How to leverage customer data insights to improve CX without risking their Privacy in 2023

Off the back of World Privacy Awareness Day 2023 just a few short weeks ago, eCommerce & Digitally First brands across industries and geographies are reflecting on approaches to better protect end user Privacy. As we enter a new year in which empathy and customer trust are deeply tied to how an organisation protects and masks consumers and business customers' personal data there has perhaps never been a more pertinent time to reflect on this important theme and initiative.

Each year, World Privacy Awareness Day falls on the 28th of January and kick starts and annual “international effort to create awareness about the importance of respecting privacy, safeguarding data, and enabling trust.” Supporting the increasing importance of privacy, a recent McKinsey study found that 85% of consumers value knowing an organisation’s privacy policy prior to making a purchase, demonstrating the importance of transparency in building digital trust. Harvard Business Review continued this theme and “The New Rules of Data Privacy 2022” sharing further guidance that organisations need to focus on extracting insight, not Personally Identifiable Information (PII). Most recently, Forbes discussed the practical tips organisations can take to build trust and foster loyalty by taking steps to safeguard customer privacy in 2023.

Adding to these trends, data privacy has never been so important to us in Asia Pacific. Australia had the highest data breach density in the world during the last quarter of 2022; twenty-four times higher than the global average. That’s a problem.

Yet as brands we continue to get it wrong. And there’s a big reason for that. In e-commerce and digital-first environments in particular we insist on collecting data that we must remember to route in a certain way, expire on a certain date, and have the right to be forgotten.? It’s a complex network of rules; of course, there will be slips. The thing is, slipping even once is unacceptable. Several companies found out the hard way towards the end of 2022, when 22 Australian accounts were breached every minute during Q4 , versus just two in the previous quarter. This was the quarter when Australia saw a 489% increase in data breaches. So many affected companies fell victim to Australia’s increasing ransomware problem – up 82% year on year. And Asia Pacific continues to be the most impacted region.?

Breaches are forcing stricter privacy standards

Such has been the impact of these security breaches that privacy updates were made across the business and regulatory worlds including:

ISO amendments

• Updates have been made to ISO standards. ISO 27701?relates to the way an organisation collects?personal?data and prevents its unauthorised use or disclosure

Increased penalties

• The Office of the Australian Information Commissioner (OAIC) passed the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022, introducing significantly increased penalties for serious or repeated privacy breaches . Responding to recent high-profile data breaches in Australia, the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 was fast-tracked, receiving royal assent on 12 December 2022. It enforces the most significant reforms to Australia's privacy laws since 2018.The 2022 amendment increases the maximum penalties for serious or repeated privacy breaches from $2.22 million penalty to whichever is the greater of:

- $50 million

- 3x the value of any benefit obtained through the misuse of information; or

- 30% of a company's adjusted turnover in the relevant period

• Great efforts have been also made by the Singapore government to set up and refine a personal data protection regime with the establishment of the Personal Data Protection Act (PDPA)
• Indonesia has also ratified their draft law on personal data protection . The draft law came into effect on October 17, 2022. The law, which is partly modelled on the EU General Data Protection Regulation, is Indonesia’s first “umbrella regulation” on personal data protection. The law will provide certain protections to Indonesian citizens’ data, and provide more legal certainty to parties processing such data.
• Multiple guidelines with various effective dates have been introduced in Thailand since the main data protection provisions under the Personal Data Protection Act (“PDPA”) came into full effect on 1 June 2021 . Organisations in Thailand should consider the new guidelines to ensure that their data privacy practices remain compliant with the PDPA.
• And India’s proposed new privacy law , is scheduled to be approved and come into effect in August 2023.

End of third-party cookies

• Google announced the phasing out of Chrome third-party cookies to prevent brands tracking individuals and further protect their data and shifting organisations focus to an increased understanding user behaviour and 1st party data on digital properties to maximise revenue and loyalty.

Without privacy guarantees we risk consumer trust

• In this tougher new environment with brands facing an increasing burden to guarantee customers’ privacy in the face of unprecedented security threats and increased penalties and regulation, maintaining consumer trust is everything.? A recent survey by McKinsey states 85% of consumers say they want to know an organisation’s data privacy policy before purchasing from them. Still the majority of brands are not in a position to live up to those expectations when it comes to digital data, according to the survey’s?Alex Singla and?Kate Smaje .

