Your marketing department wants to collect more information from Web surfers to bulk up its new customer data warehouse. The CIO says it's a no-brainer and gives the thumbs-up. But the lawyers say, “Whoa,” citing pending privacy regulations that may curb some of the data-collection practices. Who steps in to arbitrate? The Internet company's privacy officer.

Against the backdrop of diminished dotcom expectations, this collision of forces is expected to produce one of the fastest-growing, better-paying Net occupations of the early 2000s. The current corps of 200 chief privacy officers in the United States will explode to between 3,000 and 4,000 over the next year or two, according to Herman Collins, CEO of Privacy Leaders, a Las Vegas recruiter specializing in CPOs.

Increasingly, these executives will build their own departmental staffs to handle the countless day-to-day tasks involved in balancing these opposing forces: companies' profit-driven need to learn about their customers' habits vs. their customers' desire to be protected from spying and having information about them sold to the highest bidder.

Why is the need for privacy officers and departments arising now? The driving force is a set of recently enacted federal laws that will push financial and healthcare companies to hire privacy managers. Some regulations on financial institutions take effect this year; witness the appointment of CPOs at American Express, Citicorp and Royal Bank.

What Do Privacy Managers Do?

Privacy is intrinsically a multidisciplinary field. The privacy pro must take a leading role as a government liaison monitoring regulatory compliance, as a public affairs specialist and as an ombudsman, making consumer viewpoints known throughout the company, according to Robert Ellis Smith, editor of the newsletter Privacy Journal in Providence, Rhode Island.

In addition, says Smith, “the CPO has to pass judgment on new systems to assess their privacy impact, and work closely with legal council.” A company's privacy guru must be able to take a tough stand and defend it on multiple fronts. “A CPO is quite often the person who has to say no to marketing or technology departments.”

The CPO must also carry out many other functions, according to a report by Alan Westin, publisher of Privacy & American Business in Hackensack, New Jersey. Among the duties Westin enumerates:

• Organize the company's privacy committee.
  
• Conduct privacy risk assessments.
  
• Monitor legal and regulatory compliance.
  
• Handle crisis management, e.g., a security breach.

Some tasks may be delegated to staffers reporting to the CPO. In the most common form of privacy organization, responsibilities are divided along the lines of business units or departments, according to Ray Everett-Church, founder of consultancy PrivacyClue in San Jose, California. The CPO may, for example, dispatch three privacy managers to work with business development, marketing and the CIO. “These deployments assure that each major department of a company has someone tasked with privacy compliance issues in their areas,” says Everett-Church.

What Background Is Required?

The work of privacy managers is multifaceted by nature, but two areas of expertise clearly occupy the center. “CPOs typically have a law degree with some high tech exposure,” says recruiter Collins. Successful candidates often also have some experience in marketing, product development, consumer affairs and public policy.

For their efforts in juggling so many touchy areas of responsibility, privacy professionals earn excellent pay. In Silicon Valley or New York City, a privacy project manager pulls down $80,000 or more; at the director level, pay can exceed $110,000, says Everett-Church. Chief privacy officers are likely to command salaries of $150,000 to $300,000 or more.

So if you can stand the heat of friction among departments and between your company and the public, determining privacy policy may be an excellent career direction for this decade. But do yourself a favor, keep it a secret.