FinTechs & Startups at the Regulatory Crossroads

FinTechs and startups are now at a regulatory crossroad. Though they have largely existed in an environment of self-regulation, these halcyon days are almost over. State and Federal government voices are starting to express a need for more formal oversight. Regulators are struggling with the balance between protections of end users and not impeding the company’s abilities to foster innovation.

Small companies like FinTechs and startups, either as a standalone entity or as a vendor/service provider to a larger firm, have historically had major challenges with their compliance controls specifically, and with attention to data privacy in general.

Large established firms, especially in highly regulated industries (e.g. financial service, life sciences, pharmaceutical, etc.) are sometimes reluctant to do business with these smaller firms as they represent considerable risk if their controls are not in order.

Because FinTech may not currently be directly subject to traditional regulators, compliance with established laws [e.g. anti-money laundering (AML), Know Your Customer (KYC)] is difficult to measure and monitor. Here is the essence of the regulatory concern: with no direct regulation per se, customers may not understand that the traditional consumer protections they have been accustomed to with larger firms may not apply, since those protection laws wouldn't be extended to consumers who might do business with that company.

Since this may be a new paradigm for these smaller firms, I want to call attention to six general trends in the privacy space that FinTechs and startups would be well advised to be aware of as they try to ‘move up’ into the big leagues and improve their visibility with brand name, world-class firms.

They are:

1.    Shifting demographics (i.e. focus and emphasis on millennial’s impact to your business) necessitate a new and different approach to the understanding of ‘customer privacy.’

2.    Customers are savvier than ever of their privacy rights and expectations. They are not reluctant to express their concerns – especially on social media.

3.    The rise of class action law suits represents a continuous risk to companies of all sizes, but can be especially destructive to a small firm with limited capital and resources.

4.    There has been a constant revision of what is considered "personal information" and the scope is getting wider. Almost any data collected by a small firm is likely subject to protection of some kind.

5.    There has also been a constant revision or addition of increasingly restrictive state privacy and security legislation which threatens many small startups with potentially overwhelming compliance overhead. Most small firms either lack the in-house expertise to sufficiently deal with all that is required from a compliance perspective, or they may just not be aware of what is expected from them.

6.    Most regulators are showing an increased attention on consumer protection. Even if companies are following the letter of the law, if there is evidence of customer harm, a regulator may take action.

The message here should not be construed as all doom and gloom. FinTechs represent major disruptive possibilities across many industries, and consumers will be the ultimate beneficiaries. However, companies need to be cognizant of their corporate citizen responsibilities. Sure, consumers love a sexy and easy to use interface, but features and user experience shouldn’t override cyber security and privacy concerns and obligations.

Innovators in this space should devote reasonable time and resources to regulatory compliance. At the end of the day, good privacy is good business! 

Work in Privacy? Then you’re also in Sales!

My career in Privacy actually started out in information security (we called it 'Information Protection' in my firm. Other employees who thought we were too zealous in our mission called it "Information Prevention," But that's another story). I made the leap from the e-commerce team where I was initially working to the InfoSec team primarily because the dot-com bubble had burst and there appeared to be limited possibilities in e-commerce. The other reason was that the InfoSec team was then a small group almost exclusively composed of talented guys who were incredibly technical, but lacked in networking skills (by design!). Their only ask was to keep doing exactly what they were doing: heads down coding, monitoring, testing and tinkering with technologies. What they did notwant to do was talk to people, especially other people who were not technical and could not grasp the importance of what they were doing – keeping the company safe and secure.

During my interview to join the team, I positioned my value proposition as this: I don’t possess the same level of technical ability as these guys on the team but I have a lot of soft skills that this team could benefit from. I could be the voice or face of Information Protection, and propagate the message, value and importance of security (and ultimately privacy), and the onus of employees to behave and act in the right way to protect the company just as much as the Info Sec team does. (We take this for granted today, but keep in mind that this is over 16 years ago and everyone just thought ‘Well, that’s the Security guys’ job! Not mine”).

So in addition to some InfoSec ‘lite’ duties I assumed, I took my primary responsibility to be ‘selling’ the benefits of data security within the organization. That is, ‘why is it a good thing’? What is the value to this organization to be able to tell a compelling story to clients of a prudent grasp of data security by allemployees – not just the InfoSec team?

I eventually evolved my role to be the Chief Privacy Officer of the company. More than ever, I kept with me the duty of ‘selling,’ now the 'product' of privacy, to the organization, and our clients. In some ways it was, and remains a bit more complicated of a sales pitch than security. Employees’ understanding has evolved to understand the need for security in an organization; Privacy, on the other hand, is a bit more nuanced of a pitch. It takes a little more finesse to tease out the benefits of privacy by design, for example,  than say, the act of changing your password every 90 days does.

