Tough privacy questions for IT leaders

How would you react if your CEO ordered your IT organization to track an employee's e-mail? Or if a hacker gained access to sensitive customer information?

We posed this and four other hypothetical privacy scenarios to two IT leaders: Bob Prochnow, 46, chief technology officer at Austin, Texas-based SiteStuff Inc., an online exchange serving buyers and sellers in the commercial real estate market; and Robert DiStefano, 51, managing director of IT at The Vanguard Group Inc., a Valley Forge, Pa.-based mutual fund company. Here's how they responded:

Your company decides to spin off a midsize division that serves hundreds of thousands of individual customers. A year later, the spin-off is acquired by a different company. What do you do to make sure customer data remains confidential?

Prochnow: The first step is to identify the information that customers feel is confidential. Then, as part of a privacy policy, we'd have to make it clear how we store and use information, including whether we would provide it in detail or in an aggregated form to anyone. Customers typically don't object to providing information in an aggregate form.

If we were the parent company and we were spinning off a subsidiary whose customers were still our customers, we'd retain ownership of confidentiality as part of the spin-off arrangement.

DiStefano: This would be very touchy. I'd want to ID every attribute of the data about clients. Then I'd want to clearly choose which elements of that data are needed to let the spin-off retain its revenue stream and which things are owned by the parent company. They've got to be discrete.

Where there's overlap, it gets tricky. The key is to make the apps and the services offered to clients as discrete as you can, which is often difficult. I'd also want to have a privacy consultant come in and render an opinion as due diligence.

Your CEO orders you and your IT organization to track an employee's e-mail. How would you handle the situation?

Prochnow:The first thing I'd do is get the business reason. There might, for instance, be suspicion that an employee is exposing the company to federal law violations. Then I'd consult with the legal staff to make sure that they concur that the business reason justifies overriding the individual's privacy. If legal concurred, we'd then take steps to get at that information, and we'd have to do that very discreetly.

We'd have only a very small number of technology people involved and, depending on the individual circumstance, we'd inform the employee or not. You have to handle it on an individual basis. But you have to go into it knowing that once you've done this with an employee, you've completely destroyed your relationship with that employee. It's not something you can do lightly.

DiStefano: That has to be handled up front, from a policy point of view. First, the company should have made a conscious decision on how they'll deal with ownership of e-mail. Second, that policy has to be communicated to every employee, preferably on something they sign. If you've told everyone their e-mail may be monitored, and they've signed a form, that's the first step.

The other issue is, how fair is it to do the tracking? You don't want employees to think you're looking over their shoulders constantly. If there's a complaint from a supervisor about an activity that might be criminal or fraudulent, then certainly that ought to be turned over to law enforcement or the company's internal audit arm. You need clear guidelines.

New federal legislation mandates that your company post a privacy policy on your Web site within three months. When and how do you begin?

Prochnow: This is funny -