tag:econsultancy.com,2008:/topics/legal-and-regulations Latest Legal content from Econsultancy 2014-01-29T11:25:00+00:00 tag:econsultancy.com,2008:BlogPost/64208 2014-01-29T11:25:00+00:00 2014-01-29T11:25:00+00:00 The EU Consumer Rights Directive: should etailers be worried? Graham Charlton <h2>What is the aim of the directive? </h2> <p>The aims are noble enough, and broadly look to encourage more online shopping across the EU by eliminating dodgy practices such as pre-ticking boxes and hiding costs. </p> <p>According to the <a href="https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/226630/bis-13-1109-implementation-of-the-eu-consumer-rights-directive-2011-83-eu-impact-assessment-final.pdf">impact assessment</a> from the Gov.uk website: </p> <blockquote> <p>The aim of the directive is to encourage growth and consumer confidence through the harmonisation of rules in a limited number of areas so that traders and consumers face only one set of requirements wherever they sell and buy and sell in the EU.</p> <p>These areas are: Information to be provided when consumers buy goods and services. The Directive sets out what information must be provided and some rules on how and when it must be given. Cancellation rights and responsibilities for both traders and consumers where goods and services are purchased at a distance or off-premises. </p> <p>Clarification of delivery dates, and the passing of risk where goods are delivered. Prohibition of certain practices which can lead to hidden costs.</p> </blockquote> <h2>The EU proposals</h2> <h3>Cost traps</h3> <p>The directive aims to remove the risk of 'cost traps' such as people being tricked into paying for free services like horoscopes or recipes. The aim is make it explicit to customers that they have to pay for such things. </p> <h3>Price transparency</h3> <p>Customers have to be informed of the total costs of the products or services they buy, and online shoppers will not be liable for any extra fees if they weren't informed at the point of purchase. </p> <h3>Pre-ticked boxes</h3> <p>This is a crafty trick, and one which websites should never use if they care about customer experience. Good riddance. </p> <p>This is old example from <a href="http://econsultancy.com/blog/6650-ten-things-bhs-can-do-better-online">BHS</a>, with £150 of extra charges for unwary customers.  </p> <p><a title="BHS16 by ecblogger, on Flickr" href="http://www.flickr.com/photos/e-consultancy/5051980302/"><img src="http://farm5.static.flickr.com/4150/5051980302_5c7daf197f.jpg" alt="BHS16" width="480" height="280"></a></p> <h3>14 Days to change your mind on a purchase</h3> <p>This is an interesting one, and it's not clear so far how it fits in with existing legislation on returns. It has implication for companies' cashflow, with this period doubling from the current seven days. </p> <p>I would also assume that perishable goods, things like software and other items which are currently excluded would remain so, but this is something we'll look to confirm. </p> <h3>Clarity on returns charges</h3> <p>Retailers will need to make it clear before a sale who is responsible for the cost of returning goods.</p> <p>I would argue that, in general, <a href="http://econsultancy.com/blog/6951-why-online-retailers-shouldn-t-charge-for-returns">retailers shouldn't be charging for returns</a> as it can deter customers from a purchase, but they also have to weigh up the costs and benefits of doing so. </p> <h3>Changes to buttons? </h3> <p>This, on the face of it, may be the most alarming proposal, and seems to relate to the 'cost traps' mentioned above.  </p> <p>It suggests that buttons customers use to place orders online would need to explicitly state that an obligation to pay goes along with placing an order. </p> <blockquote> <p>If a distance contract to be concluded by electronic means places the consumer under an obligation to pay, the trader shall make the consumer aware in a clear and prominent manner, and directly before the consumer places his order, of the information provided for in points (a), (e), (o) and (p) of Article 6(1).</p> <p>The trader shall ensure that the consumer, when placing his order, explicitly acknowledges that the order implies an obligation to pay. If placing an order entails activating a button or a similar function, the button or similar function shall be labelled in an easily legible manner only with the words "order with obligation to pay" or a corresponding unambiguous formulation indicating that placing the order entails an obligation to pay the trader. If the trader has not complied with this subparagraph, the consumer shall not be bound by the contract or order.</p> </blockquote> <p>If you take this literally, then it could mean that something like this is required: </p> <p><img src="http://assets.econsultancy.com/images/0004/2392/Order_now.png" alt="" width="309" height="139"></p> <p>However, it could just be intended for the dodgier websites placing cost traps, or as a replacement for the final 'confirm order' button rather than for use on product pages where it would be a barrier to purchase. </p> <h2>Don't panic! </h2> <p>I want to stress that these proposals are just that at the moment, and are yet to pass through parliament. As with the EU 'cookie law' there may be a difference between the proposals and the implementation. </p> <p>Any changes in refund windows and to call-to-action buttons would obviously be a concern, but the rest of the proposals shouldn't worry respectable online retailers, and much of this just constitutes good practice. </p> <p>We'll be updating you on these proposals when we know more... </p> tag:econsultancy.com,2008:BlogPost/64132 2014-01-15T14:03:00+00:00 2014-01-15T14:03:00+00:00 Digital marketing and ecommerce trends for 2014 by Econsultancy CEO Ashley Friedlein Ashley Friedlein <h2><strong>My five highlighted trends which are <em>marketing/digital</em> focused</strong></h2> <h2>1. Multichannel</h2> <p>Some people call this ‘omnichannel’ or ‘integrated marketing’. Whatever you call it this is a ‘megatrend’ for me that will last for years to come but will be big for 2014.</p> <p>Angela Ahrendts, the Burberry CEO who is moving to Apple as SVP of Retail, says it succinctly: “Online, offline, it’s gotta be the same”.  </p> <h2>2. Real-time</h2> <p>In the same category as ‘always on’ and ‘agile’. Some of this is about technology (e.g. RTB or real-time analytics) but really it is about process and people.</p> <p>2014 will see more focus on marketing teams trying to work in ways that are more ‘real-time’. </p> <h2>3. Responsive</h2> <p>2014 will see big efforts to make all digital experiences <a href="http://econsultancy.com/admin/blog_posts/64072-25-of-the-best-responsive-design-sites-from-2013">responsive</a> so they adapt to the screen and context of use. Most obviously this applies to optimising the mobile experience in its many forms. </p> <p><img src="http://i.imgur.com/DeIyjta.jpg" alt="" width="630" height="556"></p> <h2>4. Personalisation</h2> <p>Another megatrend that I think will be big in 2014, but will continue for years yet.