Chief privacy officer

In the United States, the position of chief privacy officer was first established at consumer database marketing company Acxiom in 1991 with the appointment of Jennifer Barrett as CPO.^[9] The role operated in obscurity until August 1999 when the Internet advertising technology firm AllAdvantage appointed privacy lawyer Ray Everett to the first Internet-era instance of the role.^[10] This started a trend that quickly spread among major corporations, both offline and online.^[11][12] The role of the Chief Privacy Officer was solidified within the U.S. corporate world in November 2000 with the naming of Harriet Pearson as Chief Privacy Officer for IBM Corporation. That event prompted one influential analyst to declare, "the chief privacy officer is a trend whose time has come."^[13]

By 2001, the non-profit research organization Privacy and American Business reported that a significant number of Fortune 500 firms had appointed senior executives with the title or role of Chief Privacy Officer.^[14][15] The growth of the Chief Privacy Officer trend was further fueled by the European Union's passage in the late 1990s of data privacy laws and regulations that included a requirement for all corporations to have an individual designated to be accountable for privacy compliance.^[6][16]

By 2002, the position of Chief Privacy Officer and similar privacy-related management positions were sufficiently widespread to support the creation of professional societies and trade associations to promote training and certification programs. In 2002 the largest of these organizations, the Privacy Officers Association and the Association of Corporate Privacy Officers, merged to form the International Association of Privacy Officers, which was later renamed the International Association of Privacy Professionals (IAPP).^[17] The IAPP holds several conferences and training seminars each year around the world, hosting association members from major global corporations and government agencies, with executives seeking certification programs in privacy management practices.^[6] In 2019, it reportedly had more than 50,000 members^[18] globally, which its leadership attributed to companies' responses to new laws like the GDPR.^[19]

As the leader of a corporate privacy program, a CPO has a number of essential responsibilities,^[20] including:

• Managing the company's policies, procedures and data governance
• Driving privacy-related awareness and training among employees
• Leading incident response, including data breach preparedness
• Communicating privacy goals and values both internally and externally
• Designing controls for managing privacy compliance
• Assessing privacy-related risks arising from existing products and services
• Conducting Privacy Impact Assessments to identify risks in new or changed business activities
• Monitoring the effectiveness of privacy-related risk mitigation and compliance measures

Many of these activities and requirements are included in CPO job descriptions.^[21][22]

The role requires strong collaborative relationships^[23] with other stakeholders in an organization, including engineers and product managers^[24] (for privacy impacts to products and services), human resources^[25] (for privacy impacts to employee data), legal teams^[26] (for monitoring and interpretations of applicable laws and compliance measures), procurement and vendor management,^[27] and information technology and information security teams.^[28]

As organizations identify the need for a CPO, a frequent challenge arises in regards to placement of the role within the organization structure and the issue of overlap between similar "C-level" roles,^[29] most notably the many intersections between the roles of the CPO and the Chief Information Security Officer (CISO).^[30][31] While CPOs and CISOs have some overlap in responsibilities around data protection and data governance, ultimately privacy and security have different roles to play. For example, while CPOs and CISOs may both be concerned with the prevention of data breaches, responsibility for managing technical prevention measures will tend to lay with the CISO while a CPO's concerns will look more broadly at whether otherwise properly secured data is being used in ways that might place the company at legal, regulatory, or reputational risk.^[32]

Another area of potential overlap, and sometimes confusion, is the interaction between a CPO and the increasingly common role of Data Protection Officer (DPO). The DPO role is specifically required for certain organizations falling under the jurisdiction of the EU GDPR.^[33] DPOs have very specific roles, requirements, and expectations delineated in GDPR Article 39 and associated regulatory guidance, and those include a level of required independence and organizational separation that make it very different from a CPO.^[4]

While a number of CPOs come from legal backgrounds and have Juris Doctor (or equivalent) degrees, the CPO role is a multidisciplinary one. The role requires an executive with an understanding of how data collection and usage, and the associated risks all factor into an organization's day-to-day business operations.^[34] CPOs also need to be aware of a range of legal, regulatory, contractual, and other factors that impact an organization's privacy risk strategy. For these reasons, many believe that a legal background is a requirement for a successful CPO.^[35] Others believe a legal background may result in too narrow of a focus,^[36] and CPOs should have more than just a legal background.^[37]

Among other qualifications that are seen as valuable in CPOs are strong communications skills, particularly in the area of public relations. This is due to the role being partly responsible for the development and execution of public outreach strategies in the event of data breach or other data-related security incident, and the CPO often functions as the public relations face of the organization.^[38][39][40] CPOs are also often called upon to function as a lobbyist representing the organization's interests before lawmakers.^[41] CPOs are also increasingly required to have deep knowledge of the organization's data-related operational practices and technologies, as well as the interaction between compliance measures that span the realms of privacy and security.^[42]

An increasing number of individuals seeking careers as CPOs will seek training in multiple disciplines related to the field.^[43] Among the most common credentials seen in the space include:

• Certified Information Privacy Professional (CIPP) with regional specializations such as US, Canada, Europe, and Asia^[44][45]
• Certified Information Privacy Manager (CIPM)^[46][45]
• Certified Information Privacy Technologist (CIPT)^[47][45]
• Certified in Healthcare Privacy and Security (CHPS)^[48]
• Certified in Healthcare Privacy Compliance (CHPC)^[49]
• Certified Information Systems Security Professional (CISSP)^[50]

The complexity of the role and the challenge of finding individuals with the right mix of skills, education, and experience is reflected in the salary data. As of 2021, the CPO role commands a median salary of $200,000 globally, and over $212,000 in the United States.^[51][52] By other accounts, median salaries in 2021 for privacy office roles in the US ranged from $114,638 to $126,000.^[53][54]

• Chief Privacy Officer, Department of Homeland Security
• Chief Privacy Officer - US Department of Education
• Chief Privacy and Civil Liberties Officer - US Department of Justice
• Privacy Office - US Department of State
• County Privacy Office - County of Santa Clara California (US)
• Chief Privacy Officer - US Consumer Financial Protection Bureau
• Government Chief Privacy Officer - Government of New Zealand
• Campus privacy officer