Laura Koetzle on Turning Privacy Into Growth

TL;DR

Companies can create business value from personal data by obtaining meaningful consent, clearly explaining the customer benefit, protecting the information, and giving people continuing control over it. Forrester research found that 36% of surveyed US online adults were willing to exchange personal information for desired benefits, suggesting that transparent privacy practices can support both customer trust and commercial growth.

Transcript

Hello, and welcome back to another episode of RSAC Television. We're here at the RSA Conference in downtown, beautiful downtown San Francisco. I'm your host, Paul Roberts, the editor-in-chief at The Security Ledger, and I've been talking with some of the luminaries here at the RSA Conference all week long. And we have one of them here in the studio... Read More

Key Insights

• Meaningful consent is an informed agreement, not merely clicking through a long license document to obtain a product or service. Companies should tell customers what data they want, how they will use it, and what concrete benefit customers receive in exchange.
• Privacy can support business growth when data collection is presented as a transparent trade. Customers may receive a free service or early access to a product, while the company gains permission to use specified information under conditions the customer understands and accepts.
• Forrester’s segmentation found that 36% of 30,000 US online adults were willing to exchange personal information for benefits they wanted. That willing segment was also the highest-income customer group, indicating a meaningful commercial opportunity for companies that handle consent properly.
• Customer control is a necessary part of a responsible data exchange. Companies should let people understand future uses of their information and provide ways to update or remove it if their preferences or circumstances change after the original agreement.
• Privacy attitudes may become mainstream in a pattern similar to consumer interest in organic products. Koetzle notes that organic sourcing moved from a fringe concern to a large consumer-driven market, while arguing that the corresponding shift in privacy expectations is already accelerating.
• The GDPR has extraterritorial reach for companies selling to European consumers. Koetzle illustrates that a US airline becomes subject to the regulation if it sells a ticket to a Swedish person on holiday, even when the airline does not consider Europe its primary market.
• The GDPR is a principles-based framework rather than a fixed technology checklist. This approach can be frustrating because it does not prescribe six exact compliance steps, but it is less likely to become outdated as technology changes more quickly than legislation.
• GDPR compliance can be used as leverage for better information governance. Koetzle recommends knowing what data the organization holds, protecting it properly, disposing of it when no longer needed, and tokenizing it whenever possible to minimize exposure and risk.

Questions & Answers

Q: How can companies profit from protecting customer data?

Companies can profit by treating personal information as part of a clear and voluntary exchange. They should explain what data they want, how they will use it, what benefit the customer will receive, and how the customer can later update or withdraw the information. Forrester’s research indicates that a significant customer segment accepts such exchanges when the terms and benefits are understandable.

Q: What does meaningful consent for personal data require?

Meaningful consent requires more than asking someone to click through a lengthy license agreement before receiving a service. The customer should understand what information is being collected, its intended use, the value offered in return, and the controls available afterward. Consent becomes credible when the individual knowingly says yes and retains the ability to change that decision in the future.

Q: How many consumers are willing to trade data for benefits?

A Forrester segmentation based on 30,000 US online adults found that 36% were willing to exchange personal information for benefits they wanted. Koetzle also says this group represented the highest-income customer segment. The finding supports her argument that transparent, consensual data use can produce business opportunities while respecting customers’ expectations about protection, understanding, and control.

Q: What should a company tell customers before collecting data?

A company should identify the information it wants, explain how it intends to use that information, and state the benefit offered to the customer. The benefit might be a free service or access to an early-stage product. The company should also explain how customers can control the information later, including whether they can update it or take it away.

Q: Why does Laura Koetzle compare privacy with organic food?

Koetzle uses organic food to show how a concern that once appeared fringe can become a mainstream, consumer-driven market. She notes that organic and locally sourced products gained broad acceptance over several decades, and that consumers strongly engaged with proposed organic standards. She expects changing privacy expectations to develop more quickly because the shift is already beginning to accelerate.

Q: Does the GDPR apply to companies outside Europe?

Yes, the GDPR can apply to a company outside Europe when it sells products or services to European consumers. Koetzle gives the example of a US airline that has sold a ticket to a Swedish traveler. She characterizes the regulation as extraterritorial and warns that companies cannot assume it is irrelevant merely because they are based outside Europe.

Q: How does the GDPR differ from a rules-based framework?

The GDPR is described as a principles-based framework, so it does not prescribe one technology or a short checklist that guarantees compliance. A rules-based framework such as PCI provides clearer required actions, but particular requirements can become outdated as technology changes. The GDPR’s broader principles remain adaptable, although organizations must determine how to apply them in their own circumstances.

Q: How should companies use GDPR requirements to improve security?

Companies should use the GDPR as leverage to strengthen data governance and security practices that customers already want. Koetzle recommends identifying what information the organization holds, protecting it properly, disposing of it when it is no longer needed, and tokenizing it whenever possible. These practices minimize exposure and risk while helping the organization respond to privacy obligations.

Summary & Key Takeaways

• Laura Koetzle argues that companies do not need to stop using personal data. Instead, they should obtain genuine consent and clearly present the exchange: what information the company wants, how it will use that information, what benefit the customer receives, and how the customer can later update or withdraw the data.

• Forrester’s segmentation of 30,000 US online adults found that 36% were willing to trade personal information for benefits they valued. This group was also the highest-income customer segment. Koetzle presents this finding as evidence that responsible data practices can create commercial opportunities rather than functioning solely as compliance obligations.

• The GDPR applies beyond Europe when companies sell products or services to European consumers. Koetzle describes it as a principles-based framework centered on contextual privacy. She recommends using its requirements to identify stored data, protect it properly, remove it when unnecessary, and tokenize it whenever possible to reduce exposure and risk.