</p> <p>2014’s efforts will still largely be about personalising digital experiences but increasingly it’ll be about personalised multichannel experiences (see my first trend). </p> <h2>5. Marketing Automation</h2> <p>This is part of the megatrend that is data-driven marketing and decision-making. It sits closely alongside CRO (Conversion Rate Optimisation) that will also be a major focus for companies in 2014.</p> <p><a href="http://econsultancy.com/reports/marketing-automation-buyers-guide">Marketing Automation</a> has historically been largely the domain of B2B but this year we’ll see the thinking and technology applied to B2C too. </p> <h2><strong>And my five selected trends which are <em>technology</em>-focused</strong></h2> <h2>6. “Internet of Everything”</h2> <p>This has been big news at CES in Las Vegas last week. Connected cars, smart health services, and of course the ‘conscious home’ that Google’s acquisition of Nest for $3.2bn, announced yesterday, has further propelled into the limelight. </p> <h2>7. Wearables</h2> <p>This is really a sub-set of the previous point but is worth highlighting. Google Glass was big last year.</p> <p>The likes of Oculus Rift and Meta’s Space Glasses show what is possible. Internet-connected ‘wellness’ devices, watches, even fabrics will proliferate in 2014. </p> <p><img src="http://assets.econsultancy.com/images/resized/0004/1731/sony_smartband-blog-full.jpg" alt=""></p> <h2>8. Sensors</h2> <p>This too relates to the previous two points. Whether it is audio (e.g. Nuance), gesture (e.g. Myo), or structure sensors that can capture and transmit 3D images (for 3D printing among other things) the world of internet-connected sensors is exploding and will be exciting in 2014. </p> <h2>9. Geotargeting</h2> <p>Apple’s launch of iBeacons late last year have propelled localisation and geotargeted communications back into the limelight. 2014 is being heralded as the year of <a href="http://econsultancy.com/blog/63633-a-marketer-s-guide-to-ibeacons-and-bluetooth-low-energy">BLE (Bluetooth Low Energy)</a> as the tech that will really help this catch on.</p> <p>Whichever technology wins out, 2014 and beyond will see more localised and personalised experiences delivered for both content, marketing and payments.</p> <h2>10. Payments</h2> <p>The payments space was exciting last year but will further accelerate this year with huge amounts of activity from both start-ups and the bigger players.</p> <p>Payments will seek to become ‘frictionless’. They will become more mobile, integrated with social, and even voice-enabled. </p> <p><em>The above are just 10 that I’ve selected as the most ‘front of mind’ for me at the moment but do <a href="http://econsultancy.com/reports/digital-marketing-and-ecommerce-trends-and-predictions-for-2014"><strong>download the full 40+ page free report for all my trends and predictions across the 10 core digital topics Econsultancy covers</strong></a>.</em></p> tag:econsultancy.com,2008:BlogPost/64068 2014-01-06T16:00:00+00:00 2014-01-06T16:00:00+00:00 What is price discrimination and is it ethical? Arie Shpanya <h2><strong>What is price discrimination?</strong></h2> <p>The most basic definition of price discrimination is the act of charging different prices for identical items.</p> <p>The purpose is to capture consumer surplus (the money left of the table by charging a fixed price when some consumers would be willing to pay more), and maximize the area under the demand curve (i.e. revenue).</p> <p>There are three degrees of price discrimination:</p> <h3><strong>First degree</strong></h3> <p>This assumes that a seller knows the maximum price that every consumer is willing to pay. </p> <p>In theory, this allows the seller to maximize profit with no deadweight loss since it creates a perfectly efficient market (in economic terms), although in practice this is difficult to observe.</p> <h3><strong>Second degree<img style="float: right;" src="http://assets.econsultancy.com/images/0004/1579/buy_in_bulk.gif" alt="" width="162" height="233"></strong></h3> <p>Price varies depending on the quantity in demand. A common example of this is bulk discounts. Buyers differentiate themselves based on their preferences.</p> <p>To broaden the definition, it can also apply to quality. For example, first class and economy airline tickets, but the common factor is that the consumers differentiate and group themselves.</p> <h3><strong>Third degree</strong></h3> <p>Involves selling the same product at different prices to buyer segments. This happens when a company cuts the market into segments (segmentation variables) and fixes different prices for each group.  </p> <p>Charging different prices to different customers is legal (save for race-based and other sensitive cases), but if determined to have anticompetitive implications, it can be deemed illegal under the <a href="http://www.ftc.gov/bc/antitrust/antitrust_laws.shtm" target="_blank">Sherman Antitrust Act</a> and subsequent legislation (such as the Robinson-Patman Act of 1936). </p> <p>Price is varied between segments - the assumption being that these attributes factor into a customer’s willingness to way. The main segmentation variables are geographic, demographic, psychographic, and behavioral (seniors, students, price per country, etc).</p> <h2><strong>Examples of price discrimination</strong></h2> <h3><strong>First degree:</strong></h3> <p><a href="http://www.vjolt.net/vol6/issue2/v6i2-a11-Weiss.html" target="_blank">Victoria’s Secret</a> was inadvertently a pioneer in this field, when it tested price discrimination in 1996 through a mail order campaign. It mailed different versions of the same catalog, with different prices offered for the same item to different groups of consumers. </p> <p>By doing this, it could essentially create a real demand curve and assess the willingness to pay of different customer segments. One consumer was not happy to discover this, and filed a class action lawsuit claiming mail fraud against Victoria’s Secret. She lost. </p> <p>Retailers can distinguish between customers and price differences (as long as they do not discriminate based on impermissible attributes) and dynamic pricing is perfectly legal. </p> <p>To further drive the point home, the Judge even issued sanctions on the Plaintiff’s attorney for filing a frivolous lawsuit.</p> <h3><strong>Second degree</strong></h3> <ul> <li>Men’s Wearhouse is just one example of a retailer that offers deals such as, a suit at $299, but a discount when two are purchased ($500 for 2).</li> <li>Pharmaceutical company GOLDPHARMA uses this approach. For example, tablets were sold at $29.08 for 24 tablets, but only $60.15 for 96 tablets.