Privacy Policy Principles

Privacy is an issue that's only now starting to resonate with most businesses. Consumers of other generations didn't have much of a problem with businesses selling their information, simply because that sale would typically only garner them a few credit card or magazine offers. Today's consumer, however, is much more worried, and rightly so. If your information appears on a list, it can show up online, accessible to almost anyone. It can also be sold and resold - over and over. Think about it: would you want your personal information - your name, financial records and address - available to almost anyone with the cash to buy it?

That's why smart businesses are starting to consider their customers' privacy, and to set up and communicate clear rules governing the use of personal information. But just what should those rules be? This is an important issue and we wanted to cover it properly. That's why we consulted a company that deals with some very tricky, sticky information.

PeopleFirst makes car loans to consumers online. As such, they're privy to an enormous amount of highly personal information. And if they mishandle it, there go their customers. How do they keep information safe? How do they ensure they're using information only as their customers wish? Chief Privacy Officer Alan Amico explains the principles that should govern an ethical privacy policy.

Privacy Policies Front and Center

The first thing a good privacy policy does is let the consumer know exactly what information is collected. The policy then goes on to explain what is done with that information.

"If a consumer doesn't know what you're collecting and what you're keeping, then I don't think it's really a fair disclosure to the consumer," says Amico. "Secondly, you should let the consumer know what you do with the information. How do you use it day to day in the business? Is it shared with any third party? How long is it maintained? If the consumer stops being a customer of your business, what happens to the information?"

Clearly describe what information is collected and kept, and explain who it's shared with and why, and the policy that's followed after a customer stops patronizing your business.

Can the Legalese and the Length

A privacy policy won't do anyone any good if your policy is in legalese. The next standard a good privacy policy should adhere to is using clear, concise language.

"Privacy policies can be overdone with so much information that it's too much for the customer," says Amico. "That's not in a sense that the customer couldn't comprehend or deal with it, but if it's too lengthy and covers things that perhaps aren't as important as some of the primary topics, I'm not convinced that the customer will focus on it, read it, or appreciate it. So I think it's best to stay away from getting into extreme detail on cookies and who your partners are and things like that."

Explain to your customers in layman's language just what is done with their information, but don't include details the average customer won't understand or care about.

Make it Accessible

The last qualification of a good privacy policy is its accessibility. Store the policy on your site, with a clear link to it on the front page. You may even want - or be required by law - to send e-mails or snail mails to customers.

"At PeopleFirst we've taken great pains to make our privacy policy very understandable and clear and to make sure that our consumers have access to it. We put it on the website in a very prominent spot," says Amico. "We've done direct mail mailings to our customers, as well as e-mailing to our customers, about our privacy policy. That's an important point, because if you don't communicate it effectively, if you're not communicating every opportunity you have, your customers won't know about it and you might miss out on the competitive advantage that a proper privacy policy will give your business."

Of course, some businesses have to collect sensitive information and share it. Customers must be made to understand the circumstances under which such information is shared. In order words, tell them why so they'll understand.

"We're in a business at PeopleFirst where we collect a lot of information," he says. "Obviously when you're applying to a lender, you've got to disclose things ranging from income to assets to social security numbers. At PeopleFirst we found the fact that we tell our customers that we don't share their information with anyone except as necessary to do business is critical in that respect. Customers appreciate that and react favorably."

Privacy concerns aren't the only reason customers do business with one company rather than another, but privacy policies do matter, and your customers will appreciate knowing yours.