Who will be the 'Enron' of Information Privacy?

In 2002, ESG unveiled our research on "Regulatory Compliance and It's Impact on IT." This study culminated 18 months of meetings with regulatory agencies, IT professionals, and corporate attorneys. At the center of the study were record retention regulations and the transition of storing traditional corporate records on paper to electronic media. There were several catalysts for this transition: corporate scandals (Enron, Arthur Andersen, MCI Worldcom, Global Crossing, Qwest), more business was being conducted electronically (e-mailing your stock broker), and general business efficiency (Electronic Medical Record Program).

Two weeks ago, Enron leaders (I use that very loosely) Mr. Lay and Mr. Skilling were found guilty on a host of fraud and malfeasance counts. Sentencing, ironically, is scheduled for September 11, 2006. September 11 also set into a motion a series of events, most notably, the Patriot Act that impacted digital information management.

However, as Mr. Lay and Mr. Skilling await their fate, I believe that the IT world may get a breather from the record retention mayhem that plagues their budgets. Unfortunately, there are other events that are gaining attention in the press that I believe will create a shift in IT spend. Recently, 26+ million United States military veterans found out that their personal information was experiencing some freedom of its own after a laptop containing it was stolen. There are several other examples to go along with this one; Fidelity lost control over HP pension fund participants' person information and Bank of America lost backup tapes that contained credit card information of several U.S. Senators.

Ironically, just before the recent U.S. Veteran's fiasco, ESG published a research report "Protecting Confidential Data." This outlines some of the measures, or lack thereof, that organizations are using to secure personal information of their customers and employees. I cannot help but think back to the research we did in 2002 and the frame of mind it created for the entire ESG team. We were trying to identify the one event that really spurred IT spending for record retention. Enron was the perfect storm because the U.S. Congress drew up Sarbanes-Oxley faster than the Houston Astros contract team can assemble terms for Roger Clemmens every year in late May. Arthur Andersen literally tried to shred its association with Enron but they could not pay interns and Xerox employees fast enough to create piles of confetti. And, electronic discovery of business records, especially e-mail between Enron executives, auditors, bankers, were critical components to the conviction of Mr. Lay and Mr. Skilling.

As a result of Enron, we now have record retention regulations, corporate governance rules, and attorneys are looking in e-mails to find "smoking guns." In some cases, IT benefited. All of sudden, budgets were made available to buy e-mail archiving software, financial reporting applications were upgraded, and other compliance related projects were funded, easily. The downside for IT was that they became an integral part of financial audits, electronic discoveries, and business process projects.

As I re-read our research on Confidential Data, I am trying really hard to decipher whether the loss of U.S. Veteran's information will be Enron of the information privacy era. If it does, IT can expect a very similar cycle to that of the Enron era. Funding will be easy to find for information security software and related systems. More than likely, every piece of sensitive data -- from social security numbers to employee's addresses -- will be encrypted. Unfortunately, IT will also find itself designing several business processes to prevent any unauthorized access to confidential data. This means regular meetings with business leaders whose departments' applications create and store this form of information.

The way I see it, the verdict handed out in the Enron trial closes a chapter in IT where compliance-related purchases to support electronic record retention regulations. A new chapter, a one where information privacy will be top of mind and make headline news, will impact IT departments for the next 3-4 years.