</li> </ul><h3><strong>Third degree</strong></h3> <ul> <li>Drugstore.com customers can purchase a discount card called 'GOLD CARD' which gives a discount for GNC purchases.</li> <li>Office Depot offers a credit card bearing the logo of the store, and in return customers will receive special discounts throughout the year. Another technique that Office Depot uses is to send discount coupons to customers on the mailing list.</li> <li>Pharmaceutical company Fraser utilizes geographic price discrimination indirectly through its sub-suppliers. For example, 10 tablets of Viagra will be $69.95 for Canadian customers, while sites primarily designed for customers in the US sell the product at $103.99.</li> </ul><h2> <strong>Is it legal or ethical?</strong> </h2> <p>A University of Pennsylvania <a href="http://edition.cnn.com/2005/LAW/06/24/ramasastry.website.prices/" target="_blank">study</a> (Open to Exploitation: American Shoppers Online and Offline, Joseph Turow, Lauren Feldman, and Kimberly Meltzer) that addressed online price discrimination revealed that the majority of those surveyed believed that price customization was illegal, or strongly believed it ought to be. The truth is, it’s usually legal.</p> <p>Price discrimination is illegal if it’s done on the basis of race, religion, nationality, or gender, or if it is in violation of antitrust or price-fixing laws. The Robinson-Patman Act targets anticompetitive effects of differential pricing, but the online market is highly competitive and those effects are unlikely to arise.</p> <p>Companies retain cookies and maintain records for marketing purposes. It may be ethical if the customers allow it. But what about when this data can also be used to adjust the price or if the data is sold?</p> <p>Companies may include disclosures but how many customers actually read them? With the growth of big data, the ethics of such practices are a growing source of debate.</p> <h2> <strong>Who wins here?</strong> </h2> <p>Customers want to be treated fairly. But price discrimination occurs offline all the time, whether it be at a car dealership or a flea market.  So why is online price discriminating upsetting? It’s because often, customers don’t know that they are getting different prices. Privacy is another issue. </p> <p>There’s something a little unsettling about the amount and type of information that can be captured about you online. A recent <a href="http://www.mhfigi.com/wp-content/uploads/2013/10/MHFIGI-Data-Privacy-Concerns-FINAL.pdf" target="_blank">J.D. Power research study</a> found that over <strong>80% of consumers feel they have lost all control over how their personal information is collected and used by companies.<img style="float: right;" src="http://assets.econsultancy.com/images/resized/0004/1578/amazon_p_buy_box-blog-third.png" alt="" width="200" height="190"></strong></p> <p>Consumers already have their doubts and it is essential for retailers to try to maintain trust. Otherwise they may face scrutiny as retailers such as Amazon, Staples and more did after their pricing experiments.</p> <p>On the flip side, there are tech-savvy consumers out there and it’s quite easy for them to log in from a different IP address. These consumers may be able to take advantage of companies with geographic price differentials. Consumers also constantly utilize data themselves through price checking.</p> <p>Retailers also need real-time data and analytics to stay ahead of the curve. They are increasingly investing in dynamic pricing technologies that allow them to optimize prices based on changes in the marketplace.</p> <p>And if part of the strategy is to outprice a competitor? The consumer can win here too. Dynamic pricing can be consumer-friendly in many aspects, and can often result in a win-win situation for retailers and consumers (i.e. lower prices for consumers, higher volume for retailers).</p> <p>Dynamic pricing isn’t just about using customer data; it’s about market benchmarking such as taking into consideration what competitors are doing, or setting prices according to an optimal margin.</p> <p>Price adjustments may sometimes mean someone is paying a lower price today than you did last week, but it’s not much different from missing out on a temporary promotion. Fluctuating prices can mean higher prices at times, but it also can mean lower prices at other times. The manifestation is just a bit different now since it’s changed in line with technology.</p> <h2><strong>A fine line for retailers</strong></h2> <p>There’s no denying that data is a powerful tool. The key to implementing a dynamic pricing strategy is having the right data, and utilizing it in a responsible, effective way without alienating customers.</p> <p>At last year’s Silicon Valley Comes to Oxford event Michael Chui of the McKinsey Global Institute, who has done extensive research on <a href="http://econsultancy.com/blog/63594-10-actual-uses-of-big-data">Big Data</a>, concluded that:</p> <blockquote> <p>The use of data and analytics in general is going to be a basis of competition going forward... Those companies that are able to use data effectively are more likely to win in the marketplace.</p> </blockquote> <p>Dynamic pricing can be an effective way to optimize sales for retailers, but if it’s not implemented responsibly or if it doesn’t support the overall business strategy, it can carry potential <a href="http://econsultancy.com/us/blog/61958-five-dynamic-pricing-issues-retailers-should-consider" target="_blank">risks</a> just as any pricing strategy can.</p> <p>Ensure that the data is reliable and accurate. Use the data responsibly and be aware of best practices. Make sure not to lose the trust factor and evaluate the level of transparency you want to maintain regarding your policies.</p> <p>Fixed pricing isn’t dead, but the market is rapidly changing, and more retailers continue to adopt dynamic pricing. For other retailers, will their pricing strategies get them left behind the competition if they don't adapt?</p> tag:econsultancy.com,2008:BlogPost/63942 2013-12-04T15:28:48+00:00 2013-12-04T15:28:48+00:00 ICANN: new domains are about consumer choice and helping SMEs David Moth <p>Speaking to Atallah this week I asked what exactly he meant by this, considering the fact that most people are presumably happy with the current set up.</p> <p>“The TLD programme was born due to the need for competition and diversity within the domain name system and to provide choice for consumers,” he said.</p> <blockquote> <p>The variety of domain names is scarce, so they are inevitably getting longer. Originally domains were five or six characters long, now they are frequently 16 or 17 characters long. There’s a lack of availability and memorable names.