Lawmakers Tackle Privacy
Tech growing pains are giving privacy issues a high profile. Technology allows the easy accumulation and distribution of personal financial data as well as the theft of these data. The growing demands and interrelatedness of the marketplace have increased companies' need for profiling the purchasing habits and financial situations of consumers. A few companies made headlines last year for their poor stewardship of customer information. This notoriety helped to make consumer financial privacy an urgent issue for Congress, the public and the business community. For example, U.S. Bancorp of Minnesota sold confidential customer financial information from its files to third-party marketers. The story made national news, causing U.S. Bancorp and several other financial institutions to stop the practice and prompting the Minnesota attorney general to file suit against U.S. Bancorp. In another major privacy story, Amazon.com profiled its customers' most popular book and music purchases, named the companies employing those customers making the purchases and published the information on its Web site. Customers' reaction caused Amazon.com to immediately stop publishing it. But Amazon still retains the data. According to USA Today, only 20 of the 100 biggest online retailers have privacy policies that restrict the use of customer information to completing transactions. Although some e-commerce companies have seals--such as the WebTrust[SM] seal--to indicate the company's privacy policy, consumer groups and many on Capitol Hill believe that regulating the use of private financial information is necessary, and that disclosure and consumer choice regarding privacy policies are not enough to protect consumer privacy. This is an area where the CPA's expertise puts him or her in an excellent position to help financial institutions to implement, maintain and monitor the privacy policies and systems they will have to create. WAKE-UP CALL In early January details about the first major theft of consumer financial information from an e-commerce company flashed into the news. A computer hacker had broken into the system of CD Universe and copied 300,000 customer credit card files. The hacker attempted to extort money from CD Universe in exchange for returning the information, When CD Universe refused to submit to extortion, the hacker posted the names, addresses and credit card numbers of 25,000 customers on a Web site. Although this theft happened to an e-company, confidential financial information can be stolen from any company that maintains such records. Although federal law essentially shields consumers from any loss due to the unauthorized use of their credit cards (there is a $50 dollar limit on a credit card), this incident heightened concern over the privacy and security of data stored in computers. Ultimately, all consumers will foot the bill for these losses when companies pass the charges to their customers in the form of higher costs. NEXT? Since the accounting profession's stock-in-trade is confidential financial information, it is conceivable that the Federal Reserve Board could adopt a regulation subjecting CPAs in public practice to the privacy rules applicable to financial institutions, which require periodic disclosures to clients about the privacy and integrity of confidential data. However, the proliferation of current and upcoming privacy statutes and regulations also opens up business opportunities for the profession and at the same time could subject CPAs to tougher requirements. To mitigate risks, companies will seek assurance services that test the efficacy of their privacy systems. Clearly, of the act and what WebTrust achieves for e-commerce and SysTrust[SM] for any business are pioneering efforts in this area (see sidebar, "AICPA Assurance Service institutions." Programs That Address Privacy Issues," page 31). Privacy consulting--both creating privacy policies and systems as well as internal controls--is also an area where the accounting profession's expertise can put CPAs front and center in the effort to guard public and business interests. …