Privacy Ref Blog

Does your call center share too much personal information?

If you have done business with a company and reach out to their call center, how do they authenticate who you are? Do they ask you for personal information or ask you to verify personal information?

So I called my bank…

When I telephone my bank’s call center they need to verify who I was before they will share any information with me. The bank generally asks information that presumably I would know but would not share with anyone else such as:

I rarely share the last of these items unless for a good business purpose and it would be very unusual for me to share all three pieces of information with any one person.

There are other questions that might be asked such as “how much was a recent deposit”, but in no case does the bank give me personal information and ask for it to be verified. This is a very good practice.

Verifying personal information

Unfortunately, it is not unusual that a call center to ask you to verify personal information. While it may not be an accepted practice at a company, the practice can be the result of an individual contributor or even a manager trying to do “the right thing” to make it easier for a customer. Unfortunately this is one of those things that has just not been thought through.

For example, I called a retailer to get my frequent shopper card number. After explaining what I wanted, I was asked for my name and my zip code. “Do you still live at…” I was asked. What an easy way for someone to get my home address. How easy it would be for someone to have access to coupons or rebates I have earned.

…and then I called Disney World

Earlier this week my wife and I discussed going to Disney World for the weekend so I called the reservations number. When the automated system asked me what I wanted, I responded with “a new resort reservation”.

To make the process easier I was asked how many times I had visited Disney World. After replying I was asked if any of the visits were during the last 5 years. I responded “yes”. I was then asked for my phone number.

Much to my surprise, I was asked to verify my last name (the system spelled it for me) and my address. I was shocked. By simply providing a phone number and saying I had visited the resort in the last five years I obtained personal information from the automated system; a practice that management must have approved.

You can argue that last name, telephone number, and address are public information. I suggest it does not matter. As custodians for personal information provided by their guests, Disney (or any organization for that matter) has a responsibility to verify who the caller is before sharing any information. Besides, I suggest that mobile phone numbers are not generally public information.

Obtaining a telephone number is just not enough to provide personal information to a caller. What if I changed my phone number and didn’t report it to Disney? What if someone acquired my phone number and wanted to track me down? What of they were following my children?

I mentioned my concern to the call center representative I spoke with. She didn’t really seem concerned and was told I may want to send an email to report this.

How can this information be better protected?

Disney could ask one more question based on the information they collect during each guest’s visit. Without knowing all of the information Disney collects about their guests, here are a few suggestions:

A best practice for call center’s protection of personal information

Every organization has a responsibility to protect the personal information their customers give them. Ensuring that a call center requests information to authenticate that a caller may access personal information before providing the information is a fundamental best practice that all organizations should adopt.

Providing personal information prior to properly authenticating the caller should be considered a data breach.

  • author's avatar

    By: Bob Siegel

    Bob Siegel, the founder and President of Privacy Ref, Inc., has extensive professional experience in the development and improvement of privacy policies and procedures, the definition of performance metrics to evaluate privacy maturity, and the evaluation of compliance. He utilizes a combination of alignment, adaptability, and accountability strategies to guide organizations in achieving their privacy goals.

    He is a Fellow of Information Privacy and a Certified Information Privacy Professional, awarded from the International Association of Privacy Professionals, with concentrations in U.S. private-sector law (CIPP/US), European law (CIPP/E), and Canadian law (CIPP/C). He is also a Certified Information Privacy Manager (CIPM) and Privacy Technologist (CIPT).

    Siegel is a member of the IAPP faculty, has served on the Certification Advisory Board for the CIPM program the Publications Advisory Board.

    Siegel also writes the blog “Operational Privacy” on CIO.com

  • author's avatar

  • author's avatar

    Happy Data Privacy Day
    What is the difference between privacy and security?
    My Mother Understands
    Human Errors Will Create Privacy Issues
    EU-US Privacy Shield is coming. Now what?

    See all this author’s posts

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at info@privacyref.com

Posted on July 17, 2014 by Bob Siegel
Tags: , , ,

« »

No Responses

Comments are closed.


« »

Subscribe to our mailing list

Please fill out the form below.

Required

Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to info@privacyref.com or call (888) 470-1528.

News

February 8, 2017

New On-Line Class Offering
Learn more about privacy program fundamentals with Bob Siegel and Privacy Ref. Find out more about this offering on our On-Line Classes Page.

Latest Blog Posts

April 12, 2017

Planning for Summit 2017
With the IAPP Privacy Summit less than a month away, it is time to start planning what you will be doing there.  If you are going to the Summit this year, there are a large number of sessions, speakers, and exhibitors for you to check out and learn from.  This stands alone from the thousands of attendees, all of whom have some level of privacy expertise and experience that you can learn from. Continue reading this post...

March 23, 2017

It’s just a leak
In recent weeks, leaks have been at the forefront of news.  This is mostly in a political spectrum, but it illustrates the importance of managing how information flows through an organization.  There have been examples other than those coming from the White House though. Being non-political in nature, they have different consequences and lessons to be learned. Continue reading this post...

Other Recent Posts

PRIVACY REF