</p> </blockquote> <p>Atallah certainly has a point in this instance as in the digital age company names are becoming ever more obscure due to the need to find a short, available domain name. </p> <p>But what of the impact on existing companies? Research has shown that <a href="http://econsultancy.com/uk/blog/63841-nominet-ploughs-ahead-with-uk-domains-despite-opposition">businesses with .co.uk TLDs are almost universally against the roll out of a new .uk domain</a>, however these objections were ignored during the consultation period.</p> <p><em><strong>Results of survey into attitudes towards new .uk domain</strong></em></p> <p><img src="http://assets.econsultancy.com/images/0004/0960/Nominet_comsultation_.png" alt="" width="535" height="623"></p> <p>According to Atallah the expansion is not really about existing domain holders, it’s about emerging SMEs and internet users that will soon be coming online.</p> <blockquote> <p>It’s not fair to say that only existing companies are able to have the good domains and everyone else should be locked out.</p> </blockquote> <p>Atallah said that the new domains open up exciting opportunities for new businesses as they can develop a marketing strategy around their new name and domain.</p> <p>The example he gave is of a fictional London pizza shop, which at the moment might be restricted on the domain name that it can opt for. However the new .london TLD opens up a far wider choice of domains, which makes it easier to come up with a marketing strategy.</p> <blockquote> <p>Initially it was always lawyers registering domains, but now we are seeing more marketing folks taking a look at it. We believe this will become a trend and that people are beginning to look at the new domains as an asset and deciding how they will take advantage of it.</p> </blockquote> <p>The new TLDs also cater to nations that don’t use the Latin language, in theory making the web more accessible.</p> <p>Again, it is difficult to argue against that point, however it’s also easy to be cynical when taking into account the costs involved with the process and the additional administrative pressure placed on existing trademark holders.</p> <p>Though there are systems in place to protect copyrights and trademarks so that brands don’t fall victim to cybersquatting, the onus is on businesses to make sure they claim their trademarked domains within each relevant TLD.</p> <p>As Atallah points out, in practice it’s unlikely that brands will need to claim their domains in each of the 1,500 new TLDs. For example, Apple would presumably have no reason to want to claim ‘apple.bbc’ as it’s not really relevant to its industry.</p> <p>However even if Apple still felt it was necessary to claim its trademark in half of the new TLDs, that’s still more than 500 new domains that have to be registered, paid for and renewed on an on-going basis, which is no easy task.</p> <p>So despite the potential benefits for emerging SMEs, the new TLDs may prove to be something of an administrative headache and potential business risk for existing ecommerce sites.</p> tag:econsultancy.com,2008:BlogPost/63749 2013-11-13T16:41:00+00:00 2013-11-13T16:41:00+00:00 Don't be fooled by the name: cyber security is about people, not technology Jessica Barker <h2><strong>Human error</strong></h2> <p>In cyber security we often say 'there is no such thing as a malicious machine'. Trace a cyber attack or information breach back to its source and you won't find code, you'll find a person.</p> <p>In fact, most information breaches are the result of human error and a lack of awareness, and the 'human problem' appears to be increasing.</p> <p><a href="http://www.symantec.com/en/uk/about/news/release/article.jsp?prid=20130605_01">Larry Ponemon</a>, Chairman of the Ponemon Institute.</p> <blockquote> <p>Eight years of research on data breach costs has shown employee behavior to be one of the most pressing issues facing organizations today, up 22%</p> </blockquote> <p>Some recent information breaches handled by the Information Commissioner's Office (the ICO; the UK’s independent authority set up to uphold information rights in the public interest) help to illustrate the point: </p> <ul> <li> <strong><a href="http://www.ico.org.uk/news/latest_news/2013/1000-prisoners-details-emailed-to-inmates-families-22102013">Ministry of Justice</a></strong>. Details of all 1,182 prisoners at HMP Cardiff were accidentally emailed to the families of three inmates; the ICO issued a £140,000 penalty and referred to a "clear lack of management oversight".</li> <li> <strong><a href="http://www.ico.org.uk/news/latest_news/2013/medical-records-lost-on-bike-ride-home-04102013">Cardiff and Vale University Health Board</a>.</strong> A consultant psychiatrist was cycling home and lost a bag off the back of their bike which contained sensitive personal data including a mental health act tribunal report relating to a patient.  <p>The ICO commented that “this data breach was entirely avoidable" and specifically referred to the lack training the consultant had received.</p> </li> <li> <strong><a href="http://www.ico.org.uk/news/latest_news/2013/Bank-of-Scotland-receives-75000-penalty-after-three-year-fax-blunder-05082013">Bank of Scotland</a>.</strong> Customers' account details were repeatedly faxed to wrong recipients in a "four year fax blunder" due to human error inputting the wrong fax numbers; the Bank of Scotland was issued a £75,000 monetary penalty for the breach.</li> </ul><p>A lot of people will have heard of, experienced, or worried about losing information in scenarios like the examples above, from mistyping an email address to losing papers on the commute home from work.</p> <p>People will always make mistakes, but policies, procedures and training help to minimise mistakes by making them both much less likely and less damaging.</p> <p>They do this by helping people to understand:</p> <ul> <li>The <strong>value of information</strong> in general, and the particular types of information they really need to take care of (this is why many organisations, including the UK government have an <a href="http://en.wikipedia.org/wiki/Classified_information_in_the_United_Kingdom">information classification system</a>).</li> <li>The <strong>cyber threats</strong> and what, in particular, they should look out for.</li> <li>What is expected of them, in terms of both<strong> why and how they should keep information safe.<br> </strong> </li> <li> <strong>What to do</strong> in case of an information breach or a cyber attack.</li> <li>Where they can turn for more <strong>help, advice or support.</strong> </li> </ul><p>Driving awareness of the threats and implications of data loss, and supporting staff to understand what they can do to better protect information, makes a huge difference when it comes to cyber security.</p> <p>In fact, <a href="http://www.ey.com/GL/en/Services/Advisory/Cyber-security">a survey published by Ernst and Young</a> in October 2013 argues that 80% of the solution to cyber security is non-technical. </p> <h2><strong>Internal data theft</strong></h2> <p>Reducing accidental breaches helps to protect your organisation from the day-to-day trickle of data loss. It also makes internal data theft, far less common than accidental loss but usually more costly, more noticeable.