Marketers bolster cyber credentials as data breach notification law kicks in

It's d-day for the Notifiable Data Breaches legislation today. Here, we ask marketers what they're doing - and what they should be doing - as the laws come into effect


For many Australian organisations, 22 February marks the day when they lose much of their ability to hide shortcomings in how they safeguard the personal data of clients and employees.

The introduction of the Notifiable Data Breaches (NDB) scheme means an organisation with greater than $3 million in turnover that experiences a data breach likely to result in serious harm to any individuals whose personal information is involved must notify the Office of the Australian Information Commissioner and any affected individuals.

While the wording provides some wriggle room, particularly regarding what constitutes ‘serious harm’ and ‘likely to result’, neither the Privacy Commissioner nor the general public are likely to show much favour to organisations that knowingly fail to come clean.

Consensus has been building for some time that no organisation today is truly safe from a cyberattack, and no amount of spending can render it invulnerable. That leaves organisations to consider what they will do not if – but when – a cyber breach occurs.

Defending against breaches has long been the domain of technical specialists. But given the impact prominent data breaches at Target, Sony and Equifax have had on their brand value, NDB has become a piece of legislation every marketer should be paying attention to.

Tackling NDB at Carsales

For Carsales’ Kellie Cordner, the requirements of NDB are not so much a new imposition, as simply a way of life. As chief marketing officer, Cordner shares responsibility for the cyber defences of her organisation with the rest of her executive leadership team.

“It is something we are all signed up to, and that runs through even through our board,” she tells CMO.

The organisation has had a data breach plan in place since long before Cordner joined in 2016, with an accompanying communications plan. These are audited on a regular basis, and Carsales also conducts extensive scenario planning to ensure it is covering every possibility.

Cordner says it is vital Carsales constantly monitor its brand health and the trust that customers place in it, and keeps striving to protect that.

“As a marketer, you have to absolutely 100 per cent be all over this, and so does our CFO, our general counsel, and so on,” Cordner says. 

“The last thing you want to do when you are the custodian of trust in the brand is to be putting a foot wrong. As marketers, we are the ones that use that personal data, and we are the ones that will deal with the fallout if anything happens. People do business with brands they trust. Hence our data practices are front and centre.”

They are also built into Carsales’s policies and procedures, including its induction processes, and all staff undergo annual reaccreditation.

“With my marketing group, the minute you are touching customer data you’ll go through checks and balances with our cyber team and our dev and tech guys,” Cordner says. “You may have good intentions, but we ensure they have that locked down and covered.”

Cordner’s career did not commence in the digital realm, but she has worked hard to understand the essentials of how the data she manages is protected. One of her key methods has been to find people more knowledgeable than herself and ask them for real-life examples of how cyber breaches and defences work.

“Using actual real examples is the best way I know to wrap my head around it,” Cordner says “If you are in a traditional business and venturing into this world, a lot of times you don’t know what you don’t know. You have to make it your business as leading your marketing function to understand how you do this type of thing.”

Digital defence

Cordner is not alone, and there is a growing cadre of marketers embracing not just the digital realm, but also how to defend it.

Executive director for channels and platforms at Deakin University, Lynn Warneke, says the tighter coupling of cybersecurity and brand reputation means marketers should think carefully about cyber risk implications to brands. But she believes embracing cyber also provides an opportunity, particularly for those organisations underdoing digital transformation. Studies, for example, show perceptions of brand trust impact consumers’ willingness to share their data.

“Many organisations undergoing digital transformation aim to improve the customer experience through rich personalisation, so of course acquiring customers’ personal data is critical to success,” Warneke says. “The ‘UX of cybersecurity’ starts with perceptions about an organisation’s cybersecurity posture, transparency and data capture and handling practices.”

This includes assessment of the value on offer and concludes with calculations of whether to trust the organisation to protect and use data well enough.

“Getting that ‘return-on-sharing’ correct is critical for marketers,” Warneke says. “And given cyber risk is a critical element of that equation, marketers really should be paying attention.”

But while both Corner and Warneke have embraced cyber as essential to their roles, they are likely in the minority. This may be due to disinterest or the result of the pressure of other responsibilities. Warneke suggests it may also stem from those at the frontline of cybersecurity not thinking to include marketing in their discussions.

“The majority of organisations are addressing cybersecurity today, but many still appear to define and approach it as a defensive compliance task, and compliance isn’t usually a topic that galvanises marketers, or customers for that matter,” she says. “In the digital era, those organisations with a robust cyber posture – particularly one attuned to customer expectations and calculations about brand trust – have a potential value proposition that deserves marketers’ attention.”

Not surprisingly then, getting marketers more engaged in the cyber discussion is a challenge that is being taken up by the providers of cyber defence technology.

Up next: How marketers can ask the right questions to cope with data breach laws

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments

Latest Videos

Conversations over a cuppa with CMO: Craig Davis

​Leadership resilience, startups scaling up, marketing best practices, customer insights - these are just a few of the topics we manage to explore in the latest episode of Conversations over a Cuppa with CMO featuring Craig Davis.

More Videos

Good day sir / madamWe CLOSED JOINT-STOCK COMPANY AO KAYUM NEFT OIL COMPANY is one of theleading Oil & Gas trading companies in Russi...

BARYBKIN ALEXANDER ALEXANDROVI

Oath to fully acquire Yahoo7 from Seven West Media

Read more

Thank you for sharing your knowledge. Definitely bookmarked for future reading! Check this website https://a2designlab.com/ with lots of ...

Ryota Miyagi

Brene Brown: What it takes to be a brave leader right now

Read more

Well said! It is high time to look into the cultural values and beliefs of the audience before serving with the ads. If it is against the...

Praveen Kumar

The X factor in multicultural media planning and buying - Digital advertising - CMO Australia

Read more

I completely agree with you. High-quality customer service only strengthens loyalty to the company and helps to increase sales and increa...

Natali

Mercer CMO: How B2B brands can achieve customer love

Read more

I can imagine Google just not providing hits for these business.They need Google more than Google needs them.What about all the other sea...

Michael Hackett

Google hits out at ACCC draft code of conduct for news media negotiations

Read more

Blog Posts

Life beyond the cookie: 5 steps to mapping the future of marketing measurement

​There’s no denying there’s been a whirlwind of response to the imminent demise of the third-party cookie from all parts of the industry. But as we’ve collectively come to better understand the implications, it’s clear this change is giving the digital advertising industry the opportunity to re-think digital marketing to support core industry use cases, while balancing consumer privacy.

Natalie Stanbury

Director of research, IAB Australia

Ensuring post-crisis success

The COVID-19 pandemic has exposed brands’ CX shortcomings and a lack of customer understanding. Given ongoing disruption, customer needs, wants and expectations are continually changing, also causing customers to behave in different ways. Just look at hoarding toilet paper, staple and canned food, medicinal and cleaning products.

Riccardo Pasto

senior analyst, Forrester

A few behavioural economics lesson to get your brand on top of the travel list

Understanding the core principles of Behavioural Economics will give players in the travel industry a major competitive advantage when restrictions lift and travellers begin to book again. And there are a few insights in here for the rest of the marketing community, too.

Dan Monheit

Co-founder, Hardhat

Sign in