One CPO’s last-man-standing perspective on protecting data during shutdown

Financial institutions hold some of our most sensitive information. Marc Loewenthal was the chief privacy officer for New Century Financial Corporation when that company succumbed to the woes of the subprime mortgage meltdown, filing for bankruptcy protection in April, 2007. He had been there for five years, witnessing the company’s meteoric rise and ultimate rapid demise. Here, Loewenthal discusses how companies can secure sensitive data before and during a shut-down, and shares insight on making privacy foremost in the minds of many during uncertain economic times.

IAPP: Any effective strategies for ensuring data remain secure and private when shutting down locations/ branches/companies?

Marc Loewenthal: It’s very important to make certain that all terminated employees’ access to either physical or electronic information is cut off immediately to prevent any breaches or unauthorized taking of the information.

IAPP: Do staffing cuts really affect privacy/security?

Marc Loewenthal: They do. Unfortunately, there are always resentful employees that may seek to sabotage systems and information. Potential issues should be discussed in advance.

IAPP: Can you offer tips for protecting data when a data holder/service provider is in financial trouble?

Marc Loewenthal: Look for secondary or redundant providers in case you need them and line them up for contingency purposes. Make certain that you will have access to data whenever you need it. Check your contract to be certain that you have preserved rights in the event of a bankruptcy or other insolvency proceeding.

IAPP: What can companies do to prevent privacy/security problems from employees affected by the downturn (identity theft, data theft, etc…)?

Marc Loewenthal: Keep tight control of access to systems and essential files. Conduct assessments to make certain that personally identifiable information is protected to the greatest extent possible given the circumstances. Provide assistance to company employees to ease them through the termination process and cut down the source of their resentment or dissatisfaction.

IAPP: Are there any opportunities from the downturn?

Marc Loewenthal: It is a good time to beef up your privacy and security infrastructure, re-examine policies and procedures, enhance training, and conduct risk assessments.

IAPP: How can companies maintain privacy as an important issue in this downturn?

Marc Loewenthal: This has to be emphasized from the top down as a business priority. Good privacy and security practices are essential to the future health of a company and help with the strength of the company's overall reputation, which will be beneficial when business conditions turn around. This should be communicated as an enterprise-wide initiative.