</p> <p>When staff members are trained in cyber security, they are more equipped to notice strange behaviour from a colleague, from requesting access to files that they don't need to emailing work to their personal email address or leaving the office with piles of paper. </p> <p>If we better understand what motivates people to steal data we can put measures in place to make those thefts less likely.</p> <p>Research by <a href="http://www.symantec.com/about/news/release/article.jsp?prid=20111207_01">Symantec</a> and <a href="http://www.mishcon.com/services/dispute_resolution/mishcon_recover">Mishcon de Reya</a> indicates that most internal data theft is perpetrated by lone men in their mid-20s to mid-30s, working in technical roles, generally stealing the data by technical means.</p> <p>However, over a quarter of internal data theft is carried out by stealing hard copies, and most discoveries of internal data theft are made by non-technical staff. This all reinforces the need to have a multi-discipline approach to cyber security and shows why keeping information safe is everybody’s job. </p> <p>Patterns tend to precede internal data theft: stress is often a motivating factor for malicious insiders, particularly a professional setback (perceived or real), which highlights the need for good morale in an organisation, reinforced by two-way communication and <a href="http://econsultancy.com/uk/blog/63644-how-to-improve-your-company-culture-with-12-simple-decisions">a culture that values staff members</a> (especially at times of <a href="http://econsultancy.com/uk/training/digital-transformation">organisational change</a>).</p> <p>Processes and procedures play an important part, too. For example, as <a href="http://www.verizonenterprise.com/DBIR/2013/">70% of data theft </a>takes place within 30 days of an employee handing in their resignation, robust exit procedures that take account of data theft should be in place.</p> <p>Insiders, particularly current &amp; former employees, are cited as <a href="http://www.pwc.com/us/en/cfodirect/issues/risk-management/global-state-information-security-survey-2014.jhtml">a common source of security incident</a>, yet many organisations do not have plans for dealing with an insider threat, and those that do are often not very effective. </p> <p><img src="http://i.imgur.com/KO65KDh.jpg" alt="" width="615"></p> <h2><strong>External attacks</strong></h2> <p>Of course, discussions about internal data theft and loss should not distract from the cyber attacks that come from outside an organisation.</p> <p>In fact, external cyber attacks on organisations have increased by <a href="http://www.ft.com/cms/s/0/cc62dc38-3759-11e3-9603-00144feab7de.html#axzz2jsYISf6t">50% in the last year</a>. On top of that, external attackers are turning more and more to ‘human’ methods to extract information from an organisation, from social engineering to phishing attacks, which have grown <a href="http://www.kaspersky.com/about/news/press/2013/Kaspersky_Lab_report_37_3_million_users_experienced_phishing_attacks_in_the_last_year">87% in the last year</a>.</p> <p>Increasingly busy lives, and the blurring of home and work life, also puts information at risk, as the <a href="http://www.symantec.com/en/uk/about/news/resources/press_kits/detail.jsp?pkid=norton-report-2013">2013 Norton Report</a> (of 13,022 online adults) shows: </p> <ul> <li>49% of respondents use their personal devices for work.</li> <li>30% of parents using mobile devices for work admit to letting their children use their devices (and as children generally use the internet to play games, use social networks, watch videos and engage in other <a href="http://www.bbc.co.uk/news/technology-24580139">risky behaviour online</a>, this puts work devices at greater risk).<br>  </li> <li>One quarter of file storage users say they use the same online file storage account for both work and personal documents.</li> <li>90% of PC users delete suspicious emails from people they don't know, whereas only 56% of mobile users do.</li> </ul><p>The 2013 Norton Report also addresses the increasing risks posed by social networking. One finding of the report is that 31% of social media users connect with people they don't know, the dangers of which were highlighted recently when a security exercise carried out on a US Government Agency <a href="http://www.dailymail.co.uk/news/article-2486975/How-fake-Femme-fatale-created-hackers-carried-cyber-attack-high-level-U-S-government-agency.html">hit the headlines</a>.</p> <p>Two hackers staged a cyber attack on a US Government Agency by setting up a Linkedin and Facebook profile posing as a young woman, and convinced officials to click a corrupted e-card that obtained passwords to sensitive documents.</p> <p>Within the first 15 hours, the fake profile had made 60 Facebook connections and 55 LinkedIn connections with employees from the targeted agency and its sub-contractors and within one week the hackers had achieved their aim of infiltrating the agency.</p> <p>This success of this exercise demonstrates the ease with which attackers can use social networks to gain access to people and their information.</p> <h2><strong>A multifaceted approach to a complex problem</strong></h2> <p>Cyber security is about trying to govern where humans and machines meet.</p> <p>In too many organisations, however, it is still seen as something for IT to tackle alone, but <strong>all of the technical solutions that money can buy will not protect an organisation from human error, malicious insiders and external attacks. </strong></p> <p>What do help to protect organisations are technical solutions implemented as one part of an organisational approach that depends on understanding of the value of information, and covers policies, procedures and training.  </p> <p>As MI5 Director General Andrew Parker commented at the recent Intelligence and Security Committee:</p> <p style="padding-left: 30px;">it's tempting to think that security relating to an IT issue must have an IT solution, and of course that's part of it… but those [IT solutions] sit within the whole range of security arrangements that we have - physical security of our facilities, but most importantly the personnel security that we apply to the vetting that our people have… the way they're managed, and the way all these measures together make it extremely difficult and extremely unlikely to have… breaches </p> <p>To take care of information, you must put people at the centre of your approach to cyber security.</p> tag:econsultancy.com,2008:BlogPost/63531 2013-10-07T09:43:00+01:00 2013-10-07T09:43:00+01:00 Tightly regulated: how does a Swiss bank go mobile? Ben Davis <p>If UBS uses social networks, it has to moderate all comments because any comment on products of other banks is potentially investigable by regulators.