This document discusses privacy issues related to customer relationship management (CRM). It notes that while consumers complain about privacy, they often do not opt out when given a choice. Organizations only seriously address privacy when pressured by regulators. Both customers and organizations take risks by sharing information, so managing these risks is important for CRM success. The document provides recommendations for what consumers and organizations can do to address privacy concerns in the age of new technologies that capture more personal data.

1. Internet Security and Privacy
Issues in CRM
Jagdeep Singh

2. • The paradox: consumers complain about privacy issues, but, more
often than not, they do not opt out, even when provided the choice.
• Organizations attempt to provide privacy protection in limited form.
• They become serious only when pressured by society, government
inquiry, or regulation to implement appropriate privacy containment
measures.

3. Straightforward Agreement
• (customer or prospect) give something (information, behavior) to
receive something (optimal exchange of products and services). I
(organization) receive something (information, behavior) in order to
give something (optimal provision of products or services).

4. CRM efforts inherently create risks for both
parties entering a relationship.
• The individual’s risk is providing personal and behavioral information
to an organization. In many cases, the individual is unaware that
information is being captured.
• The organization, by taking this information, has a definitive or
implied responsibility to adhere to the individual’s request.
• Both parties take risks to achieve gains. CRM success is somewhat
reliant upon the successful management of these risks.
• A final note: In all business dealings, being honest with the consumer
is definitely the best policy.

5. Data must be secure
• First, the data must not be ‘dropped’(i.e., lost in data transmission, a
file or database deleted or rendered unreadable, or a hard copy
physically lost).
• Second, data must be processed inn a way that ensures only
authorised employees of the organization and/or its partners can
access it. (e.g.: B2B2C)

6. Consumer Privacy Concerns
• The recent explosion in social media use, coupled with expanded use
of the Internet not only for commerce but for many utility functions
such as bill payment, has precipitated an increased awareness of how
much information is being provided to organizations and, thus,
potential risks of privacy.

7. Organization Privacy Concerns
• The executive level position of chief privacy officer (CPO) has become
even more important. This has provided some comfort for
organizations, but ownership and titles do not guarantee successful
execution.
• This person usually has a legal background, and most are attorneys.
• The CPO has executive ownership of all privacy and ethical issues.
• This has provided some comfort for organizations, but ownership and
titles do not guarantee successful execution

8. Their concerns can be categorized into
several areas:
• What information is captured? How and where is the information
captured? What was or was not said, implied, or agreed upon with the
party the information represents?
• How is the information maintained within the organization? Who has
access to the information? What security is in place to maintain the
information? What mechanism is in place to modify the information?
• How is the information being used? By whom? For what purpose?
• Is the organization compliant with current, pending, and planned
regulation for all of the previously mentioned areas?
• Are there global implications that may affect the organization’s attempt to
comply with legal requirements and acceptable privacy and ethical best
practices?

9. What Consumers Can Do
• There are both formal and informal, and one-time and ongoing,
actions that consumers can take to ensure that organizations
recognize and, hopefully, adhere to their privacy needs.
• But the underlying theme is that the consumer must “get smart.”
• No single organization, including the government, will be looking out
for a specific individual.
• Social pressures have precipitated legislation that attempts to protect
the populace at large in certain high-exposure areas. But consumers
must take on the responsibility of ensuring their privacy is intact.

10. PayPal
• PayPal is a service that lets consumers shop online without sharing
their financial information with sellers. Since PayPal is considered a
financial institution under the Gramm-Leach-Bliley (GLB) Act, it
cannot disclose its account holders’ nonpublic personal information
to third parties unless account holders opt in to those disclosures.
• PayPal provides protection against unauthorized payments sent from
the consumer’s financial accounts. If an account is subject to fraud or
unauthorized use, PayPal puts a “Limited Access” designation on the
account.

13. Data Protection & Privacy in the Insurance
Industry
The Information Technology Act, 2000 (IT Act) and the
Information Technology (Reasonable Security Practices and
Procedures and Sensitive Personal Data or Information) Rules,
2011 (SPDI Rules) set out the general framework with respect to
data protection in India.
Emerging technologies usually deal in customer data which can
be used to drive insights related to historical health issues and
behavioural patterns of customers

14. Regulatory Framework Governing
Insurance Companies
• The IRDAI has made it mandatory for all the insurance
companies to ensure the protection and maintenance of
confidentiality of all the information that they have collected.
• IRDAI (Maintenance of Insurance Records) Regulations,
2015 – Pursuant to Regulation 3(3)(b), 3(9) insurers are
required to ensure that: The system in which the policy and
claim records are maintained has adequate security features,
and the records pertaining to policies issued and claims made
in India (including the records held in electronic form) are held
in data centres located and maintained in India.

15. • IRDAI (Protection of Policyholders’ Interests) Regulations,
2017 – Pursuant to Regulation 19(5) insurers are required to
maintain total confidentiality of policyholder information unless it
is legally necessary to disclose the same to statutory
authorities.

16. • IRDAI (Outsourcing of Activities by Indian Insurers)
Regulations, 2017 – Pursuant to Regulation 12 insurers are
required to ensure that the:
• The outsourcing service provider has adequate security policies
to protect the confidentiality and security of policyholder
information;
• Information and data parted to outsourcing service providers
remain confidential; and
• Customer data is retrieved with no further use of the same by
the service provider once the outsourcing agreement is
terminated.

17. Regulatory Framework Governing
Insurance Intermediaries
• Treat all information supplied to them by prospective clients as
completely confidential to themselves and to the insurer(s) to
which the business is being offered
• Take appropriate steps to maintain the security of confidential
documents in their possession, including by way of restricting
access to such information, execution of confidentiality
undertakings, etc.

18. What Organizations Can Do
• First, organizations should ensure that they are, and will continue to
be, in total compliance with all privacy laws and privacy legislation.
• Second, organizations must determine their customer and prospect
privacy and ethical expectations and meet or exceed those
expectations.
• Opt in and Opt out strategy

19. Strategic Steps for Managing Privacy Issues
• Assign privacy strategy ownership
• Supportive technical and business infrastructures
• Create internal awareness
• Analyze each area that can be a source of consumer information
• Identify all locations of captured information in the organization
• Implement hardware and software that ensure data security
• Create a formal privacy policy for internal use, for external partner
use, and for the consumer

20. Information and Privacy Management
Practices
• Timeliness is important
• Talk to customers, employees, and contractors.
• Document the issue.
• Don’t sugarcoat the message.
• Provide support
• Show me the money
• Personalization creates trust
• Notify all potential victims

21. New Technology Implications
• New technologies are rapidly being developed and deployed as CRM
enablers.
• Radio frequency identification(RFID)
• Tollway transponders
• Wireless applications
• Internet of Things