As I’ve written before, it is becoming thankfully much easier to get people to appreciate the intrinsic value of privacy in products and/or services. Privacy, I’ve always asserted, is different than vanilla data security; it’s special. It’s accessible. Since everyone now has either a LinkedIn profile, a Facebook page or both, or their kids have it, we are conscious of the benefits of privacy, and everyone cares about it, or is at least mindful of it. Everyone has a smartphone and everyone goes apoplectic if they think they’ve lost it – and the thought of everything in it. Not because the phone or the contents contained therein are not replaceable, but because it means that a little bit of their private space has been lost. And so the art of the sale’s pitch for privacy being baked into products or services is becoming easier.,It is by no means a slam dunk. It is difficult to think of the value of privacy in terms of an ROI, since it is difficult to quantify along the same lines. Yet, your customers know when it is not present, and they will take action accordingly.

So don’t be ashamed, sheepish or even contrite when acting as a 'sales person' for the privacy proposition your product or service promises and will deliver. What’s a great privacy sales pitch? How about the idea that people (i.e. your customers) value their privacy and they want the businesses they do business with to do so too. Consumers want to associate a brand with the notion of privacy, especially if an exchange of sensitive data is involved. At the heart of the matter, though, this is not simply a hollow pitch for a product or services that does not deliver on its promise. If fact, I’d argue that nothing else delivers more value - intrinsically - than by making the assertion, and then delivering what you are selling. (I think the FTC thinks the same way too!)

Is Privacy dead? Or just Modesty?

As you have probably heard before, Sun Microsystems co-founder Scott McNealy famously said: "You have zero privacy anyway. Get over it." But that was said way back in 1999!!  Back then, there was no Facebook, no MySpace, no Twitter, nor LinkedIn; Google was barely a year old.  And privacy was already dead?!? (Where was I? And I still chose the privacy profession??!)

Mark Zuckerberg, CEO and founder of Facebook also once said in an interview that "People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time." And then went on to say that “ …we view it as our role in the system to constantly be innovating and be updating what our system is to reflect what the current social norms are," he said. 

Interesting. So are Facebook and other social networking sites only reflections of what is currently acceptable in society at this point in time? If that is the case, then why must there be laws, for example,  against drunk driving if people should know when to quit (the social norm) and not to do something dangerous like get behind the wheel after too many cocktails? Yet we have had to put laws in place that actually define what is drunk in the legal sense (i.e. blood alcohol level). Self-regulation, at least in this instance of personal behaviour, does not universally work out so well.

So what drives what? Does social media reflect the new normalcy of openness or does it merely provide an outlet for pent–up desire for everyone to engage in a community, share some intimate details with friends (but mostly acquaintances), and attempt to parse the much desired 15 minutes of fame into smaller, longer bits. Are our egos crowding out the sense of Victorian modesty that used to prevail in company of strangers, or even friends? With over a billion users now on Facebook, it is difficult to believe that only the extroverts have inherited the Earth…..

The question is: are sites like Facebook (not the only enabler here) simply the force multiplier that drives the users to reveal more private detail, or rather, just the medium? Social networking sites like FB can be no different than videos like “Girls Gone Wild.” This outlet more than enables bad behavior; it rewards it with some kind of validation and exposure. But then again, should I be able to blame the New Jersey Turnpike for me being caught going 100 miles an hour…..?

Data Privacy Day & My 12 Privacy Resolutions for 2016

In advance of International Privacy Day later this month, I’d thought I’d update my Privacy Resolutions for yet another new year. Here they are in no particular order:

