Privacy Ref Blog

Does your call center share too much personal information?

If you have done business with a company and reach out to their call center, how do they authenticate who you are? Do they ask you for personal information or ask you to verify personal information?

So I called my bank…

When I telephone my bank’s call center they need to verify who I was before they will share any information with me. The bank generally asks information that presumably I would know but would not share with anyone else such as:

I rarely share the last of these items unless for a good business purpose and it would be very unusual for me to share all three pieces of information with any one person.

There are other questions that might be asked such as “how much was a recent deposit”, but in no case does the bank give me personal information and ask for it to be verified. This is a very good practice.

Verifying personal information

Unfortunately, it is not unusual that a call center to ask you to verify personal information. While it may not be an accepted practice at a company, the practice can be the result of an individual contributor or even a manager trying to do “the right thing” to make it easier for a customer. Unfortunately this is one of those things that has just not been thought through.

For example, I called a retailer to get my frequent shopper card number. After explaining what I wanted, I was asked for my name and my zip code. “Do you still live at…” I was asked. What an easy way for someone to get my home address. How easy it would be for someone to have access to coupons or rebates I have earned.

…and then I called Disney World

Earlier this week my wife and I discussed going to Disney World for the weekend so I called the reservations number. When the automated system asked me what I wanted, I responded with “a new resort reservation”.

To make the process easier I was asked how many times I had visited Disney World. After replying I was asked if any of the visits were during the last 5 years. I responded “yes”. I was then asked for my phone number.

Much to my surprise, I was asked to verify my last name (the system spelled it for me) and my address. I was shocked. By simply providing a phone number and saying I had visited the resort in the last five years I obtained personal information from the automated system; a practice that management must have approved.

You can argue that last name, telephone number, and address are public information. I suggest it does not matter. As custodians for personal information provided by their guests, Disney (or any organization for that matter) has a responsibility to verify who the caller is before sharing any information. Besides, I suggest that mobile phone numbers are not generally public information.

Obtaining a telephone number is just not enough to provide personal information to a caller. What if I changed my phone number and didn’t report it to Disney? What if someone acquired my phone number and wanted to track me down? What of they were following my children?

I mentioned my concern to the call center representative I spoke with. She didn’t really seem concerned and was told I may want to send an email to report this.

How can this information be better protected?

Disney could ask one more question based on the information they collect during each guest’s visit. Without knowing all of the information Disney collects about their guests, here are a few suggestions:

A best practice for call center’s protection of personal information

Every organization has a responsibility to protect the personal information their customers give them. Ensuring that a call center requests information to authenticate that a caller may access personal information before providing the information is a fundamental best practice that all organizations should adopt.

Providing personal information prior to properly authenticating the caller should be considered a data breach.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at info@privacyref.com

Posted on July 17, 2014 by Bob Siegel
Tags: , , ,

« »

No Responses

Comments are closed.


« »

Subscribe to our mailing list

Please fill out the form below.

Required

Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to info@privacyref.com or call (888) 470-1528.

News

May 10, 2017

Predictive Breach Cost Model
Download our predictive breach cost modelhere.

Latest Blog Posts

September 18, 2017

Burying your head in the sand won’t make Data Protection requirements go away
Recently, I had dinner with  a colleague that I had not seen in several years. Their company, a multinational with global operations, had undergone several changes in that time. When the dust settled, this friend had been tapped as "privacy manager". Along with corporate counsel (part time for privacy), they decided that, even under GDPR, they did not need a Privacy / Data Protection Officer . Huh? Continue reading this post...

August 14, 2017

Privacy Ref and CyberDefenses Bring Privacy and Security Together
There is a saying that you can have security without privacy, but you cannot have privacy without security. While privacy and security are both concerned with the protection of information held by an organization, security provides the means to meet the business requirements identified to meet privacy demands from regulators, customers, employees, and other stakeholders. Privacy Ref works with our clients to improve their business and operational practices for protecting personal information. Increasingly our clients’ have been looking for services to supplement their security practices, tools, and expertise. CyberDefenses fills this role. Continue reading this post...

Other Recent Posts

PRIVACY REF