New Research Institute Tackles Privacy Issues

In September, he launched the Ponemon Institute, whose mission is to promote ethical information and privacy management practices in business and government.

Ponemon, formerly with PricewaterhouseCoopers and KPMG, describes the organization, based here, as an independent "think tank" focused on research and education. One of its primary activities will be rating, or benchmarking, the performance of companies in a particular industry with respect to privacy and data management policies.

The institute, which he is funding himself and which has one part-time and four full-time employees, also aims to develop a framework that organizations can use as a blueprint for implementing and adhering to privacy practices.

While some federal regulations to protect consumer privacy, such as the Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act, serve as motivation for companies to institute privacy policies, they haven't had a big impact on the way companies conduct business, Ponemon said.

"We want to come up with a motivation other than the regulations. We want to get companies to think of this as a competitive advantage," he said.

Ponemon recently was CEO of Privacy Council, a Richardson, Texas-based provider of privacy solutions, and remains on its board of directors. He has a Ph.D. in business ethics and served on an advisory committee on privacy for the Federal Trade Commission.

He came up with the idea of a think tank that would be independent of a specific product or solution about four years ago while working at Pricewaterhouse-Coopers, where he was global managing partner of compliance risk management, which included the firm's privacy practice. Before that, he headed KPMG's business ethics services.

Chris Larsen, chairman and CEO of Dublin, Calif.-based E-Loan, recently joined the Ponemon Institute's board of directors.

E-Loan had been a client of Ponemon's when he was with PricewaterhouseCoopers and Privacy Council.

The Ponemon Institute "will bring some integrity and clarity to the whole debate about privacy," Larsen said.

Ponemon brings clarity by bridging the two sides of the debate,citizens and businesses, he said. He also helps companies understand that if they don't make privacy a priority, they'll lose their customers' trust, Larsen said.

The institute will help raise the privacy bar, said Steve Skinner, president and CEO of Peppers and Rogers Group, a management consulting firm based in Norwalk, Conn., where Ponemon is a partner heading its privacy practice.

"What Larry is doing with privacy is taking something that many people see as a regulatory or compliance issue that they have to deal with but don't necessarily like dealing with and turning it into a competitive advantage by helping companies understand responsible information management," Skinner said.

Ponemon's passion for privacy goes back nearly 20 years. While working at KPMG, he saw privacy looming on the horizon as a big issue in the Internet age, as it became easier for companies and government agencies to collect information about people, he said.

Privacy has become a particularly critical issue after last year's terrorist attacks, Ponemon said.

"We want the government to use the best technology to sniff out the bad guys and protect us from another 9/11, but at the same time we don't want that to be intrusive, where everyone has a dossier," he said.

When it completes a study, Ponemon Institute will offer companies detailed benchmark reports for a fee, typically about $25,000, which includes a half-day workshop.