• Continue to unsubscribe from all e-mails, newsletters, magazines, blogs, reddit feeds, etc. that I don't read, never read anymore or never actively signed up for. I clearly know my e-mail address is just going to be sold to other marketers or mailing lists anyway so I’ll at least start to cut down on the clutter. I realize that this might be a relatively futile gesture, but you gotta start somewhere right? Better yet, I’ll create a few junk accounts that I don’t care if they are sold or spammed to. (Where’s Prodigy when you need it?!?)
•  Update and strengthen the passwords that I use for critical, financial and other data heavy websites. Better yet: completely migrate all of my passwords to a password manager app like LastPass, DashLane. I had been using PasswordBox for some time, but they just end of lifed it and I’m not crazy about the new owner’s replacement.  Better yet, use a password randomizer along with a password manager!
•  Stop updating everyone on my location via smartphone apps. No one older than 14 years old one really cares (right?) and I’m probably just letting thieves know I am not home so they can rob me.
•  When putting mail in the mailbox for the Postman to pick up, I’ll never lift the flag anymore to indicate that there is mail in the box. The mailman will find it anyway (they’re good like that). Leaving the flag up tells ID thieves that you have some mail that may contain some interesting personal data. Better yet, never mail anything ever again.
•  Really take an interest in all privacy notices and policies. This may surprise you, but companies are (finally) starting to make an earnest effort to make those documents readable and accessible to laypeople. What had once been just a CYA document written by the attorneys, now contains the future of where your data privacy may reside.
•  Stop using my debit card to make online or offline purchases, or buy gas; use a credit card only. Using a debit card gives a thief direct access to your checking account, making it difficult to prove fraud, and preventing you from taking advantage of consumer protection laws that most credit cards offer.
•  Do a regular exhaustive Google search on myself to see what information is out there so I can see what the blogosphere is saying about me, if anything (!), and make sure it is accurate.
•  Make sure the "Do not track" option is checked by default in all of my browser's settings. Across all devices.
• Use the TOR browser more often. I did download it as an experiment but got tired of the less than mainstream functionality. But that’s the point, no? Not that I have anything to hide, mind you…
•  Helping my business and technology partners better integrate the concept of 'privacy by design' into their business and/or IT development processes; no more bolting it on once the process or application is complete and ready to be rolled out.
•  Finally, take a real hard look at the new GDPR just issued by the European Union. The language and principles in there are but a foretaste of what will likely be part of a US privacy regime in 3-5 years. There are lot of tenets in there that US companies would have difficulty implementing today, but they should imagine a future where they might likely have to implement something like a ‘right to be forgotten.’

What are you doing?

 Happy New Year!

Privacy & Compliance: Why Women & Minorities Need Apply

When I was invited to speak at the Philadelphia Leadership & Diversity Conference last year, my first thought was that I was honored. My immediate second thought was that they must have asked the wrong ‘Al Raymond.’ Now, I’m not the whitest guy on the planet, but if you look at my LinkedIn profile picture you’ll see that, yes, I do have a bit of a St. Tropez tan going on, but I would not be considered the best example of a diversity candidate to speak at a diversity conference. So what value could I bring to the conference, and what could I talk about with any degree of credibility?

When I told my team of the invite and what my first impressions were, they had a bit of a chuckle too. But when I explained to them my struggle for a suitable topic, they reminded me of a few very excellent and insightful points that I had overlooked. I should remember, they told me, that our Privacy team was 87% female. And 50% of those females were minorities. (Our inside joke is that I am the minority candidate on the team). And that they were all very happy where they were in their current careers.

They were spot on. And this got me thinking about what I wanted to talk to the Conference about: the fields of Compliance in general, and Privacy specifically are a fantastic and natural place for female candidate to look for their future careers. I have found that there is something about a female approach to a Compliance or Privacy challenge that varies significantly from a male’s perspective. The women on my team, and women in Privacy in general, bring a very nuanced approach to thinking about Privacy issues and solutions. And it makes sense: Privacy and its kissing cousin, Compliance, are built on a foundation of accordance with laws and regulations. If you know anything about the laws in the Compliance and Privacy space, you know how many shades of gray are involved in the black letter laws. More than 50 shades, for sure. Most laws in our world have enough ambiguity to drive a Jeep Cherokee through, so it helps to have people who can think in terms of gradation, yet be practical.

I speak from experience on how women think differently from men in this space. I started out in information security, and I was primarily focused on protecting data. It was an easy exercise: build a moat around the data and don’t let anyone get to it. Thus, the data is protected; problem solved. But the discipline of privacy differs from information security in that one of the tenets of privacy is the principle of access. It states that an individual should be informed of the existence, use, and disclosure of his/her personal information and should be given access to that information and be able to challenge the accuracy and completeness. That is a whole lot different concept than simply making sure the data center has locks on the doors with hungry Dobermans running around it at nite.

Thanks to my team’s counsel, I spoke to the Conference participants about the worlds of Privacy and Compliance and how they both present a relatively under-publicized and untapped goldmine of opportunities for both women and minorities to seek their professional fortunes. Both are places where people are judged on their merits and accomplishments, and it makes it easier to stand out as star employee that way.