But we need insights from customer data to improve the CX

Here’s the catch. Our customers expect us to know them intimately and to deliver the customer experiences (CX) they want. When we don’t, they won’t hesitate to leave. FullStory’s 2023 global consumer survey says 72% of consumers say they will leave if website load times are frustratingly slow. And 57% of those who quit a website on perceiving the online customer experience to be poor won’t stop to tell you why – they will simply silently retreat. Which is why it's critical to harvest all the data you can from your website to understand how it’s performing and how visitors are receiving it.

Here’s the catch. Our customers expect us to know them intimately and to deliver the customer experiences (CX) they want. When we don’t, they won’t hesitate to leave. FullStory’s 2023 global consumer survey says 72% of consumers say they will leave if website load times are frustratingly slow. And 57% of those who quit a website on perceiving the online customer experience to be poor won’t stop to tell you why – they will simply silently retreat. Which is why it's critical to harvest all the data you can from your website to understand how it’s performing and how visitors are receiving it.

So, if we must have customer data to meet their needs what should we do?

The advice for organisations with eCommerce or Direct To Consumer (DTC) Digital operation is clear - only collect the data you need. Reviewing the way in which you collect customer data is a big part of trust. And trust drives customer retention.

Helping e-tailers do exactly that is a driving force behind the development of the Fullstory 's DXI (Digital Experience Intelligence) platform, which incorporates robust Private-by-Default capabilities to ensure all elements of customer data are masked at the source (website & mobile) no matter where they appear on the page so you can move faster with confidence.

Fullstory ensure’s digital experience privacy on your behalf in the following ways:

• Only collect what you need

Since third party data is leaving your kit bag and first party data is growing in importance, it’s critical to be mindful about what you record if you want to protect your customers and yourself. Essentially if?capturing specific customer data ?isn't critical, logging it can be more of a risk than a reward. FullStory's DXI platform uses?Private-by-Default ? to capture digital experience data precisely so that sensitive data is never gathered unnecessarily. FullStory manages privacy unique to the market by only collecting only what you opt to include which is far safer and minimises the risk of PII exposure.

• Don’t let your mask slip

By extension, when you mask elements using FullStory they don’t touch our servers. They never leave your browsers and mobile apps where they are processed and then completely left out (not hidden) when your data comes to us.

• Know your data hiding places

Many companies fall apart from a privacy standpoint not because there are holes in their data collection practices but because they have data hiding in unknown places. Cloud infrastructures don’t have hard boundaries, especially when you integrate third parties such as partners and suppliers. Maybe you are watertight, but are they? This was the driving question behind the development of Detections , feature in the FullStory platform that illuminates the places sensitive user Personally Identifiable Information (PII) like credit card details and passwords may be buried.

But don't just take my word for it.

MYOB has privacy at the centre of their DXI strategy

MYOB ’s solutions revolve around managing people’s sensitive business and accounting data, which is why privacy had to be a priority in analysing customers' online behaviour for improving the digital experience.? They are using FullStory's Private by Default capabilities to automatically exclude sensitive information from their analysis. By exploring customers’ digital experiences without breaching PII regulations MYOB has fixed bugs, improved its online environment through better understanding of customers and saved 25% in engineering costs.

Privacy is a big discussion, and with the recent focus on protecting customers it’s only getting bigger. Thats why we recently launched our free FullStory Community which brings together 1000s of Digital Experience Intelligence practitioners (UX, Product, Engineering, Support, Marketing & Executives) across the globe, and I love it, because this gives our customers a chance to air their views and ask their questions on important things like privacy.

With additional privacy reform on the Australian Government's agenda for 2023, the new year is the perfect time for organisations to review privacy practices and reset, ready for a year of further anticipated reform. This includes understanding what data you hold; where your data is stored, and de-identifying or destroying personal information that is no longer needed.

For a wealth of information to train your teams on the global privacy landscape, including practical training for all your teams and an overview video of FullStory’s Private-by-Default approach to protecting your digital customers data, visit the dedicated? FullStory Privacy Hub or get in touch with me directly and I’ll connect you with answers to your privacy questions.

Until next time, keep your user data private and build trust.

C.

---

Carrie Mott

Head of Marketing - Asia Pacific

FullStory