</p> <p>UBS also can’t be seen to recommend any products, especially in the US. On top of this, the bank, like a lot prestigious brands and companies after UHNW customers, is incredibly sensitive to risk and very protective of its brand.</p> <p>So the challenge for UBS is to navigate these difficulties. Here are some of the takeaways from Shane’s talk.</p> <h2>Closed group marketing: a personalised app for billionaires!</h2> <p>Fascinatingly, UBS created an app for 30 or so billionaires in the UHNW category (over $50m spending money).</p> <p>Each app was personalised to its user (they were handed an iPad at an F1 event) and the UBS mobile dev team were on site to manage the experience, adding features such as a personal photo library as the day went on.</p> <p>Shane explained that the regulation around customer names was so tight, they effectively had a war room with numbered pictures of customers, compiling photo albums without referring to anyone by name.</p> <h2>Challenges</h2> <p>The apps have to be sure not to garner information from their users in case this can lead to the identifying of customers. To that end:</p> <ul> <li>No free text forms in apps, so no questions or personal info can be added.</li> <li>No logging in to apps, for the same reason.</li> </ul><p>And with social media:</p> <ul> <li>The recording of all social communication in <a href="http://www.linkedin.com/company/ubs">LinkedIn </a>and on <a href="https://twitter.com/UBS">Twitter</a> is mandated, keeping it safely should the regulators require it. Nevertheless, UBS has some active social channels.</li> <li>Tweeting can apparently take days! Getting clearance from legal is a long old process.</li> </ul><p><img src="http://assets.econsultancy.com/images/resized/0003/8385/ubs_app-blog-half.png" alt=""></p> <h2>Over 30 apps</h2> <p>UBS apps are all free. They include a store locator, a prices and earnings comparison app, a funds manager and some tied in to UBS’s extensive sponsorship across F1, the Guggenheim, Art Basel and many local intitiatives.</p> <p><strong>Go check them out in the app store! And if you work in mobile, don't assume you know red tape until you've worked for a Swiss bank.</strong></p> tag:econsultancy.com,2008:BlogPost/63299 2013-08-28T17:41:37+01:00 2013-08-28T17:41:37+01:00 Gamification for marketers: what old school games can teach us about engagement Matthew Kates <p>Why is gamification such a powerful marketing approach? Because it allows brands to combine business interests with consumer interests by making content entertaining and fun.</p> <p>It may be a new word, but gamification is an old concept. It turns out we can learn a lot from classic board games like Pictionary and Monopoly by understanding who plays which games, and why.</p><p><strong>By understanding how the psychology behind some of our favorite board games still applies to what motivates consumers, marketers can tap into gamification. </strong></p> <p>Here are four categories of game mechanics that marketers can take advantage of to drive customer engagement and brand awareness.</p> <h2>1. Express yourself</h2> <p>This first example is games that motivate people, which fall into the expressive category. Games like Pictionary fall into this artistic, demonstrative category, because they give consumers a stage and allow them to tap into their creative side.</p> <p>What can marketers learn? Use an expressive campaign to capture or remarket authentic content, create a platform for your brand advocates, or a program that is incredibly viral.</p><p>Consider McDonald’s 'Perfect Pair Contest,' an engagement campaign geared toward driving awareness of a new Frozen Strawberry Lemonade, creating buzz around consumer generated content and getting people excited about the McDonald’s brand.</p> <p><img src="http://assets.econsultancy.com/images/0003/6915/McDonald_s.png" alt="" width="595" height="414"></p> <p>The Twitter contest asked consumers to nominate themselves and their significant other as the 'McDonald’s Perfect Pair,' and incorporated a video gallery, photos and a real-time leaderboard that consumers .</p><p>After judges selected the top ten Tweets, and finalists submitted videos explaining why they should win, all the content went live for public voting.</p> <p>This helped the campaign go viral by giving brand advocates a platform to express themselves, which resulted in a wealth of authentic <a href="http://econsultancy.com/us/blog/62970-four-ways-to-drive-engagement-with-user-generated-content" target="_blank">user generated content</a> for McDonald’s too.</p> <h2>2. Fortune Teller</h2> <p>By fortune teller - think games like the Magic 8 Ball. These games are simple interactions and a fun way for consumers to learn about themselves. Marketers can leverage the same motivators to gain consumer insight, educate and attract new consumers, and better recommend the right product or solution based on consumer responses.</p><p>Madewell’s “Are You Madewell?” Facebook app and microsite applied a fortune teller type game to gamification marketing. The retailer tapped into people’s desire to learn about themselves via multiple choice questions about their lifestyle and preferences to find their fashion personality.</p> <p><img src="http://assets.econsultancy.com/images/0003/6916/Madewell.png" alt="" width="434" height="567"></p> <p>Madewell drove “Likes” of the brand on Facebook, increased its email database and increased awareness of the new ecommerce site. Fortune teller games and personality quizzes result in great data and analytics for brands.</p> <h2>3. Earning points &amp; keeping score</h2> <p>Just as games like Monopoly entice us to play by offering competition, status recognition and even different payout levels, marketers can use programs that allow consumers to earn points based on complexity or value and track their progress.</p> <p>Brands can further motivate ongoing engagement across a variety of activities and place variable payouts on different actions by using badges (as recognition symbols) and real time leaderboards (as status updates).</p> <p><img src="http://assets.econsultancy.com/images/0003/6913/HBO.png" alt=""></p><p>HBO’s 'Win the Throne Sweepstakes' used a similar gamification marketing strategy to acquire new HBO subscriptions, while retaining current subscriptions. HBO engaged consumers in a fun, branded experience by having them register and answer a few questions to categorize them into one of five families.</p> <p>Participants could leave that family at any time and collect sweepstakes entries or points for activities like playing games, being in the top rated family, winning a bow and arrow shooting challenge, etc. The program motivated strong engagement across HBO’s Game of Thrones channels.