1. Measures that a company can take to protect a customer's data and
privacy. What are the implications of data protection and privacy for a
multinational company?
By Steven Tomlinson
Student number: 630044285
Total word count: 2894

2. Abstract
This essay will discuss the measures that a company can take to protect consumer data
and privacy in relation to small and medium-sized enterprises (SME’s) as well as
multinational organisations. Furthermore, the essay will analyse the implications of data
protection and privacy for a multinational company by assessing and presenting the evidence
discussed through the use of academic journals and case studies in order to conclude the
argument.
Introduction
The challenge for organisations in the post digital era is to make practical and
effective use of consumer data while also protecting an individual’s privacy choices and
personal information of the user in relation to an organisations digital marketing efforts.
Manyika et al., 2015 states, that the Internet of Things (IoT) has the capacity for
organisations to utilize the various fields of data protection and information privacy by
capturing data, protecting and retaining information by using specific software, hardware and
human resources in order to allow firms to improve their marketing skills and further enhance
their customers quality of life. However, in light of IoT’s data driven processes, organisations
must keep up with the pace of technological improvements and importantly, the regulations
that relate to the laws surrounding data protection, privacy, and security compliances in the
EU and USA. Both SME’s and multinational organisations have the ability to control the
information an individual reveals about their selves in order to gain competitive advantages.
However, this is much more difficult for SME’s as they may not have the skills and
knowledge, such as, data warehouses in comparison to larger corporations. For example,
Google has become one of the largest organisations that can harbour vast amounts of
consumer data through the use of web analytics (Chaffey & Chadwick, 2016). In addition,
data mining has created a capability for data regarding an individual to be collected and
collaborated from a variety of sources very easily. However, concerns over who can access
the information stored in servers is a growing phenomenon that companies must be aware of.
For example, emails can be stored on a server but if the information has not been encrypted
correctly web penetration techniques can be used, such as, SQL mapping. Therefore leaving
vulnerabilities on the system that can be exploited by hackers. With this in mind, it is key for
organisations to provide their customers with the knowledge that their personal information is

3. safe and cannot be stolen by hackers or somebody within the organisation (Chaffey, Ellis-
Chadwick, Mayer, & Johnston, 2009).
Measures that a company can take to protect customer data and privacy
Data protection and the law
The protection of data legislation is enacted for the purpose to protect an individual’s
data, privacy and to stop personal information from becoming misused (Chaffey &
Chadwick, 2016).
“Member states shall protect the fundamental rights and freedoms of natural persons (i.e. a
named individual at home or at work), and in particular their right to privacy with respect to
the processing of personal data.” (Chaffey, Ellis-Chadwick, Mayer, & Johnston, 2009).
Data privacy and its legal protection can vary around the world which brings significant
challenges to organisations whom store personal data to achieve and maintain compliance
with various regulations that relate to data protection. The US and EU operate under a Safe
Harbour Privacy Principle program which enables the US to provide personal protection
without breaching the EU national equivalents (Ni Loidean, 2016). In addition, the
regulations are a necessity to an organisations marketing operations as both the US and EU
must provide consumers with information on web analytics and cookies (Chaffey, Ellis-
Chadwick, Mayer, & Johnston, 2009). However, interpretation between the directive
marketing associations are unclear amongst the two parties as the directive was first created
before the internet was invented (Law Review, 2014). For example, Google Spain SL were
asked by an internet user to remove personal information gathered from a simple Google
search that revealed their personal data. The case made it into the Spanish high court which
were subject to the directive therefore requiring Google Inc. to remove the sensitive data
(Law Review, 2014). In addition, the legislation requires that organisations provide and make
security of data a priority by ensuring encryption standards are used therefore allowing
ethical hackers to maintain system safety and data protection (Chaffey & Chadwick, 2016).
Personal Data

