• PC World
• » Security

WASHINGTON -- Web surfers often yawn and click the "next" button when they see verbose privacy policies online. They rarely pause to read about what happens to the passwords, account details, and Social Security numbers they enter into Web forms.

They should--because what they don't know could hurt them. And sites should make it simpler for their customers to learn where their vital statistics end up, say experts at a recent Federal Trade Commission forum on consumer privacy.

Distractions Dictate

"That's the sleeping tiger," says Larry Ponemon, who chairs the privacy think tank Ponemon Institute, speaking of the careless treatment that privacy policies receive from both companies and customers.

But instead of focusing on consumers' privacy demands, businesses are scrambling to comply with new privacy laws and regulations, he says.

And public demand for security remains in its infancy, notes Gary Clayton, who chairs the Privacy Council, a data protection company.

The FTC recently began to enforce a rule requiring financial companies to safeguard customer information, under the Gramm-Leach-Bliley Act.

Healthcare companies recently had to scramble to secure patient data under the April deadline of the Health Insurance Portability and Accountability Act.

The healthcare and pharmaceutical industries have the worst privacy safeguards, while the financial industry has the best, according to a Ponemon Institute survey.

The survey asked leaders at 50 companies about their privacy and network security management. While 98 percent of the companies surveyed have privacy policies, nearly half of them say their rules aren't user friendly, and 43 percent of them don't follow privacy practices around the world.

Problems Increase

Many businesses are paying more attention to international privacy standards, such as those in the European Union and Canada, which are often stricter than U.S. rules. Yet they're not listening closely to their customers, Ponemon says.

That stunted communication with customers is "a very large minefield" for individuals and businesses that deal with proprietary information online, Ponemon says.

The proliferation of sophisticated viruses and worms underscores the need for businesses to keep their data secure, digital security experts say.

Three years ago it took seven days for the so-called Love Bug virus to multiply on computers around the world. But last winter, it took only 15 minutes for the Slammer worm to spread across the globe and shut down major Internet servers.

"Companies wouldn't know what to do if they were hit on the side of the head with a two-by-four," Ponemon says. Only 19 percent of companies formally enforce privacy violations, according to the survey.

Unfortunately, consumers often have no recourse when their personal data is recorded erroneously or is stolen, since their complaints go "into a great vacuum," he says.

A breakdown in business privacy safeguards can threaten the promised innovations of handheld devices, firewalls, and secure networks, says Robert Gratchner, Intel's corporate privacy manager.

Ideas and Options

Privacy policies should be reworded in brief, "how-to" phrases, suggests Steven Adler, market manager for IBM's Tivoli Security and Privacy Software.

Also, Web sites can implement some safeguards that don't force people to read pages of policy. Some sites use the Platform for Privacy Preferences, or P3P, standard, which shows surfers a privacy policy "snapshot."

AT&T offers a free downloadable privacy bird that sits in the corner of a Web browser, chirps, and changes colors according to an Internet site's security.

"We can hear all we want about technologies," says Ari Schwartz, associate director of the nonprofit Center for Democracy and Technology. "The options they'll give to consumers out there is a whole different story."

The baby steps taken by businesses are positive, but it's too early to tell what the outcome for personal privacy will be, he adds.

• See more like this:
• privacy,
• security,
• privacy policy,
• federal trade commission,
• ftc,
• ponemon,
• p3p