The advent of the chief privacy officer role has occurred largely within the regulated sectors of health care and financial services, but has spread to many industries and companies of all sizes. The spread has no doubt been quickened by the FTC's enforcement of Section 5 of the FTC Act, prohibiting “unfair or deceptive acts or practices in or affecting commerce.” The most common enforcement actions undertaken by the FTC have been against companies whose use of their customer's personal information is in violation of their own stated privacy policies. These types of mishaps reveal an underlying lack of coordination between the privacy and security functions. Therefore, the quality of the relationship between an organization's privacy and security functions may be a key predictor of compliance success.

The introduction of a privacy program within an organization can sometimes cause tension with the information security function. These tensions arise out of the common goals and purposes shared between the two groups. Further, shared interest in common technologies that provide for confidentiality of information, the primary objective of both groups, can confuse program scope or worse, foster unhealthy competition. In-house counsel can work to ensure the relationship between privacy and security functions is conducive to reducing risk, not introducing it.

In-house counsel can provide leadership to executives and prove instrumental in harmonizing the privacy and security programs within their organizations. Counsel should consider the privacy and security functions in context with each other, understanding the relationships and dependencies between the two groups. The key is for counsel to remain informed and abreast of the goals and strategies of the privacy and security functions, and recognize points of reliance and points of divergence between the two. With advance planning and guidance, tensions that commonly arise between the two functions can be defused, and both programs can thrive in part due to the success of the other.

Counsel should consider the following. First, privacy is usually not attainable without security. Arguably, the primary objective of an information security program is to protect the confidentiality of sensitive information from unauthorized disclosure. The privacy program is focused on the same objective for a subset of the organizations sensitive data: personally identifiable information, or PII. The privacy team can and should rely on the vast arsenal of technologies deployed by corporate information security departments to preserve confidentiality. Since the privacy function doesn't need to replicate these technologies, it can focuses on privacy process and policy.

Second, the policies produced by each group have important differences. Privacy policies often embody requirements found in unique state, federal and international laws and regulations that apply to individual consumers, whom these laws are designed to protect. What information about the person is collected and why? How will it be used? How will the corporation's technology interact with that person and her data? For example, how will cookies be used to capture and track a customer's online behavior?

By contrast, information security policies are rooted in best-practice, industry consensus frameworks, as much as they are based on legislative frameworks. While such frameworks for privacy are strengthening, such as the generally accepted privacy principles there are many more and robust frameworks available for information security. Care should be taken to correlate privacy policies with security policies so that one doesn't step on the other. A common misfire of privacy programs is to produce privacy policies that create redundancies or inconsistencies with security policies.

Third, as corporate governance mechanisms continue to evolve and mature, they are capable of contemplating and overseeing the management of security and privacy risk. Legal officers might be more likely than CISOs or CPOs to participate in the governance committees of an organization. If a risk, operations, or information officer has not already sounded the call to information governance, the general counsel may bring to light the management of these unique and ever-growing risks.

In summary, in house counsel can do the following with regards to guiding the privacy and security functions in achieving overall risk management objectives:

• understand the common and diverging goals of each program
• recognize the dependencies between privacy and security programs
• understand that security and privacy policies should be complementary, can co-exist within the corporate policy framework, but have unique differences.
• engage corporate governance functions as appropriate to oversee privacy and information security risk management

The advent of the chief privacy officer role has occurred largely within the regulated sectors of health care and financial services, but has spread to many industries and companies of all sizes. The spread has no doubt been quickened by the FTC's enforcement of Section 5 of the FTC Act, prohibiting “unfair or deceptive acts or practices in or affecting commerce.” The most common enforcement actions undertaken by the FTC have been against companies whose use of their customer's personal information is in violation of their own stated privacy policies. These types of mishaps reveal an underlying lack of coordination between the privacy and security functions. Therefore, the quality of the relationship between an organization's privacy and security functions may be a key predictor of compliance success.

The introduction of a privacy program within an organization can sometimes cause tension with the information security function. These tensions arise out of the common goals and purposes shared between the two groups. Further, shared interest in common technologies that provide for confidentiality of information, the primary objective of both groups, can confuse program scope or worse, foster unhealthy competition. In-house counsel can work to ensure the relationship between privacy and security functions is conducive to reducing risk, not introducing it.

In-house counsel can provide leadership to executives and prove instrumental in harmonizing the privacy and security programs within their organizations. Counsel should consider the privacy and security functions in context with each other, understanding the relationships and dependencies between the two groups. The key is for counsel to remain informed and abreast of the goals and strategies of the privacy and security functions, and recognize points of reliance and points of divergence between the two. With advance planning and guidance, tensions that commonly arise between the two functions can be defused, and both programs can thrive in part due to the success of the other.

Counsel should consider the following. First, privacy is usually not attainable without security. Arguably, the primary objective of an information security program is to protect the confidentiality of sensitive information from unauthorized disclosure. The privacy program is focused on the same objective for a subset of the organizations sensitive data: personally identifiable information, or PII. The privacy team can and should rely on the vast arsenal of technologies deployed by corporate information security departments to preserve confidentiality. Since the privacy function doesn't need to replicate these technologies, it can focuses on privacy process and policy.

Second, the policies produced by each group have important differences. Privacy policies often embody requirements found in unique state, federal and international laws and regulations that apply to individual consumers, whom these laws are designed to protect. What information about the person is collected and why? How will it be used? How will the corporation's technology interact with that person and her data? For example, how will cookies be used to capture and track a customer's online behavior?

By contrast, information security policies are rooted in best-practice, industry consensus frameworks, as much as they are based on legislative frameworks. While such frameworks for privacy are strengthening, such as the generally accepted privacy principles there are many more and robust frameworks available for information security. Care should be taken to correlate privacy policies with security policies so that one doesn't step on the other. A common misfire of privacy programs is to produce privacy policies that create redundancies or inconsistencies with security policies.

Third, as corporate governance mechanisms continue to evolve and mature, they are capable of contemplating and overseeing the management of security and privacy risk. Legal officers might be more likely than CISOs or CPOs to participate in the governance committees of an organization. If a risk, operations, or information officer has not already sounded the call to information governance, the general counsel may bring to light the management of these unique and ever-growing risks.

In summary, in house counsel can do the following with regards to guiding the privacy and security functions in achieving overall risk management objectives:

• understand the common and diverging goals of each program
• recognize the dependencies between privacy and security programs
• understand that security and privacy policies should be complementary, can co-exist within the corporate policy framework, but have unique differences.
• engage corporate governance functions as appropriate to oversee privacy and information security risk management