Privacy-information services: The free, the cheap and the pricey
A top affliction of privacy professionals is the growing complexity of privacy laws. The number of jurisdictions regulating data privacy and the number of other laws in which privacy provisions are tucked has increased with no letup since 2000. Like the Lilliputians in Gulliver's Travels, the tiniest jurisdictions are now lassoing their privacy ropes around the mightiest of corporations. Where does this leave those who are charged with keeping their organizations privacy-compliant? Desperately looking for a way to organize news about all of these developments. I recently surveyed the landscape of possible solutions to this problem. What did I find? Three different approaches: free Web sites, newsletters and news feeds; fee-based periodicals; and fee-based databases, such as Nymity's PrivaWorks, Cecile Park Publishing's DataGuidance and law firm Morrison and Foerster LLP's Summit Privacy. What were the pros and cons of each approach? Free sourcesPrivacy leaders with no budget will want to exploit what's free, including these options:
I've been a Daily Dashboard junkie for years, and keep an online collection of links to hundreds of articles featured in the Dashboard. When it comes to analysis of developments in privacy law, many law and consulting firms also offer free newsletters. Table 1 offers a full list, including instructions on how to sign up. Table 1: Law and Consulting Firm Privacy NewslettersA number of firms offer excellent, succinct analysis of developments in data privacy, security and retention.
Source:
Minnesota Privacy Consultants, 2009
The advantage of these sources is that they're free. If you have the time to peruse them, they can keep you current on the most important debates and risks. But these sources aren't designed to provide answers to narrow questions or comparisons across jurisdictions of regulations or risks on a particular topic. Fee-based periodicalsSubscription-based services like the following can greatly leverage a privacy officer’s small budget, and they dive deeper into key privacy topics than free sources do:
Other paid periodicals include Evan Hendricks' biweekly Privacy Times ($350 per year) and Robert Ellis Smith's monthly Privacy Journal ($125 per year). If you're a member of the American Bar Association, you could receive the quarterly SciTech Lawyer, and IAPP members receive the monthly Privacy Advisor. The privacy commissioners of Canada and Italy each issue their own newsletters (see here for Canada, and here for Italy), while members of the French association of privacy correspondents, AFCDP, also receive an excellent newsletter. The strength of these services is their depth and breadth. Subscribers gain the opportunity of acquiring a detailed understanding of narrow questions across multiple jurisdictions. That said, these services mostly lack an on-demand way to search for answers. Searchable databasesThe crown jewel for any privacy officer, however, is to be able to tap a person or database on demand to answer narrow questions for obscure situations. Last month, I gained access to the two leading privacy-database services. I tested how effective they were at providing answers to a battery of questions facing CPOs today. What were the results? I'd call DataGuidance the "LexisNexis" of privacy and PrivaWorks the "Westlaw" of privacy. Those who've used both know that Reed Elsevier's LexisNexis offers a simple interface, while Thomson Reuters' Westlaw provides a more robust set of filters and features. DataGuidance right now is the place to go for European content. I tested six types of questions U.S. companies often have about complying with EU member-state data-protection laws:
I found it easy to use the DataGuidance filters. Choose a jurisdiction and a topic, then hit "search" The reference materials that show up are a combination of government documents and analyses written by practicing privacy attorneys from a number of reputable firms. Once inside the topic, you can filter for applicable regulations and case law. The reference materials are well tagged, so it doesn't take long to determine if the database contains your answer. Where does DataGuidance have room to improve? There are no apparent cross-jurisdictional matrices presenting the answers across all 28 member states for any of the questions I tested. And there doesn’t appear to be one common template for the analyses. The authors structure their analyses differently and go to varying levels of detail. The result is that it's hard to find a pan-European answer to any question at the same level of detail. When you can't find the answer you're looking for, both DataGuidance and Nymity pledge to load questions into their research program. PrivaWorks was a different experience. The interface sported more modules and filters, making it harder to get to the point of taking full advantage of it. After some training, however, I found it easier to find cross-jurisdictional answers. PrivaWorks, for example, contains a Breach Response Support Center that centralizes reference materials on the topic and includes a filter for comparing criteria in U.S. state laws. PrivaWorks also includes pages dedicated to 10 different industries. Three other differentiators: the portal contains a "Manage the Risks" module organized by 17 business risks, statistics counters that rank the reports most frequented by users, and reference materials that are structured in the same format and tagged according to the 10 Generally Accepted Privacy Principles. I tested PrivaWorks against six North American questions I've heard lately:
So, on fairly narrow questions, both DataGuidance and Nymity deliver usable results. Table 2 shows a comparison of key elements of the two services. Table 2: Nymity vs. DataGuidanceNymity's PrivaWorks and Cecile Park Publishing's DataGuidance lead the market in subscription databases for privacy information.
Source:
Minnesota Privacy Consultants, 2009
Where can Nymity improve? Making the interface more intuitive so that it requires less training, and adding European and Asian content. New entrantLast December, San Francisco-based law firm Morrison & Foerster entered the subscription-database market for privacy information with its Summit Privacy Resources LLC spin-off. Summit Privacy is a queriable database of English-language texts of world privacy laws that MoFo has organized into a common lexicon. Use Summit Privacy's filters to query all "privacy notice" obligations worldwide, for example, and the Web site will produce a spreadsheet matrix of world privacy laws compared against similar privacy-notice provisions. A network of local counsel around the world keeps the database updated. Besides generating law charts, Summit Privacy's comparative strength is Asian privacy regulations, which are often not available on the Web in English or with the appropriate context to understand the actual corporate obligations. What's the only downside to the service? The minimum 25-seat, $25,000 annual subscription price. That's a steal for Fortune 100 companies, but it's probably out of the reach of smaller enterprises with only periodic privacy needs. All three services deserve applause for bringing more order to the growing patchwork of privacy information. Which one will prevail in today's flat economy? Whoever can become as simple and as accurate as Google and as indispensable as Microsoft Office. As privacy threats and compliance obligations spread into the vast sea of small businesses, first-mover advantages have yet to be claimed.
|
|
||||||||||||||||||||
|
||||||||||||||||||||
Other articles by Jay Cline