Some telcos have rather too relaxed an attitude towards data breaches. Such telcos may have implemented inadequate controls prior to a breach, but their PR teams will pretend to take them seriously after they occur, even if their apologies are usually mixed with attempts to shift the blame and plenty of dissembling about the severity of the breach. So it comes as a shock to see a telco spending money on promoting the notion that breaches have less impact on customer confidence than widely believed.
It’s a fact of modern life: Data breaches happen. How businesses respond to a breach is what matters to consumers.
That’s a key finding of the new Canadian Breach Response Report by TELUS, in partnership with global market intelligence firm, IDC. The study reveals Canadian consumers understand that data breaches are a part of life, with more than three-quarters of respondents saying their trust would not be irreparably damaged by an incident. In fact, 77 per cent have accepted the fact that security breaches will happen, and that they can be managed. Organizations have an opportunity to build trust through transparent data practices and meaningful responses.
This quote is taken from a paid advertorial in The Globe and Mail, one of Canada’s most popular newspapers. Although the advertorial is designed to look like a normal article, its status is clarified at its end.
Advertising feature produced by Globe Content Studio with TELUS. The Globe’s editorial department was not involved.
To be fair to TELUS, I would not disagree with the claims made by their advertorial. Their research suggested most people will not switch suppliers just because of a data breach. They also found that the way management responds to a breach has more influence on customer perceptions than the fact the breach occurred. A breach that is handled adroitly may lead to increased respect for the organization that suffered the breach. These observations are consistent with other data I have seen from around the world. But I would still question the wisdom of deliberately associating TELUS’ brand with assertions like ‘data breaches are a fact of life’. It would be easy to quote portions of their advertorial out of context following a breach, and thus characterize TELUS as being indifferent to the consequences of privacy breaches.
The purpose of the advertorial is to promote TELUS’ security services to other organizations, not to tell ordinary phone users they should not worry about breaches. That results in a jarring contrast between the tone of the advertorial and the TELUS security webpage it points to, which uses big letters to warn:
86% of Canadians are concerned about their data after a breach
So now we know that 86 percent are ‘concerned’ whilst 77 percent ‘have accepted the fact’; it is easy to see how statistics about public opinion can be contorted to suit conflicting narratives. Risk professionals should always be wary of accepting such figures at face value.
A recent study by the TM Forum found that 62 percent of telcos consider security to be one of the best opportunities for revenue growth. The contradictions in tone surrounding the TELUS advertorial help to illustrate a key difficulty faced by telcos that hope to increase revenue from security services. Nobody likes to pay twice for the same thing. Telcos need to avoid the perception that they are seeking to profit from security services that address weaknesses in the security of their comms services. It may seem that selling security on a B2B basis will not affect the marketing of comms services supplied on a B2C service. However, there will be questions asked about management priorities when an issue affects the privacy of many consumers. When it happens, management does not want to appear to have failed to secure their networks because they were not willing to pay for the quality of security they sell to others.