4. Although measures are taken to protect an individual’s personal data that an
organisation collects, breaches of personal data and security risks are reported daily (Feri,
Gianetti, & Jentzsch, 2015). Personal data breaches can happen across multiple areas within
an organisations marketing spectrum as everything is accessible over the internet nowadays.
However, a big issue surrounding protection that relates to social networking. For example,
Facebook has 1.23 billion users worldwide (Sedghi, 2016), whereby individuals can be
tagged in photos and have valuable information exposing a digital footprint that is either left
by choice but ultimately most of the time unexpectedly (Sedghi, 2016). This raises concerns
over what information is being shown across the internet because the data can easily be
searched across the web. Furthermore, the data can become accessed by anyone wishing to
seek information online via their profile. Therefore, over the internet you most certainly leave
a digital footprint regarding oneself. For example, unencrypted emails can be accessed by the
email server administrators and also the internet service provider as well as third parties
searching for traffic of a certain connection, are able to gain access to personal contents.
Personal data is supposed to be lawfully processed but unfortunately it can also be unlawfully
obtained. For example, two FBI agents were caught stealing over $800,000 worth of bitcoins
(Smith, 2015). Therefore, it goes to show how important it is for an organisation to act
ethically with consumer data meaning companies should only periodically store personal
information and ensuring their security is up to date, as old security systems, such as,
firewalls, can expose vulnerabilities to unethical hackers which can be used against the users
whereby personal data is stolen from them (Smith, 2015).
Data Mining
Data mining is a process that an organisations uses to search through data warehouses
to find hidden patterns and relationships that relate to the firms consumers data base (Chaffey
& Chadwick, 2016). Therefore, in relation to marketers, the process helps an organisation
identify their customers’ needs by segmenting groups and identifying their individual
requirements through customer data analysis and through the use of web analytics to reveal
insights into a customer’s interests (Chaffey, Ellis-Chadwick, Mayer, & Johnston, 2009). The
increasing improvements in technology has significantly increased data storage, collection,
and manipulation ability. The process is also becoming ever more complex as data sets
increase in size. Therefore, data mining applies these processes to bridge the gap between
statistical data and traditional marketing methods to database management by exploring and

5. discovering algorithms more effectively and allowing to be applied to large data sets
(Chaffey & Chadwick, 2016). The whole process allows an organisation to gain a
competitive advantage through the use of basket analysis. For example, Natwest PLC uses
mining credit card techniques to find indications of fraud (Brown, 2015). For example, when
shopping abroad, the data is picked up by basket analysis that observe the shopping patterns
of the customer whereby any unfamiliar purchases are identified and translated back to the
customer. Furthermore, organisations can facilitate their marketing strategy through sales
forecasting which gives an organisation the opportunity to develop their marketing strategy
through the use of realistic, optimistic and pessimistic projections (Chaffey & Chadwick,
2016).
“UK Chartered Institute of Marketing definition defines marketing as the management
process responsible for identifying, anticipating and satisfying customer needs profitably”
Chaffey, Ellis-Chadwick, Mayer, & Johnston, 2009
However, data mining can be misused unintentionally, whereby producing results
which seem significant but do not really predict the future consumer behaviour, therefore
having little use to the organisation (Heatley & Otto, 1998). Furthermore, not all customer
shopping patterns and algorithms are always valid. For example, trying to distinguish spam
and legitimate emails in a particular data set can be difficult for organisations, especially
SME’s that may not have the required knowledge or skill set to overcome such problems.
Furthermore, data mining may not have any ethical implications, it is still associated with
collecting of personal information that relates to an individual’s behaviour. Therefore, further
raising questions that relate to the privacy of an organisations customer. Data mining also
involves data preparation which can discover patterns and information which could
compromise an organisations privacy obligations, in relation to the law (Chaffey &
Chadwick, 2016). Therefore, a threat to a person’s privacy can arise when the data miner or
anyone that has access to the data set can compile personal information that originally was
anonymous. Furthermore, the EU and US Safe Harbour Principles currently exposes EU
user’s privacy to US organisations. For example, in the Edward Snowden’s worldwide
surveillance disclosure has consequently lead to a discussion between the EU and US to
revoke the policy to which an agreement has not been made (Preibusch, 2015), meaning
private data can be accessed and exposed by the National Security Agency (NSA).