</p> <h2>4. Skill-based games</h2> <p>Operation and Memory are classic examples of skill-based games. These games are mentally or physically challenging, or both. They motivate players to try over and over again, in an attempt to improve their performance.</p> <p>In marketing,<strong> brands can use this psychology to drive high frequency and create a memorable educational experience.</strong> Brands can also encourage participants to share scores and challenge friends, making for a huge viral opportunity.</p><p>Arby’s “Fresh Catch” promotion increased brand awareness of a new sandwich by leveraging this sort of gamification. The instant win fishing advergame allowed participants to play over and over again in order to better their performance, or in this case, catch more fish.</p> <p><img src="http://i.imgur.com/PomAYZy.jpg" alt="" width="524" height="338"></p> <p>The campaign went viral based on a wide range of consumers sharing scores, and participants came back over and over again to better their previous performance.</p> <h2>New word, old concept</h2> <p>Marketers can learn a lot from the board games we played on rainy days as kids. Gamification allows us to combine traditional marketing strategies with more innovative digital campaigns.</p><p>Everyone loves to play games, whether it is something more intellectual like Trivial Pursuit or more on the collaborative side, like Charades. This affinity to be challenged and to win, translates perfectly into marketing and turning consumers into brand advocates by offering them engaging games and interesting content.</p> <p>Once a brand decides on the overall promotion goal, it is simple to build a targeted <a href="http://econsultancy.com/uk/blog/9720-gabe-zichermann-gamification-isn-t-about-offering-free-stuff-it-s-about-status">gamification</a> program to support that. Can you think of any other gamification ties to old school games?</p> tag:econsultancy.com,2008:BlogPost/63059 2013-07-12T11:37:00+01:00 2013-07-12T11:37:00+01:00 Nominet stands to gain millions from .uk domains, but do businesses really need them? Graham Charlton <h2>The new proposals</h2> <p>Key controversies from the original proposals included the difficulty of existing .co.uk owners in acquiring the .uk versions of their domains, and the fact that part of the justification for the new extensions was security. </p> <p>The obvious response is: why not extend security to all UK domains? This is itself is no justification for .uk. Indeed, <a href="http://econsultancy.com/uk/blog/11191-q-a-nominet-on-the-uk-domain-proposals">Nominet's answers to these questions were unconvincing</a>, with the explanation that adding security measures to .co.uk would cost businesses more money.</p> <p>The revised proposal includes: </p> <ul> <li>Enhanced checks on registration data, and a UK ‘address for service’ requirement, to enhance consumer trust.</li> <li>A right of first refusal for existing .uk registrants.</li> <li>A competitive price point of around £5.50.</li> <li>A commitment to offer services to improve security across the whole .uk namespace.</li> </ul><p>One good thing is the right of first refusal to existing registrants of domain names, though this is common sense and fairness. Frankly, it was bizarre that this wasn't thought of in the first proposal. </p> <h2>Issues not addressed by Nominet</h2> <p>There are a few here, one big one being the need for .uk in the first place.</p> <p>Introducing the new extension virtually forces brands to buy the new domains, as they wouldn't want to risk confusion for searchers, as well as the potential for existing domain extensions to be devalued. </p> <p>So, this essentially doubles the renewal fees for the 3m+ businesses with .co.uk domains, not to mention the costs of changing stationery, marketing materials, customer 'education' and so on. <strong>All for no obvious benefit for business.</strong></p> <p>Also, despite much-trumpeted new security features, the confusion between .uk and .co.uk could well mean <strong>a greater likelihood of phishing attacks working. </strong></p> <p>In a post from Edwin Hayward, he outlines other problems with .uk. These are just a sample:</p> <ul> <li>The current system is effective and well understood.</li> <li>There are no technical reasons to change the current structure.</li> <li>Using .UK and .CO.UK alongside each other for businesses creates confusion.</li> <li>Technical setup costs for running two domains and redirecting emails and traffic.</li> <li>Loss of confidence in .co.uk as .uk takes off.</li> </ul><h2>The benefits for Nominet</h2> <p>The benefits of the new domain extension are unclear at best for businesses, but the extra renewal fees will certainly benefit Nominet. </p> <p>Depending on the uptake, and based on a £5 per year renewal fee, Nominet stands to make more than £25m, and perhaps £40m+ from .uk. </p> <p><img src="http://i.imgur.com/Urc9D0x.png" alt="" width="453" height="392"></p> <p>I said in my last post that<strong> this amounts to a tax on the UK's online businesses,</strong> and the new proposals haven't changed my mind on this. While some issues have been addressed, <strong>the fundamental question of why this is necessary remains. </strong></p> <p>Here's Nominet's explanation: </p> <blockquote> <p>We believe that a new secure product will create a new, trusted online home for British businesses. We hope it will help the internet economy by combating cybercrime and creating a namespace which consumers trust.</p> <p>Since our inception in 1996, we have been asked numerous times about whether registrations at the second level would be possible. Our market research shows businesses demand for effective and convenient tools that would ensure the integrity of their online presence and deliver higher customer confidence.   </p> </blockquote> <p>So we have <strong>security issues which could be addressed without the new domains</strong>, and their own market research which can't always be trusted, especially when the organisation carrying out the research has a vested interest. (Lets face it, if you want a certain answer, you can ask the question in a certain way). </p> <p>Edwin Hayward: </p> <blockquote> <p>The winners from this are Nominet, registrars, and trademark holders, while the losers are existing .co.uk registrants, UK businesses, the credibility of .co.uk namespace, and trust in .co.uk. </p> <p>In fact, a similar proposal was put forward in 2005 (quietly to the Policy Advisory Board, not to the public) and was voted down 11-0. This PAB board was abolished in 2010, and now Nominet 'oversight' is from Nominet Members, who are mainly registrars.  </p> </blockquote> <p>If there are genuine reasons for the new .uk domains, Nominet should state them clearly and, if there is a demand from businesses, let's see the stats. </p> <h2>The consultation continues...