Combining
CRM with Privacy and Security
As in any business, either traditional or electronic, a certain amount of risk in transactions is always present. A
element of business success is to put in place strategies and procedures that will mitigate that risk and yet still yield
an acceptable return on investment.
Trites
(2003) presents the following elements of an effective approach to security issues in e-business, which are also applicable
to traditional business functions as well:
·
Identify risks
·
Detemine the costs of those risks
·
Calculate the costs of covering those risks
·
Make hard decisions |
CRM
-
Return on
Investment (ROI) is calculated based on the amount of revenue gained from business activity; however, managers often fail
to measure accurately the impact of CRM. Gessner and Volonino (2005) argue that an effective Business Intelligence (BI) strategy,
including a fully integrated CRM, can maximize the value of each customer. An effective CRM strategy that is integrated with
its BI strategy measures the impact of customer management over time. The figure below depicts Gessner and Volonio's model
of the customer value chain.
-
By addressing the complete
continuum of customer value, a company can collect a significant amount of specific data. It is one issue in itself to collect
that information accurately and judiciously. Thompson (2005) argues that four companies in particular, Onyx, salesforce.com,
RightNow, SPSS and Sage CRM, are deserving of their Summit Award honours because they have created software that measures
particularily well "in indicators of customer/partner satisfaction, loyalty and project success." (Thompson, 2005)
Privacy
- TRUSTe® is "an independent, nonprofit enabling trust based on privacy for personal information on the Internet. They
certify and monitor web site privacy and email policies, monitor practices, and resolve thousands of consumer privacy problems
every year."
-
According to Apple Computer, Inc.®'s (2006) privacy policy, their registration in the Truste Privacy® program "reflects our promise to tell you what personal information we collect; the types of companies we may
share your information with; the choices available to you regarding the collection, use, and distribution of the information;
the security procedures in place to protect the loss or misuse of information under our control; and how you can correct inaccuracies
in the information. "
- The BBBOnLine, Inc. program is a component of the Better Business Bureau®. As such, its mission is to "promote trust and confidence
on the Internet through the BBBOnLine Reliability and Privacy Seal Programs. BBBOnLine's web site seal programs allow companies
with web sites to display the seals once they have been evaluated and confirmed to meet the program requirements. The BBBOnLine
Reliability Seal confirms a company is a member of their local Better Business Bureau, has been reviewed to meet truth in
advertisement guidelines and follows good customer service practices."
-
The BBBOnLine Privacy Seal "confirms a company stands behind its online privacy policy and has met the program requirements
regarding the handling of personal information that is provided through its web site." The problem with the Better Business
Bureau is that companies voluntarily register with them; companies with poor confidence ratings and negative track records
would certainly avoid doing so.
Internet
Security
-Threats
from the Internet have affected the way businesses design and implement security procedures. According to Carey (2006), "
a significant portion of direct - often targeted - threats poses a huge new risk to revenue, brand equity, business operations,
and critical infrastructure." (p. 1) Anderson (2004) cites the importance of doing a complete security assessment
before implementing a CRM strategy. He feels this will not only deal with the current contentious issues, but it will also
help to plan for future issues as well. Anderson makes the
important point that managers cannot forget to upgrade older machines into the security matrix, because they often serve as
a point of entry.
-
Protective
measures such as encryption, digital certificate or PKI (Public Key Infrastructure) systems, S-HTTP, Secure Socket Layers
(SSL), and firewalls are all designed to increase the levels of security between computers as users transmit and receive data.
-
Paypal was designed as a secure method to process on-line payments. As a division of e-bay, it offers registered users a convenient and safe way to exchange funds. The PayPal system requires users to maintain
an acceptable level of business ethics, including processing payments and shipping goods in an timely manner. It also offers
the option of rating sellers and buyers, a way for consumers to develop confidence in their activities. (PayPal, 2006)
- Yet PayPal is not immune to its own security problems. In 2006, a hole was discovered in the PayPal system that enabled
hackers to go in and re-direct users - a practice known as phishing - to another site where the users were asked to submit
personal information and credit card numbers. The complete report can be found here (Evers, 2006).
-
Awareness & Education
- Many e-businesses and organizations have started to spend more resources on educating the public on Internet
safety and the security of transmitting information via their sites. For example, many businesses now include a specific privacy
policy statement in prominent locations on their websites.
- Apple Computer, Inc.®'s policy is an example of a legal disclaimer and user information that is written in accessible layperson terminology.
However, although Apple specifically refers to their compliance with the Truste Privacy® program, their disclaimer includes the information that "The TRUSTe program covers only information that is collected
through this Web site, and does not cover information that may be collected through software downloaded from the site." The
catch-all wording of this disclaimer may raise suspicion that Apple® software has built-in programs to track and
link customers' activities.
-
The
Chartered Accountants of Canada (CICA) as a legislative body have developed their own privacy initiatives designed to
guide policy and activities of Canadian businesses. Their publication Privacy Compliance: A Guide for Organizations &
Assurance Practitioners is one example of how specific industries within Canada are developing information packages to inform and guide its members.
-
The
Canadian federal government also try to be proactive in its approach to consumer education of privacy issues. On the Office
of the Privacy Commissioner's website, a number information links are provided as is an interactive quiz for consumers to play to test their knowledge on privacy
rights. Take the test here.
-
A more reactive way to inform the public
of the negative issues inherent to the use of the Internet occurs after the fact, when secure data has been hacked and more
often than not, used for malicious or illegal purposes. Often sealing an e-business company's fate, a highly publicized announcement
of a security breach in their operations is somewhat effective in demonstrating the flaws in the system and warning users
to be cautious. Cyveillance®, an online risk monitoring and management company posted this newscast to its website.
-
In
an ironic yet effective twist, an American-based program, TippingPoint is designed to encourage and reward hackers. With this
initiative, hackers are asked to target certain sites and identify the security holes. In order to collect their reward, the
hacker must first agree to report their activities to the company before going public. (Espiner, 2005)
-
The Internet was designed originally as an
instrument to share data, and it still is. Yet the limits to sharing must now be set based on protecting the rights of individuals
and businesses. Few solutions to combat the issues of balancing CRM strategies with privacy and security are without their
drawbacks. An important key to survival in the current business climate is to be well-informed of the risks and not be passive
designers and surfers.