Despite Stricter Rules in Europe, U.S. Companies More Advanced in Protecting Data28 April 2006
A new study comparing European and U.S. corporate privacy practices reveals that while European companies impose tighter restrictions on the sharing of sensitive personal data, U.S. companies currently have more sophisticated systems in place to prevent breaches.
The study, sponsored by global law firm White & Case as part of its annual Global Privacy Symposium, which will be held Thursday, April 27 in New York, was conducted by the independent privacy think tank Ponemon Institute. The study surveyed 47 U.S. and European multinationals on eight privacy practices, including privacy policy; communications and training; privacy management; data security methods; privacy compliance; choice and consent; cross-national standards; and redress. The survey questions were reviewed by two European data protection authorities, The Information Commissioner's Office of the UK and The Commission Nationale de l'Informatique et des Libertes (CNIL) in France.
"European companies are much more likely to have privacy practices that restrict or limit the sharing of customer or employees' sensitive personal information and are also more likely to provide employees with choice or consent on how information is used or shared," said David Bender, head of White & Case's Global Privacy practice. "But the research also revealed that U.S. companies are engaging in more security and control-oriented compliance activities than their European counterparts. As a result, U.S. corporations scored higher in five of the eight areas of corporate privacy practice."
Bender adds that ongoing concern about compliance with government rules is the lead driver for both U.S. and European companies' privacy practices. But 50 percent of European and 24 percent of U.S. privacy leaders now believe that strong privacy policies also are an important part of protecting or enhancing their company's brand or image in the marketplace.
"The study further shows that European corporate privacy leaders are more likely to hold the view that their role is inextricably tied to advancing a culture of responsible information use rather than establishing technical or administrative controls over privacy and data protection," said Larry Ponemon, founder of the Ponemon Institute, who led the research team. "In their minds, the most important thing is to convey the need for companies to act responsibly with personal information rather than using enhanced technologies like data encryption to prevent inadvertent breaches."
Among the other key findings:
-- U.S. companies are more likely to have a dedicated privacy officer or
leaders responsible for privacy issues than comparable European
companies. U.S. privacy leaders also tend to have a higher level of
reporting authority within the company than their European
counterparts.
-- Most European companies have a strict "no share" policy for consumer
and employee data. Less than half of participating U.S. companies have
such a policy.
-- U.S. companies are more likely than their European counterparts to
offer privacy training and awareness programs for employees. In
addition, U.S. companies are more likely to impose mandatory training
for all employees who routinely use sensitive personal information.
-- U.S. companies are more likely to employ information security
technologies to protect or safeguard sensitive personal information
than European firms, including the use of encryption, intrusion
detection systems, and Website monitoring. U.S. companies are also
more involved with the review and monitoring of their marketing and
customer contact programs and far more likely to require all vendors,
contractors and other third parties to comply with data security
guidelines and practices.
-- European companies have more rigorous data export controls, especially
when moving personal information about employees and customers, to
non-European Union nations. In addition, European companies are more
likely to incorporate privacy program objectives that focus on data
relevancy and date adequacy.
"European businesses also appear to lean more heavily on their respective data protection authority to get feedback about their privacy programs. By comparison, U.S. companies rely on more sophisticated technology and training programs to impose adequate privacy protections on their operations," said Bender.
In 2004, the Ponemon Institute conducted a similar survey comparing Canadian and U.S. corporate privacy practices and, in that report, Canadian firms outperformed their U.S. counterparts.
For more information or to obtain a copy of the "Benchmark Study of European and U.S. Corporate Privacy Practices," please contact Sandi Sonnenfeld, Media Relations Manager, White & Case at 212/819-8299 or via email ssonnenfeld@whitecase.com.
About White & Case
White & Case LLP is a leading global law firm with nearly 2000 lawyers practicing in 38 offices in 25 countries. White & Case's Privacy practice operates at the forefront of privacy issues and data protection laws. We advise clients on how to adopt sound privacy practices, avoid privacy risks, and protect their competitive advantage. We also represent clients in privacy-related litigation. Each year we host an annual Global Privacy symposium, write articles and publish or sponsor surveys related to complex privacy issues. Visit http://www.whitecase.com.
About the Ponemon Institute, LLC
Ponemon Institute is a "think tank" dedicated to advancing responsible information management practices in business and government. To achieve this objective, Ponemon Institute conducts independent research on privacy and information security, educates leaders from the private and public sectors, and verifies the privacy and data protection practices of organizations. The Institute is headquartered in Michigan. For more information, visit http://www.ponemon.org or contact (800) 887.3118.
Source: prnewswire
All trademarks and copyrighted information contained herein are the property of their respective owners.
The Shield Pro 2006
Related Articles
|