</h2> <p>This is not finally decided yet. <strong>The consultation process will continue until 23 September 2013. </strong></p> <p>You can add your views on this using <a href="http://www.nominet.org.uk/how-participate/policy-development/current-policy-discussions-and-consultations/registration-second">this online form</a> (spot the link to the form if you can). It's hardly an example of <a href="http://econsultancy.com/uk/blog/62987-12-useful-tips-for-web-form-optimisation">web form best practice</a>, but it's important to make your views known if you have concerns. </p> tag:econsultancy.com,2008:BlogPost/63018 2013-07-05T13:03:00+01:00 2013-07-05T13:03:00+01:00 This week's finest digital marketing infographic Ben Davis <p>There was much panic amongst site owners and marketers in the run up to the enforcement deadline last year, mainly because people were not told clearly <a href="http://econsultancy.com/blog/9202-eu-cookie-law-three-approaches-to-compliance">what was necessary for compliance</a>.</p> <p>Should they add interruptive pop-ups for new visitors and risk massive bounce rates? Or instead go for an 'implied consent' solution? Or do nothing? In theory the latter two options carried the risk of fines, so the worry was understandable.</p> <p><a href="http://econsultancy.com/uk/blog/9453-econsultancy-s-solution-to-eu-e-privacy-directive-compliance">We opted for an implied consent solution</a> as we believed that our users were savvy enough to know what cookies are, but also deserved some clarity on what we do with their data. </p> <p>There were also dark predictions that the EU Cookie Law would cost UK Plc <a href="http://www.techradar.com/news/world-of-tech/roundup/uk-cookie-law-to-cost-10-billion-1077339">up to £10bn</a>, but thankfully this hasn't come to pass. </p> <p>Indeed, up to the end of 2012, the <a href="http://econsultancy.com/uk/blog/11373-eu-cookie-law-ico-has-received-just-550-complaints">ICO received just 550 complaints about cookies on websites,</a> and they are much more concerned about spam emails and unwanted calls. </p> <h3>Concerns reported about cookies via the ICO website:</h3> <p><img src="http://assets.econsultancy.com/images/0003/5022/Cookie_stats_ICO.gif" alt="" width="517" height="313"></p> <p>Since then,<strong> only a further 87 complaints have reached the ICO, compared to 78,667 about unwanted marketing communications. </strong></p> <p>So, a huge waste of everyone's time and money? </p> <p><img src="http://assets.econsultancy.com/images/0003/5020/cookie_info.png" alt="" width="612" height="2955"></p> tag:econsultancy.com,2008:BlogPost/62653 2013-05-15T10:23:48+01:00 2013-05-15T10:23:48+01:00 Don't be a mobile privacy creep. Eight top tips for marketers Danilo Labovic <h2>1. Take consumer mobile privacy concerns seriously </h2> <p>Security and safety are key concerns for consumers, especially around mobile commerce.  Last year's <a title="Webcredible study" href="http://econsultancy.com/uk/blog/10544-security-screen-size-and-form-filling-still-barriers-for-m-commerce" target="_blank">Webcredible study</a> found that users worry about having their personal details being intercepted or stolen,.</p> <p><a title="research" href="http://econsultancy.com/uk/blog/61971-66-of-smartphone-owners-are-worried-about-privacy-infographic" target="_blank">Research</a> this year revealed that<strong> 43% of users do not trust companies with their personal information</strong> and 91% said that they avoided doing business with companies they don’t believe protect their privacy.</p> <p>That's a big chunk of potential business to lose through being careless with consumer privacy.</p> <p><img src="http://assets.econsultancy.com/images/0003/3344/Mobile_privacy_1.png" alt="" width="414" height="170"></p> <h2>2. Understand the issues </h2> <p>A recent '<a title="Opinion" href="http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2013/wp202_en.pdf" target="_blank">Opinion</a>' from the <a title="Article 29 Data Protection Working Part" href="http://ec.europa.eu/justice/data-protection/index_en.htm" target="_blank">Article 29 Data Protection Working Part</a>y, the umbrella group for national privacy authorities in the EU, highlighted an "alarming disregard" among app developers toward data protection risks, especially around lack of transparency and lack of informed consent.</p> <p>Start with that document to understand what you need to know to take better care of users' personal information.  </p> <h2>3. Build privacy into the plan from the start</h2> <p>Don't wait to be hit by a privacy problem and the need for a retrospective fix, with all the loss of consumer confidence and trust that entails.</p> <p>More than 1,600 new apps are added to app stores daily and the average smartphone user will download 37 apps. If yours is successful then don't risk your investment by failing to consider privacy from the start. </p> <h2>4. Create a data checklist</h2> <p>At an early stage review exactly what personal data you're planning to collect in your app and avoid or limit collecting personally identifiable data that's not required for your app's functionality.</p> <p>It's an easy way to avoid giving your users nasty surprises through unexpected privacy practices.</p> <h2>5. Keep it simple</h2> <p><strong>Only 6% of the top 100 UK websites <a title="surveyed last year" href="http://www.truste.com/uk-privacy-index-2012-websites/" target="_blank">surveyed last year</a> had a mobile optimised privacy policy</strong> while, in <a title="June 2012" href="http://www.futureofprivacy.org/mobile-apps-study/" target="_blank">June 2012</a>, <strong>just 61% of the top 150 apps had a privacy policy at all.</strong></p> <p>Once you've decided on your privacy plan, make it easy for consumers to understand and agree to it, and enable them to make meaningful choices. Make it clear if you're accessing location-specific data and if you'll share that information with third parties.</p> <p>Think about using a short form privacy notice – much easier to read on a mobile device - with a link to the full privacy policy. </p> <h2>6. Be a smart cookie</h2> <p>Don't assume the EU Cookie Directive only applies on desktop websites, <a title="it doesn't" href="http://econsultancy.com/uk/blog/9773-how-will-the-eu-cookie-law-affect-mobile-marketing" target="_blank">it doesn't</a>.</p> <h2>7. Offer opt-outs</h2> <p>Let your users opt-out of targeted mobile advertising if they want to and avoid delivering ads outside the context of the app. </p> <p><img src="http://assets.econsultancy.com/images/0003/3345/Mobile_privacy_2.png" alt="" width="342" height="276"></p> <h2>8. Consider independent mobile privacy certification </h2> <p>With nearly half of consumers checking for independent privacy certification or seals, being able to show that you've undergone rigorous vetting by an independent third party can be a simple way of demonstrating that you take mobile privacy issues seriously.</p>