Interview with Tess Koleczek

October 2004

Terry McQuay, Nymity's President, interview with Tess Koleczek, Chief Privacy Officer at E-LOAN, reviews the privacy considerations at E-LOAN specifically related to off-shore outsourcing. E-Loan offers their customers a choice of having their loan applications processed in United States or off-shore.

Nymity: Tess, please introduce E-LOAN and the outsourcing data processing option you offer your customers.

Koleczek: E-LOAN, Inc. (www.eloan.com) is an online consumer direct lender offering borrowers a variety of mortgage, auto and home equity loans. Last year, E-LOAN originated over $6 billion in consumer loans.

Protecting consumers' financial privacy is a paramount concern, prompting E-LOAN to implement industry leading privacy practices and advocate strong consumer financial privacy protection laws. In June 2004, an independent study conducted by TRUSTe and The Ponemon Institute ranked E-LOAN as one of the top 20 most trusted companies for privacy in America . E-LOAN was the highest ranked online financial services company to make the top 20.

In early February of this year we launched an offshore outsourcing pilot program that is limited to back-office underwriting functions for our home equity applications. We chose one of the most respected and experienced outsourcing companies - Wipro Spectramind ( www.wiprospectramind.com ), the global technology services division of Wipro Ltd., which is traded on the New York Stock Exchange. This outsourcing program enables us to provide faster service due to the time offset. Essentially, as we close our business day in the US , India begins theirs. This 24-hour processing capability enables us to fund loans one to two days faster - in 10 days vs. 11 to 12 days - than if they were processed entirely in the US . The program also keeps us competitive in the marketplace - outsourcing in the lending industry is widespread; it's part of the reality of doing business today. With offshoring being such a hot topic, particularly from a privacy perspective, we felt an obligation to disclose this practice to our customers and offer them the choice of processing their information domestically.

Nymity: Why did you find it necessary to offer this option to your customers?

Koleczek: In everything we do, we strongly believe honesty is always the best policy. We also believe that two key components of protecting consumers' privacy are disclosure about how customer information is used and consumer control over how this information is used. These beliefs led us to disclose the details of offshore program to our home equity customers before they complete their application - including the faster time processing benefit - and give them a choice to opt out of the program and have their entire transaction processed domestically.

Nymity: What percentage of your customers choose to have their processing in the US ?

Koleczek: Currently 87% of customers selecting the overseas option. That number has been slowly increasing since we began the program.

Nymity: Was this percentage a surprise?

Koleczek: Quite frankly it was. While we believed that disclosing the program, providing a choice and explaining a time benefit would be appreciated by consumers, we didn't think the numbers would be as high as they have been from the start. However, the results of our program support the idea that when you make the effort to explain the "what, where & why" to consumers, they are comfortable with it.

Nymity: Of the customers that opt-in to having their information processed in the US , what are their major motivators?

Koleczek: Although we haven't conducted any formal studies to discover why approximately 15% of our customers have chosen domestic processing, it's not a stretch to assume that in addition to lingering privacy and security concerns, there are many people who associate offshoring with unemployment and the loss of jobs in this country. This association may prevent them from being agreeable to participating in our program.

Nymity: For those that have privacy concerns, why do they perceive a higher risk when their information goes off-shore?

Koleczek: There's a vision out there that has an overseas worker wearing a sinister look, waltzing out the door with a million social security numbers. Or there are stories in the press about overseas employees holding information hostage for more money. The fact is that reputable companies that provide these services go to great lengths to prevent such occurrences - possibly even greater lengths than most domestic companies, simply because repeated occurrences of these type of events would result in a catastrophic loss of business and reputation. It could cripple the outsourcing industry as it is today.

For our part, we make sure that we're only dealing with reputable service providers. We don't send paper documents overseas, and information is never stored locally in these offshore locations, but merely viewed by employees. We use technological solutions for data transfer, with full cooperation and assistance from these service providers, to protect the privacy and security of our customer information.

Nymity: Your privacy policies indicate that the laws of the land are not sufficient to protect personal privacy - why do you make this statement?

Koleczek: Federal laws on privacy do very little to put control of information in the hands of the person who actually owns it - the consumer. California passed SB1, which went into effect on July 1 of this year. It is a real victory for consumers and requires financial institutions to get explicit consent from a consumer before sharing their information with unaffiliated third parties, and gives consumers the chance to opt-out of data sharing with affiliates. Unfortunately some of the very parties in the financial industry that helped negotiate the final language of the bill are now challenging it in the court system. I think they fear that giving consumers control over information will somehow cause the sky to fall. We think the results of our program demonstrate that this isn't the case; demand for our outsourcing program is actually outstripping our current capacity.

Nymity: Has the Patriot Act had any impact on your business or privacy policies?

Koleczek: No.

Nymity: Will California 's new outsourcing legislation (SB 1451) impact E-LOAN?

Koleczek: No, it shouldn't. Once customer information comes through our doors, we feel an obligation to treat that information with the same level of respect, no matter who we have processing it. If it's going to a service provider, we contractually obligate them to treat that information with the same standard of care that we do ourselves, whether that meets or exceeds applicable law. From start to finish, we're accountable for what happens to that information, and that's really all SB 1451 is demanding.

Nymity: Do you see off-shore outsourcing becoming a large issue for US companies? Is it a privacy issue?

Koleczek: I believe overseas outsourcing is already a large issue for many US companies. More and more companies are electing to move work offshore because the economic benefits and competitive pressures. It's no longer a fad, but a reality of doing business.

As far as it being a privacy issue, if outsourcing (regardless of location) is done right, privacy concerns should be adequately addressed. We disclose offshoring up front and do our best to assure people that their information is protected, and we build in the technology to support that claim. I believe that if this was the standard operating procedure for companies that use offshore service providers, the issue as far as privacy is concerned would fade.

Nymity: In closing, do you see any risk to Canadian firms that act as outsourcers for US firms?

Koleczek: There will always be risks associated with outsourcing. It's up to the service provider to determine where on the scale they want to be regarding privacy risk. Success will come to companies that address the issues of security in the transfer and handling of data, the privacy protections they implement, employees they hire, security of equipment and facilities and so on. If they offer a product that demonstrates to potential customers that this is a well-developed process that meets or preferably exceeds the requirements for the protection of personal information, they should not only minimize risk, but also be successful.