</span></p><p><span style="color:#000066;">In these days of customer-self service where most customers already know how to 'point and click' on a web page to create and update their own profiles, it would not take much effort to provide customers with better fine-grained controls over what happens to their data.</span></p><p><span style="color:#000066;">How about these for features that every self-respecting company should in future want to include in their 'update profile' customer web pages:</span></p><ol><li><span style="color:#000066;">table listing trading partners including checkboxes that allow the customer to choose which partners their data may/may not be shared with</span></li><br /><li><span style="color:#000066;">table listing countries including checkboxes that allow the customer to choose which countries their data may/may not be exported to</span></li><br /><li><span style="color:#000066;">a drop-down list for how long the customer allows the data to be retained without asking again?</span></li></ol><p><span style="color:#000066;">Please comment if you have any view(s) on this....</span></span></p><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/4361742269119622426-4663897622489145787?l=timdwilliams.blogspot.com' alt='' /></div>Tim D Williamshttp://www.blogger.com/profile/14377948130159867436noreply@blogger.com0tag:blogger.com,1999:blog-4361742269119622426.post-53923274284237385652009-03-21T22:27:00.000Z2009-03-21T22:36:09.115ZWhy is it that companies think it's OK to call their customers and ask customers for their ID, but they don't have any way to prove their ID?<br /><br />Isn't it just asking for trouble if companies 'train' their customers to give out their ID to unidentified callers?<br /><br />Wouldn't it be so easy for companies making outbound calls to let their potential customers ask them safe confidence building questions first, like what's the first digit and the fifth digit of my account number? <br /><br />Even if such minor details were occasionally disclosed to someone who wasn't actually their customer, the data would not be useful to any wrong-doer, and the benefits of all customers not giving out sensitive data to random callers would far exceed any risks.<br /><br />I'm very interested to know what other people think about this idea. Please comment...<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/4361742269119622426-5392327428423738565?l=timdwilliams.blogspot.com' alt='' /></div>Tim D Williamshttp://www.blogger.com/profile/14377948130159867436noreply@blogger.com0