6. Implications of data protection and privacy for a multinational company’s
Digital customer relationship management (e-CRM)
Digital customer relationship management (e-CRM) approach is required to build and
sustain long term business with customers (Chaffey & Chadwick, 2016). The implications of
data protection and privacy for a multinational company is to ensure an organisations e-CRM
components that are measurable by combining the interaction, involvement, intimacy and
influence of personal information across the organisation securely. H Tahir et al 2013 states,
that a customer’s expectations are related to the organisations performance and that if
expectations are too high performance may have a short fall. Therefore it is important for
multination companies, when applying the e-CRM framework, to ensure that they create a
customer value proposition which coincides with their data protection and privacy regimes in
order to gain repeat custom from their customer and competitive advantages.
e-CRM refers to the marketing activities, tools and techniques delivered over the internet
(using technologies such as web sites email data capture warehousing and mining) with a
specific aim to locate, build and improve long term customer relationships to enhance their
individual potential”. (Harrigan, Ramsey, & Ibbitson, 2011).
For many multinational organisations, email marketing is seen as powerful tool for
developing relationships with customers which relate to opt-in email options for customer
retention (Chaffey, Ellis-Chadwick, Mayer, & Johnston, 2009). Therefore, careful planning
of e-CRM is required to protect personal information on a database and integrated with an
organisations tradition customer relationship management (CRM). It is important that
multinational organisations use social media techniques to improve their customer
relationships. Meaning, instead of leaving customer comments unanswered, an organisation
should answer them even if they are negative comments. This creates an opportunity to gain a
competitive advantage by integrating and developing CRM traditional operations; which adds
value to their customers overall experiences, by collecting data, listening to what the
customer has to say, and bringing them closer to the organisation (Chaffey, Ellis-Chadwick,
Mayer, & Johnston, 2009).

7. “Far too many companies that I consult with sit on loads of good consumer data…& do
nothing with it. It’s truly amazing, because in that data is a gold mine of insight”
(Kissmetrics 2016)
A key component of a successful customer relationship is making sense of the vast
amounts of data (Chaffey & Chadwick, 2016). In order for this strategy to work,
multinational organisations are to develop a multi-channel approach whereby they monitor
customer actions and behaviours, then by reacting to them and to monitor the response
(Chaffey, Ellis-Chadwick, Mayer, & Johnston, 2009).
Delighting customers and making a profit
Most importantly the e-CRM, is about making an organisations customer happy while
at the same time making a profit. Tesco’s is a good example of how a company can make use
of their huge data warehouses and how they brought loyalty back to their stores (Manyika et
al., 2015). This initiative has helped Tesco.com establish themselves as a world leading
grocer, that offer many other products and services, with an estimated turnover of £401
million and profits up 37% to 21 million (Chaffey, Ellis-Chadwick, Mayer, & Johnston,
2009). What is most fascinating about Tesco’s digital marketing success is their digital efforts
in Malaysia in 2006 with the introduction of the Club card. Prior to 2006 Tesco’s had
troubles with their mass mailing strategy whereby emails were bouncing or having incorrect
email addresses (Manyika et al., 2015).
“We know that one loyal customer is worth five times a newly acquired customer.
Unfortunately, we had a problem where loyalty was in decline and we felt that we needed to
find a way to thank our important, loyal customers,” (Manyika et al., 2015).
Tesco’s developed consumer interest by gathering data from Nielson and other
researchers which helped them to shape new products and innovative ideas. By combining
the data gathered with the Club card, which includes data on consumer behaviour, and
marketer trends (Manyika et al., 2015). Tesco’s were better equipped at understanding their
customer through the use of data in order to get closer to their customers.

