They want to avoid class-action lawsuits and possible shareholder revolt. During his audits, Dr. Ponemon's team does everything from interviewing employees to sifting through reams of data housed in computer servers. And the results can be surprising. He adds, though, that most problems are the result of human error. Oftentimes, employees don't know the company's policies well and are not trained to follow them.
Many companies make pains to revise their practices to conform to their stated privacy policies.
Others, Dr. Ponemon says, have even abandoned certain businesses because of the potential privacy problems. He declines to give examples. The audit, Expedia says, proved that the company was in compliance with its stated privacy policies. Still, Expedia made the language of its privacy policy more explicit. The company also changed its policy for sending out promotional e-mail messages with discounts on airlines and hotels.