Interview with Susan Oliver

March 2006

Interviewee: Susan Oliver, Chief Privacy Officer, Cornerstone

Interviewer: Terry McQuay, President of Nymity

Subject: Privacy Considerations when Renting Consumer Information

Nymity: Susan, congratulations on your appointment as Cornerstone's Chief Privacy Officer. There is growing interest related to the privacy practices surrounding list brokers and list managers. Please start by explaining these businesses.

Oliver: Thank you Terry. The list industry involves a number of different entities – all of whom play a role in the management and brokering of permission-based lists. List Managers represent the interests of list owners, promoting their lists to brokers and marketers. List managers provide ongoing information on costs and counts, receive orders and coordinate sample mail pieces, email creative and telemarketing scripts for list owner approval. List Brokers are responsible for list research to find lists that meet the targeting criteria of the marketer. Brokers negotiate pricing, coordinate sample mail pieces, place orders with list managers and ensure on-time delivery of the orders. They also coordinate invoicing and provide expertise and tools in the list response analysis process.

Nymity: What assurances do list broker have that the list provider has the individual's consent and are complaint with privacy laws?

Oliver: A reputable list broker will take several steps to ensure that the list owner has complied with existing privacy laws. This includes getting the list owner to sign a warrant verifying their compliance as well as securing a sample of the notice that has been provided. This allows the list broker to make a decision about whether or not to recommend a list to a Client. Good brokers and their Clients know that a 3rd party list based on sound notice and consent is ultimately a better performing list.

Nymity: Who is ultimately accountable?

Oliver: Ultimately, I think we’re all accountable for compliance – that’s certainly been our view at Cornerstone. Technically however, under PIPEDA, BC’s PIPA and Quebec’s Privacy Laws, the list provider is accountable, although the list broker could certainly be drawn into an investigation. However, in Alberta both the list provider and the list broker can legally be held accountable. At the end of the day, a list broker plays a critical role in protecting Clients from any risk to reputation by ensuring, as best they can, the compliance of the lists they broker.

Nymity: How does opt-out work when a using a rented list?

Oliver: List owners provide updates of their file, reflecting any recent opt-out requests from customers, to their list managers on an ongoing basis. When mailers use a rented list and the consumer wants to know the source of their name and/or to opt-out, they will typically do two things:

1. include this individual in their own “do not promote” file and
2. refer the consumer back to the list broker.

At Cornerstone, it is our policy to facilitate any consumer inquiries and/or opt-out requests with the list owner.

Nymity: What security, use, retention and use controls are in place? What are the provisions in a contract?

Oliver: Typically, list owners will include most or all of the following requirements from marketers in their list rental agreements:

1. a sample direct mail piece, email creative or telemarketing script for approval;
2. specification of one-time use;
3. specification of a data retention period;
4. requirement to use CMA suppression files;
5. requirement to abide by Canadian privacy law and other relevant provincial or federal legislation; and
6. data security requirements.

Nymity: Many organization's online privacy policies state that the organizations doesn't sell consumers personal information. Would this be equivalent to renting personal information? Are organizations being devious by saying the don't sell, but rent it instead?

Oliver: I think that the terms “sell” and “rent” tend to be used interchangeably. If an organization states that they don’t “sell” consumers personal information this is intended to convey that their information will not be made commercially available. However, many organizations use terms such as “share” or “make available” to convey that the consumer’s name and address may be rented.

Nymity: What are the privacy issues related to renting lists of email addresses?

Oliver: The email environment is distinct and it’s important for legitimate marketers to do things to differentiate themselves from spammers. It all starts with renting a privacy compliant list. Marketers must also be sure that the email message clearly identifies both the marketer and the list owner (source of the email) and provides the recipient with a simple and easy-to-use email means to opt-out of receiving further email marketing communications. And in addition, marketers must follow proper email conventions in order to avoid being caught in spam traps.

Other privacy issues related to renting lists of email addresses involves complying with other SPAM laws such as the US CAN-SPAM Act. When U.S. email marketers rent a list that is owned, managed and deployed by a Canadian firm, they are not required to follow CAN-SPAM. On the other hand, if marketers are renting a list owned, managed and deployed by a U.S. firm, the list owner has the right to ask them to follow CAN-SPAM legislation.

Nymity: Do you see most organizations going to opt-in consent for the sharing of email addresses?

Oliver: Most commercially available Canadian-based email lists are opt-in. The CMA has led the charge in this regard. As of April 1, 2004, any organization who is a member of the CMA cannot send email marketing communications without the express consent of the recipient, except where there is an existing business relationship. And list owners who are members of the association cannot disclose a consumer’s email address to any third parties without opt-in consent. So for the association’s members, opt-in has become the standard.

Nymity: What are the notice requirements for organizations that rent consumers personal information?

Oliver: List owners must provide consumers with notice of this purpose at the time they are collecting personal information or if that is not practical, prior to making the consumer’s name available for rental. As most commercially available lists include name and address information only, most give the consumer the opportunity to opt-out of this use of their information.

Nymity: Is it common for List Brokers/ List Managers to have Chief Privacy Officers?

Oliver: Many list brokers and managers are based out of the United States. I’m not sure what they do. I would assume that Canadian List Brokers / List Managers have designated privacy officers, however Cornerstone may be unique in having a Chief Privacy Officer. Because our business revolves around the responsible management of our Clients' customer information, we believe that having a senior level individual in charge of Privacy is important for the business.

Nymity: As Chief Privacy Officer, where do you focus your efforts?

Oliver: Externally, I focus on the ever changing privacy environment and working with our industry association to ensure that we continue to enjoy a balance between the legitimate privacy rights of Canadians and the legitimate need of businesses to use personal information. Internally, my focus is on monitoring our compliance with our own privacy policies, existing laws and industry guidelines and employee training.

Nymity: As a subscriber of Nymity's PrivaWorks program, how has this program helped in your privacy initiatives?

Oliver: Unlike other resources I’ve explored, PrivaWorks provides a wealth of information, analysis and tools that have a very practical application in our organization’s day-to-day privacy management.

Nymity: In closing, what changes do you expect the marketing community would like to see in the 2006 PIPEDA review?

Oliver: I think the marketing community believes that PIPEDA as it currently exists strikes a balance between the needs of consumers and the needs of business and that for the most part it’s working well.