8. “When customers shopped, we started to fill information as we tried to prove our
understanding of the consumers as individuals. We started to look at how we catered our
approach, personalised our offers and enabled Tesco to make viable business decisions. If we
can speak to you as individuals, ultimately we can win your loyalty,” (Manyika et al., 2015).
For example, the multinational organisation targeted segments of their market to reduce cost
by pin-pointing who and where their customers were which meant they could assess the
impact and opportunity costs in relation to where they built their stores. This significantly
improved their understanding of purchasing habits amongst their customer database.
Rewarding customers is only one way that a multinational organisation can add value
to their customer relationship (Chaffey & Chadwick, 2016). As seen in the Lands’ End case
study, this organisation has shaped their products with innovative marketing ideas. Lands’
End is a worldwide direct merchant of clothing and products for the home sold through their
catalogue or the web (Rappa, 2008). Much like Tesco, Lands’ End were able to offer their
customers a unique shopping experience and were able to get closer to their customers by
doing so. Furthermore, Land’s End use their digital capabilities, regarding their extensive
web site offerings, by offering a unique and quality shopping experience (Rappa, 2008). In
addition, the organisation has managed to facilitate intellectual property rights, such as, Shop
with a Friend and Wardrobe Wizard, which further strengthens their customer value adding
proposition by shaping new products with innovative marketing campaigns.
Conclusion
In conclusion, the rise and fast pace in technological improvements opens up many
new opportunities for organisations, both SME’s and multinational. However, in light of
IoT’s data driven processes it is much more difficult for SME’s as they may lack the required
skill set in comparison to multinational organisations. Moreover, there is a growing concern
over the protection of customer data and privacy and how this personal information is being
shared and stored within an organisation. For example, web penetration techniques are used
by unethical hackers and even security agencies to obtain sensitive data regarding oneself.
Therefore, it is key organisations keep their systems and practises up to data in order to keep
their consumer data private and away from unethical motivations. In addition, organisations
across the globe must stay within the law regarding customer data. However, this is difficult
as the laws between the EU and US differ which can leave customer data vulnerable to third
party attacks. In addition, data mining can be misused unintentionally therefore it is important
that organisations are fully aware of procedures and law regarding their customers privacy

9. rights. Furthermore, by integrating and effective customer relationship management (e-CRM)
and careful planning of it is required in order for organisations protect personal information
on a database. This creates an opportunity for the organisation to gain a competitive
advantage over competition and adding value to their customer experience. Therefore, it is
about delighting the customer while making a profit and to insure that information and data
of their customer online is used correctly and within the law. Tesco’s and Lands’ End are a
good example of how a successful marketing campaign can produce results. The two
companies have set out to get closer to their customers by offering unique products and
services with innovative marketing ideas. Furthermore, these initiatives have helped the
organisations to strengthen their customer value proposition.
Bibliography
Brown, C. (2015). NatWest data campaign. Precision Marketing, 14(43), 1–4.
Chaffey, D., & Chadwick, E. (2016). Digital Marketing: Strategy, Implementation and
Practise (6th ed.)
Chaffey, D., Ellis-Chadwick, F., Mayer, R., & Johnston, K. (2009). Internet Marketing:
Strategy, Implementation and Practice (4th ed.)Pearson.
Feri, F., Giannetti, C., & Jentzsch, N. (2015). Disclosure of personal information under risk
of privacy shocks. Journal of Economic Behavior & Organization, 14(30),
Harrigan, P., Ramsey, E., & Ibbotson, P. (2011). Critical factors underpinning the e-CRM
activities of SMEs. Journal of Marketing Management, 27, 5–6.
Heatley, S., & Otto, J. (1998). Data Mining Computer Audit Logs to Detect Computer
Misuse. International Journal of Intelligent Systems in Accounting Finance & Management,
7(3), 125–134.
Kissmetrics. (2016). Customer intelligence & web Analytics. Retrieved March 23, 2016, from
https://www.kissmetrics.com/
Law Review, H. (2014). HARVARD LAW REVIEW. INTERNET LAW — PROTECTION
OF PERSONAL DATA — COURT OF JUSTICE OF THE EUROPEAN UNION CREATES
PRESUMPTION THAT GOOGLE MUST REMOVE LINKS TO PERSONAL DATA UPON
REQUEST, 128(735),
Manjur, R., Ismail, N., Pandey, R., Chan, J., Writer, S., Salim, H., & Davy, A. (2014,
October 20). Case study: How Tesco brought loyalty back to its stores. Retrieved March 23,
2016, from Agencies, http://www.marketing-interactive.com/case-study-tesco-brought-
loyalty-back-stores/
Manyika, J., Chui, M., Bisson, P., Woetzel, J., Bughin, J., & Aharon, D. (2015, June). THE
INTERNET OF THINGS: MAPPING THE VALUE BEYOND THE HYPE
Ni Loidean, N. (2016). THE END OF SAFE HARBOR: IMPLICATIONS FOR EU
DIGITAL PRIVACY AND DATA PROTECTION LAW. Journal of Internet Law, 19(8),

