1. © 2006 IBM Corporation Privacy Matters: Safeguarding Identity, Data and Corporate Reputation Harriet P. Pearson VP Corporate Affairs & Chief Privacy Officer PAGE ONE TeleconferenceAugust 22, 2006

2. © 2006 IBM Corporation 2 The Challenge In a complex and changing world, simple choices—between “privacy” and “no privacy”—are not possible—at least, not usually. We must seek innovative ways of bridging between the human need to trust—to have control, a zone of privacy--and the unlocking of value in information. To do otherwise will (at the least) pose challenges to corporate reputation and freedom of action—individually and collectively

3. PAGE ONE Teleconference August 22, 2006 © 2006 IBM Corporation 3 Key privacy-related developments and trends in 2006  Data risks now evident to all of us: Media, legislative and litigation attention to data breaches, lack of control individuals have  Privacy observation for public purposes: Controversy over government access to data held by private sector (from US to China)  Globalization of business processes challenges EU requirements for data transfers and access by non-EU citizens. Rise of Asia  Transformation of health care (adoption of electronic health records to emergence of information-based medicine) raises new privacy issues (beyond HIPAA)  Concerns over RFID and other new technology sparks advocacy and legislative activity to restrict/regulate

4. PAGE ONE Teleconference August 22, 2006 © 2006 IBM Corporation 4 Privacy Legislation around the Globe European Union European Data Protection Directive (1995) Canada PIPEDA (2001 - 2004) U.S. – Sectoral Health Sector; HIPAA (2002) Financial Sector GLB (2001) Children’s Privacy; COPPA (1999) California Privacy; (2005) Australia Privacy Amendment (Private Sector) Act 2000 (2001) New Zealand Privacy Act (1993) Japan Personal Data Protection Act (April 2005) APEC Guidelines (2004) Existing Private Sector Privacy Laws Emerging Private Sector Privacy Laws APEC Guidelines (2004)

5. PAGE ONE Teleconference August 22, 2006 © 2006 IBM Corporation 5 A Simple Strategy to Protect Corporate Reputation  Understand corporate risks and invest in managing them  Be aware of how changes in business models and practices change risk profile – where are sensitive personal data and how are they managed? Risks to individual identify are now part of corporate privacy and security calculus  Prepare for the inevitable security/privacy incident  Drive adoption and readiness of privacy incident response plan. Don’t let it get out of date. Think global, not just US  Confront incidents/issues quickly—proactively if you can--but be ready for long haul to re-establish trust  Consider case studies such as Eli Lilly, Choicepoint, Veterans’ Administration, Ernst & Young  Communications plays a KEY role  All disciplines play—internal, executive, media, issues management

6. PAGE ONE Teleconference August 22, 2006 © 2006 IBM Corporation 6 A Long History… IBM developed one of the first global privacy policies in businesses--in 1960s Longstanding enagement in public policy, e.g. OECD guidelines development and legislation to protect privacy, e.g. health and e-mail privacy One of the first companies to appoint CPO First company to create Privacy Research institute, focus on privacy-enabling technologies and methodologies. Early supporter and leader of industry privacy and security initiatives, e.g. TRUSTe

7. PAGE ONE Teleconference August 22, 2006 © 2006 IBM Corporation 7 Technology - Reuters and “Big Blue’s ultimatum” : Keep Employees’ SSNs off the Healthcare ID cards… IBM rated among top 10 privacy leaders IBM named in US Top 10 and in Canada #1: Study conducted by Ponemon Institute and nonprofit TRUSTe identifying most trusted companies for privacy “IBM Big Blue set the standard in employee privacy in the 60’s with the first formal corporate policy” Continued Attention to Privacy Recognized… IBM is The Best Privacy Company of the Year 2003 “IBM makes Privacy a Chief Priority” “Study finds IBM top employer for workplace privacy” and

8. PAGE ONE Teleconference August 22, 2006 © 2006 IBM Corporation 8 Questions and Discussion