Data breaches the looming drain on brand trust
In 2012 then-FBI director Robert Mueller predicted there would only be two types of companies in the future – "those that have been hacked and those that will be".
In 95 days Australian companies will face the reality of Mr Mueller's warning when the true scale of cyber breaches will be made public under the federal government's Notifiable Data Breaches Act.
Mandatory reporting of data breaches in Australia could mean a hit to the share price of any listed company – just ask Yahoo, Target, Home Depot and Chipotle in the US.
In Australia hacking will soon become a very public, whole-of-business problem and marketers will need to play a lead role because regulators are forcing that agenda.
Whilst most marketers are still focused almost exclusively on how to leverage the power of data and navigate the complexity and opacity that surrounds the fundamentals of measurement and return-on-investment in their digital endeavours, regulators globally are stepping up the pressure directly and tacitly on businesses to increase their obligations and protection of the individual.
The EU's General Data Protection Regulation (GDPR), which starts to bite in May next year with fines of 4 per cent of company revenues, and the rumblings in recent weeks from US congressional hearings into Silicon Valley's tech giants, is more evidence of the coming pressures on the business of marketing around data and consumer protection.
Recent findings from The Ponemon Institute, considered the pre-eminent global research centre dedicated to privacy, data protection and information security policy, show a direct correlation between a company's cumbersome response after a data breach and a decline in share value, customer churn and revenue loss.
One of the more concerning figures is that 31 per cent of customers had discontinued their relationship with a company after data breaches. There is clear and present danger for marketers in advance of Australia's new data breach regime, which starts on February 22. Incident response planning
Under the Notifiable Data Breaches scheme, businesses subject to the Australian Privacy Principles under the Privacy Act (with an annual turnover of more than $3 million) must notify eligible data breaches to the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable after the entity becomes aware of the breach.
Failure to abide by the requirements will constitute a "serious interference with the privacy of an individual", which could see sanctions by the Privacy Commissioner and fines that could quickly climb beyond $1 million.
Reputational damage to a brand is the unenforceable but possibly more significant toll.
So whilst many of us are nervous about the EU's GDPR policy rippling across the international marketing community next year – and we should be – the lack of proper data protections on our own shores are already impacting Australian businesses, and it is likely many more breaches are going to need to be disclosed.
Global cybersecurity firm Forcepoint concurs, recently publishing figures that show almost 94 per cent of ASX-listed businesses had experienced a data breach in the past year.
Every CMO should have an understanding of their company's data protection approach and have an incident response plan.
If the adage that prevention is better than cure holds true, then the marketer, and indeed the chief customer officer who is responsible for the total relationship with an organisation's customers must think beyond the current digitally-led zeitgeist of "seamless omni channel customer experiences". As the voice of the customer, the chief customer officer should heed the intent of the regulators. Protect what you value so greatly.
Temptation, however, is indeed a dangerous thing. The power to leverage data through building richer profiles of customers is the new elixir that is meant to drive growth. Made even more tantalising by our escalation into the Internet of Things (IoT) providing more data points in which to mine customer insights and opportunity.
The more valuable those data sets are to a company the more attractive they become to cyber criminals. No wonder regulators are stepping up the pressure on brands to legitimately put the customer first.
One thing is clear; as we head into 2018, no business or brand is immune from digital incursions. We have been warned.
It will be interesting to see if CVT can execute a number of domestic and European contracts in the lead up to mandatory data breach reporting. Hopefully Ted & the team will give an update at the AGM in regards to inbound inquiry and potential / quantified sales pipeline.
I believe that the mandatory data breach reporting will be a key driver in the success of CVT in 2018
CVT Price at posting:
5.4¢ Sentiment: Buy Disclosure: Held
