Marketers bolster cyber credentials as data breach notification law kicks in

It's d-day for the Notifiable Data Breaches legislation today. Here, we ask marketers what they're doing - and what they should be doing - as the laws come into effect


For many Australian organisations, 22 February marks the day when they lose much of their ability to hide shortcomings in how they safeguard the personal data of clients and employees.

The introduction of the Notifiable Data Breaches (NDB) scheme means an organisation with greater than $3 million in turnover that experiences a data breach likely to result in serious harm to any individuals whose personal information is involved must notify the Office of the Australian Information Commissioner and any affected individuals.

While the wording provides some wriggle room, particularly regarding what constitutes ‘serious harm’ and ‘likely to result’, neither the Privacy Commissioner nor the general public are likely to show much favour to organisations that knowingly fail to come clean.

Consensus has been building for some time that no organisation today is truly safe from a cyberattack, and no amount of spending can render it invulnerable. That leaves organisations to consider what they will do not if – but when – a cyber breach occurs.

Defending against breaches has long been the domain of technical specialists. But given the impact prominent data breaches at Target, Sony and Equifax have had on their brand value, NDB has become a piece of legislation every marketer should be paying attention to.

Tackling NDB at Carsales

For Carsales’ Kellie Cordner, the requirements of NDB are not so much a new imposition, as simply a way of life. As chief marketing officer, Cordner shares responsibility for the cyber defences of her organisation with the rest of her executive leadership team.

“It is something we are all signed up to, and that runs through even through our board,” she tells CMO.

The organisation has had a data breach plan in place since long before Cordner joined in 2016, with an accompanying communications plan. These are audited on a regular basis, and Carsales also conducts extensive scenario planning to ensure it is covering every possibility.

Cordner says it is vital Carsales constantly monitor its brand health and the trust that customers place in it, and keeps striving to protect that.

“As a marketer, you have to absolutely 100 per cent be all over this, and so does our CFO, our general counsel, and so on,” Cordner says. 

“The last thing you want to do when you are the custodian of trust in the brand is to be putting a foot wrong. As marketers, we are the ones that use that personal data, and we are the ones that will deal with the fallout if anything happens. People do business with brands they trust. Hence our data practices are front and centre.”

They are also built into Carsales’s policies and procedures, including its induction processes, and all staff undergo annual reaccreditation.

“With my marketing group, the minute you are touching customer data you’ll go through checks and balances with our cyber team and our dev and tech guys,” Cordner says. “You may have good intentions, but we ensure they have that locked down and covered.”

Cordner’s career did not commence in the digital realm, but she has worked hard to understand the essentials of how the data she manages is protected. One of her key methods has been to find people more knowledgeable than herself and ask them for real-life examples of how cyber breaches and defences work.

“Using actual real examples is the best way I know to wrap my head around it,” Cordner says “If you are in a traditional business and venturing into this world, a lot of times you don’t know what you don’t know. You have to make it your business as leading your marketing function to understand how you do this type of thing.”

Digital defence

Cordner is not alone, and there is a growing cadre of marketers embracing not just the digital realm, but also how to defend it.

Executive director for channels and platforms at Deakin University, Lynn Warneke, says the tighter coupling of cybersecurity and brand reputation means marketers should think carefully about cyber risk implications to brands. But she believes embracing cyber also provides an opportunity, particularly for those organisations underdoing digital transformation. Studies, for example, show perceptions of brand trust impact consumers’ willingness to share their data.

“Many organisations undergoing digital transformation aim to improve the customer experience through rich personalisation, so of course acquiring customers’ personal data is critical to success,” Warneke says. “The ‘UX of cybersecurity’ starts with perceptions about an organisation’s cybersecurity posture, transparency and data capture and handling practices.”

This includes assessment of the value on offer and concludes with calculations of whether to trust the organisation to protect and use data well enough.

“Getting that ‘return-on-sharing’ correct is critical for marketers,” Warneke says. “And given cyber risk is a critical element of that equation, marketers really should be paying attention.”

But while both Corner and Warneke have embraced cyber as essential to their roles, they are likely in the minority. This may be due to disinterest or the result of the pressure of other responsibilities. Warneke suggests it may also stem from those at the frontline of cybersecurity not thinking to include marketing in their discussions.

“The majority of organisations are addressing cybersecurity today, but many still appear to define and approach it as a defensive compliance task, and compliance isn’t usually a topic that galvanises marketers, or customers for that matter,” she says. “In the digital era, those organisations with a robust cyber posture – particularly one attuned to customer expectations and calculations about brand trust – have a potential value proposition that deserves marketers’ attention.”

Not surprisingly then, getting marketers more engaged in the cyber discussion is a challenge that is being taken up by the providers of cyber defence technology.

Up next: How marketers can ask the right questions to cope with data breach laws

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments

Latest Videos

More Videos

I found decent information in your article. I am impressed with how nicely you described this subject, It is a gainful article for us. Th...

Daniel Hughes

What 1800 Flowers is doing to create a consistent customer communications experience

Read more

Extremely informative. One should definitely go through the blog in order to know different aspects of the Retail Business and retail Tec...

Sheetal Kamble

SAP retail chief: Why more retailers need to harness data differently

Read more

It's actually a nice and helpful piece of info. I am satisfied that you shared this helpful information with us. Please stay us informed ...

FIO Homes

How a brand facelift and content strategy turned real estate software, Rockend, around

Read more

I find this very strange. The Coles store i shop in still has Flouro lights? T though this would have been the 1st thing they would have ...

Brad

Coles launches new sustainability initiative

Read more

Well, the conversion can be increased by just using marketing, but in general if you are considering an example with Magento, then it is ...

Bob

How Remedy is using digital marketing and commerce to drive conversion

Read more

Blog Posts

Why conflict can be good for your brand

Conflict is essentially a clash. When between two people, it’s just about always a clash of views or opinions. And when it comes to this type of conflict, more than the misaligned views themselves, what we typically hate the most is our physiological response.

Kathy Benson

Chief client officer, Ipsos

Brand storytelling lessons from Singapore’s iconic Fullerton hotel

In early 2020, I had the pleasure of staying at the newly opened Fullerton Hotel in Sydney. It was on this trip I first became aware of the Fullerton’s commitment to brand storytelling.

Gabrielle Dolan

Business storytelling leader

You’re doing it wrong: Emotion doesn’t mean emotional

If you’ve been around advertising long enough, you’ve probably seen (or written) a slide which says: “They won’t remember what you say, they’ll remember how you made them feel.” But it’s wrong. Our understanding of how emotion is used in advertising has been ill informed and poorly applied.

Zac Martin

Senior planner, Ogilvy Melbourne

Sign in