Interview with John Gustavson

September 2004

Terry McQuay, Nymity's President, interview with John Gustavson, President & CEO of the Canadian Marketing Association, as the CMA's Privacy Conference is taking place on September 23rd, 2004.  This years conference focus is Turning Privacy into a Marketing Advantage. 

Nymity: As PIPEDA has been in full effect for eight months, what are now the top privacy concerns of your members?

Gustavson:  Our members have been complying with the basic principles of PIPEDA since our own Privacy Code went into effect and became compulsory for members in 1993. There are a number of administrative requirements, however, as well as rulings from the Privacy Commissioner that now have to be taken into account. Our upcoming privacy conference on September 23 will deal with some of the practical ways our members are dealing with privacy issues, including database management, consent, outsourcing, new customer information and so on.

The second big concern we have is the application of the Act to all commercial activity and our understanding that some small businesses have still not figured out how to comply with the new requirements of PIPEDA. Failure to comply will only lead to tougher legislation. For that reason we issued a paper jointly with the Ontario Privacy Commissioner this past spring to provide guidance to small business in this province.

Nymity: How will this joint paper you completed with the Ontario Privacy Commissioner's Office help small business?

Gustavson:  Well, the paper goes through each of the principles found in Schedule 1 of PIPEDA and tries in a very straightforward and simple way to explain how small businesses can engage in best privacy practices. It’s sort of a primer, not for the sophisticated marketer, but we think valuable information for small business. The paper can be found at our website, www.the-cma.org.

Nymity: How have consumers reacted to PIPEDA and their new privacy rights?

Gustavson:  I think they’re slowly waking up to the fact that business is changing its practices and they do have new rights. We also believe that consumers are starting to pay more attention to privacy policies, particularly where there may be significant amounts of money or sensitive information involved.

Nymity: Are large numbers of consumers complaining to the Federal Commissioners' Office? What industry sectors are receiving the most complaints?

Gustavson:  Generally those sectors that have been covered from 2001 are still receiving the most complaints, particularly where the information is considered to be sensitive. This means that financial institutions are often the target of complaints.

Nymity: Are your members modifying (changed from “mortifying” in original question) consent strategies?

Gustavson:  Our own Privacy Code, which is compulsory for our members, was changed earlier this year and goes beyond the legislated provisions on the issue of consent. We require that any consent, such as opt-out or opt-in, be easy to see, easy to understand and easy to execute. The request for consent must also contain sufficient information for a reasonable person to make an informed decision. Our members are also doing a better job of recording and tracking the consents they receive, which is very important if there’s a subsequent complaint.

Nymity: What are the specific challenges for the retail industry?

Gustavson:  Particular challenges for the retail industry revolve around the in-store acquisition of personal information. Training front-line staff to be aware of privacy policies, to comply with them, and to be able to direct consumers to them, is extremely important for the retail industry. Equally, their front-line staff in call centres must be able to answer questions about the company’s privacy policy.

Nymity: How have your members leveraged privacy to build revenue?

Gustavson:  Obviously the building of consumer trust means a longer-term relationship and repeat buyers. Your next best customer is your immediate past customer and that’s where privacy plays such an important role in building additional revenue over the lifetime value of a customer.

Nymity: What are CMA latest initiatives with the Privacy Commissioner’s Office?

Gustavson:  There are three things that come to mind. First, of course, is the 2006 Parliamentary review of the existing legislation and how we might go forward with that process. The second is our application for funding for a research project to help both the office of the Privacy Commissioner and Canadian business to understand the strong role that a chief privacy officer can play. We have also suggested further research into small business issues and benchmarking that can be used by small business to improve their privacy practices. Finally, we need to continue our education of the staff of the Privacy Commissioner with respect to consent and how it is obtained and used within the context of business transactions.

Nymity: What impact has British Columbia and Alberta's Privacy Acts had on your members?

Gustavson: We were very pleased that these Acts were declared to be substantially similar(proposed). They are, of course, more simple and straightforward than PIPEDA but we are satisfied that we are not seeing the break-up of the national marketplace into ten or eleven privacy regimes. Anyone engaged in a national marketing campaign with any residency in either British Columbia or Alberta will have to pay attention to the differences between these Acts and the federal Act.

Nymity: What are the privacy priorities and future privacy initiatives at the CMA?

Gustavson:  We will continue to educate our members in best privacy practices and continue to offer in-house training sessions both for members and non-members. And, of course, potential amendments to the privacy legislation in 2006 provides a potential threat to the use of customer information for marketing purposes.

Nymity: In closing, what can one expect to learn at the September 23 Privacy Conference; Privacy in Practice for 2004, and can non-CMA member attend?

Gustavson:  This Conference certainly goes beyond the basics of compliance. The program deals with the legislation in practice, the specific issues that have arisen in implementing privacy policies and compliance with the Act, and will get into some of the complexities that people are having to deal with. While still offering our basic in-house training sessions, this Conference takes our privacy education to a more advanced level.