I enjoyed my time in InfoSec and still stay interested in technology and cyber security issues, but the evolution of my professional journey into Privacy, which has allowed me to be surrounded by so many competent and talented women and minorities, has been a force multiplier for my career that plain old hard work just could not have produced alone. It stands as the single best career decision I have ever made. And you can too.

(Lack of) Privacy as a competitive differentiator

I have been struggling with the recently fashionable notion of 'privacy as a competitive differentiator' or 'competitive advantage' for some time now (here and here). And I can see similar struggles in some of the literature posted by my peers trying to 'sell' the idea of our privacy position/program as way of distinguishing oneself from your competition – a truly rational exertion, by the way. The optimist in me sees the potential to show how different (better?) you are than your peers by how you treat customer data, and thus leverage that behavior for some (unknown or intangible) benefit. Maybe this is privacy professionals self-talk to make ourselves feel good about what we do, and rationalize that our activities are not just pedestrian compliance functions. I'm sure, however, actuaries have the same goal. As do accountants, account payable professionals and maybe even custodians - all looking to contribute to the company's overall benefit by 'monetizing' the excellence of their services.

Yet I'm still not convinced we have made measurable progress with the public on this issue. I've yet to hear a groundswell of consumer sentiment in which privacy is the primary motivator to buy a product/service or to switch to that product/service. Sometimes you do hear consumers mention privacy, true, but it always seems to be subordinated to something else – bad customer service, low product quality, rude employees, etc. Not that companies have not tried to quantify how much privacy as a service/feature might be valuable to people. There have been some recent attempts by a few companies (AT&T, AshleyMadison.com, Google) to try and put a price tag on 'privacy,' though the end state in those cases look more like a state of secrecy or 'pay not to be annoyed.'

I think, instead, that the lack of privacy controls or an honest culture of privacy within a company will lead to a disadvantage. If nothing else, what this inverse situation will create is a floor, rather than a ceiling, against which all companies must at least raise their privacy-related behaviors (without already being obligated by regulation, that is). Think about cell phones: how viable would a cell be if it was fantastic in every way possible except that it had a 1 megapixel camera? Game over. To even be considered a contender in the mobile phone space today, you have to have at least an 8 megapixel camera. That's just table stakes. Here is where I see the arms race for privacy programs going as well.

(Some) consumers still see privacy as analogous to air - completely necessary to the existence of the arrangement, but generally not taking notice of it until it is in short supply or not there at all. What we need to do as privacy pros is get better at selling how great breathing is.

Privacy as The Boogeyman

If you’re like me, you might be noticing the frequency with which the perception, concept or practice of privacy increasingly makes its way into our daily life and vocabulary, across different mediums, and in many diverse contexts.

A regular feature I enjoy in my weekend reading is The Haggler column in the Sunday New York Times Business section. Basically, this is a column where readers write in to The Haggler (a.k.a. David Segal) asking him to intercede on their behalf against a company with which they have had some untoward experience and have gotten no satisfaction. People write in to The Haggler for help as if he is Obi-Wan Kenobi (That is, “Help me, Obi-Wan Kenobi, you’re my only hope”).

What I have noticed, and Segal just recently pointed out, was that many companies that The Haggler contacts in an attempt to help resolve the situation for their customer have fallen back on the comfortable position and response of refusing to talk about the disgruntled customer’s case with The Haggler due to the ‘privacy rights of the customer’ – even after the customer has agreed to waive their privacy rights do that The Haggler could act on their behalf! Usually in writing!

Segal notes:

"The Haggler has encountered this sequence of events more than a few times, and it always mystifies. If the real obstacle to discussing a matter is something other than privacy rights, invoking those rights is a very silly idea. Because after those rights are waived, it looks as though the company used a high-minded principle as a cheap excuse."

Excuse indeed. While generally speaking, companies rightly need to and should protect their customers data and transactions with them, it seems as though some companies reflexively use the boogeyman of ‘privacy’ as a reason to not be as transparent or forthright as they should. The ‘diplomatic immunity’ card of privacy should not used as an impediment to satisfaction, especially when the customer has either authorized a third-party to help resolve their disagreement, or otherwise is attempting to bring to light some unethical or questionable behavior by a company.

Transparency in practice and behavior is the present and future for companies who use, collect and process customer data in every format and medium. Period. Using the privacy of the customer as a kind of talisman that can only be understood or appreciated by the company is an outdated and inefficient model way of doing business. Plus, it’s just outright lazy. Companies who are transparent and forthright about their customer’s experience and want to do the right thing by them are also the ones that rank highest in customer service satisfaction surveys. Hiding behind the boogeyman of privacy doesn’t really scare anyone these days. Although it just might scare aware some business.