Privacy Ref Blog

Does your call center share too much personal information?

If you have done business with a company and reach out to their call center, how do they authenticate who you are? Do they ask you for personal information or ask you to verify personal information?

So I called my bank…

When I telephone my bank’s call center they need to verify who I was before they will share any information with me. The bank generally asks information that presumably I would know but would not share with anyone else such as:

I rarely share the last of these items unless for a good business purpose and it would be very unusual for me to share all three pieces of information with any one person.

There are other questions that might be asked such as “how much was a recent deposit”, but in no case does the bank give me personal information and ask for it to be verified. This is a very good practice.

Verifying personal information

Unfortunately, it is not unusual that a call center to ask you to verify personal information. While it may not be an accepted practice at a company, the practice can be the result of an individual contributor or even a manager trying to do “the right thing” to make it easier for a customer. Unfortunately this is one of those things that has just not been thought through.

For example, I called a retailer to get my frequent shopper card number. After explaining what I wanted, I was asked for my name and my zip code. “Do you still live at…” I was asked. What an easy way for someone to get my home address. How easy it would be for someone to have access to coupons or rebates I have earned.

…and then I called Disney World

Earlier this week my wife and I discussed going to Disney World for the weekend so I called the reservations number. When the automated system asked me what I wanted, I responded with “a new resort reservation”.

To make the process easier I was asked how many times I had visited Disney World. After replying I was asked if any of the visits were during the last 5 years. I responded “yes”. I was then asked for my phone number.

Much to my surprise, I was asked to verify my last name (the system spelled it for me) and my address. I was shocked. By simply providing a phone number and saying I had visited the resort in the last five years I obtained personal information from the automated system; a practice that management must have approved.

You can argue that last name, telephone number, and address are public information. I suggest it does not matter. As custodians for personal information provided by their guests, Disney (or any organization for that matter) has a responsibility to verify who the caller is before sharing any information. Besides, I suggest that mobile phone numbers are not generally public information.

Obtaining a telephone number is just not enough to provide personal information to a caller. What if I changed my phone number and didn’t report it to Disney? What if someone acquired my phone number and wanted to track me down? What of they were following my children?

I mentioned my concern to the call center representative I spoke with. She didn’t really seem concerned and was told I may want to send an email to report this.

How can this information be better protected?

Disney could ask one more question based on the information they collect during each guest’s visit. Without knowing all of the information Disney collects about their guests, here are a few suggestions:

A best practice for call center’s protection of personal information

Every organization has a responsibility to protect the personal information their customers give them. Ensuring that a call center requests information to authenticate that a caller may access personal information before providing the information is a fundamental best practice that all organizations should adopt.

Providing personal information prior to properly authenticating the caller should be considered a data breach.

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at info@privacyref.com

Posted on July 17, 2014 by Bob Siegel
Tags: , , ,

« »

No Responses

Comments are closed.


« »

Subscribe to our mailing list

Please fill out the form below.

Required

Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to info@privacyref.com or call (888) 470-1528.

News

April 16, 2018

IAPP Training Classes
Privacy Ref is proud to announce that we are an official training partner of the IAPP. You now have the opportunity to learn from one of our knowledgeable privacy professionals using the most respected training content in the industry. The robust interactive training offered, aids in the understanding of critical privacy concepts. The contents of the courses are integral to obtaining your privacy certifications and to educate your new team. Learn more here.

Latest Blog Posts

June 4, 2018

My First Taste of GDPR
It is no secret that I am, for lack of a better term, a nerd. I am also a Privacy Consultant here at Privacy Ref, so I usually pride myself on knowing about privacy goings on in the world. However, for the first time I was bamboozled by changes to a privacy policy. Continue reading this post...

April 30, 2018

Defining GDPR for Non-Privacy People
During the IAPP’s most recent Privacy Summit, I was approached with an interesting question. “I am a privacy professional and I know why GDPR is important. I know about the fines and requirements for compliance, but few others at my company do. How do I explain GDPR to my colleagues effectively?” I responded with a quick and simple answer that probably did not cover all the bases, so I wanted to write up some deeper thoughts on the subject. Continue reading this post...

Other Recent Posts

PRIVACY REF