10. Preibusch, S. (2015). Privacy Behaviors After Snowden. Communications of the ACM, 58(5),
48–55.
Rappa,M. (2008). Managing thedigitalenterprise.RetrievedMarch24, 2016, from
http://digitalenterprise.org/cases/landsend.html
Sedghi, A. (2016, January 29). Facebook: 10 years of social networking, in numbers. The
Guardian. Retrieved from
http://www.theguardian.com/news/datablog/2014/feb/04/facebook-in-numbers-statistics
Smith, A. (2015, September 1). Ex-fed in silk road case stole $820, 000 in bitcoins. CNN.
Retrieved from http://money.cnn.com/2015/09/01/technology/fed-bitcoin-silk-road/
Citations, Quotes & Annotations
Brown, C. (2015). NatWest data campaign. Precision Marketing, 14(43), 1–4.
(Brown, 2015)
Chaffey, D., & Chadwick, E. (2016). Digital Marketing: Strategy, Implementation and
Practise (6th ed.)
(Chaffey & Chadwick, 2016)
Chaffey, D., Ellis-Chadwick, F., Mayer, R., & Johnston, K. (2009). Internet Marketing:
Strategy, Implementation and Practice (4th ed.)Pearson.
(Chaffey, Ellis-Chadwick, Mayer, & Johnston, 2009)
Feri, F., Giannetti, C., & Jentzsch, N. (2015). Disclosure of personal information under risk
of privacy shocks. Journal of Economic Behavior & Organization, 14(30),
(Feri, Giannetti, & Jentzsch, 2015)
Harrigan, P., Ramsey, E., & Ibbotson, P. (2011). Critical factors underpinning the e-CRM
activities of SMEs. Journal of Marketing Management, 27, 5–6.
(Harrigan, Ramsey, & Ibbotson, 2011)
Heatley, S., & Otto, J. (1998). Data Mining Computer Audit Logs to Detect Computer
Misuse. International Journal of Intelligent Systems in Accounting Finance & Management,
7(3), 125–134.
(Heatley & Otto, 1998)
Kissmetrics. (2016). Customer intelligence & web Analytics. Retrieved March 23, 2016, from
https://www.kissmetrics.com/
(Kissmetrics, 2016)
Law Review, H. (2014). HARVARD LAW REVIEW. INTERNET LAW — PROTECTION
OF PERSONAL DATA — COURT OF JUSTICE OF THE EUROPEAN UNION CREATES
PRESUMPTION THAT GOOGLE MUST REMOVE LINKS TO PERSONAL DATA UPON
REQUEST, 128(735),
(Law Review, 2014)

11. Manjur, R., Ismail, N., Pandey, R., Chan, J., Writer, S., Salim, H., & Davy, A. (2014,
October 20). Case study: How Tesco brought loyalty back to its stores. Retrieved March 23,
2016, from Agencies, http://www.marketing-interactive.com/case-study-tesco-brought-
loyalty-back-stores/
(Manjur et al., 2014)
Manyika, J., Chui, M., Bisson, P., Woetzel, J., Bughin, J., & Aharon, D. (2015, June). THE
INTERNET OF THINGS: MAPPING THE VALUE BEYOND THE HYPE
(Manyika et al., 2015)
Ni Loidean, N. (2016). THE END OF SAFE HARBOR: IMPLICATIONS FOR EU
DIGITAL PRIVACY AND DATA PROTECTION LAW. Journal of Internet Law, 19(8),
(Ni Loidean, 2016)
Preibusch, S. (2015). Privacy Behaviors After Snowden. Communications of the ACM, 58(5),
48–55.
(Preibusch, 2015)
Sedghi, A. (2016, January 29). Facebook: 10 years of social networking, in numbers. The
Guardian. Retrieved from
http://www.theguardian.com/news/datablog/2014/feb/04/facebook-in-numbers-statistics
(Sedghi, 2016)
Smith, A. (2015, September 1). Ex-fed in silk road case stole $820, 000 in bitcoins. CNN.
Retrieved from http://money.cnn.com/2015/09/01/technology/fed-bitcoin-silk-road/
(Smith, 2015)