The DOBlog

Category: Customer Service

  • Bank of Ireland Double Charging – a clarifying post

    Having spent the day trading IMs and talking to journalists about the Bank of Ireland Laser Card double charging kerfuffle, I thought it would be appropriate to write a calmer piece which spells out a bit more clearly my take on this issue, the particular axe I am grinding, and what this all means. I hope I can explain this in terms that can be clearly understood.

    What is LASER?

    For the benefit of people reading this who aren’t living and working in Ireland I’ll very quickly explain what LASER card is.

    LASER is a debit card system which operates in Ireland. It is in operation in over 70,000 businesses in Ireland. It is operated by Laser Card Services Ltd. Laser Card Services is owned by seven of Ireland’s financial services companies (details here) and three of these offer merchant services to Retailers (AIB, Bank of Ireland, and Ulster Bank). In addition to straightforward payment services, LASER allows card holders to get “cashback” from retailers using their card.

    There are currently over 3million Laser Cardholders nationwide, who generated more than €11.5billion in retail sales in 2008. On average, over 300 Laser card transactions are recorded per minute in Ireland.

    How it works (or at least the best stab I can get at it)

    As Jennifer Aniston used to say in that advert… “now for the science bit”. Children and persons of a sensitive disposition should look away now.

    One problem I’ve encountered here is actually finding any description of the actual process that takes your payment request (when you put your card in the reader and enter your pin) , transfers the money from you to the retailer, and then records that transaction on your bank statement.  Of course, there are valid security reasons for that.

    So, I’ve had to resort to making some educated guesses based on my experience in information management and some of the comments in the statement I received from Bank of Ireland back in June. If I have any of this wrong, I trust that someone more expert than me will provide the necessary corrections.

    1. The card holder presents their card to the retailer and puts it in the card reader. The card reader pulls the necessary account identifier information for the card holder for transmission to the LASER processing system (we’ll call this “Laser Central” to avoid future confusion).
    2. The retailer’s POS (point of sale) system passes the total amount of the transaction, including any Cashback amount and details of the date, time, and retailer, to the Laser card terminal.  Alternatively, the Retailer manually inputs the amount on the Laser POS terminal.
    3. This amount and the amount of the transaction is transmitted to the Laser payment processing systems.
    4. ‘Laser Central’ then notifies the cardholder’s bank which places a “hold” on an amount of funds in the customer’s account. This is similar in concept to the “pre-authorisation” that is put on your credit card when you stay in a hotel.
    5. At a later stage, ‘Laser Central’ transmits a reconciliation of transactions which were actually completd to the Laser payment processing sytem. This reconciliation draws down against the “hold” that has been put on funds in the card holder’s account, which results in the transaction appearing on the card holder’s bank statement.

    Point 5 explains why it can sometimes take a few days for transactions to hit your account when you pay with your laser card.

    The Problem

    The problem that has been reported by Bank of Ireland today and which was picked up on by Simon over at Tuppenceworth.ie in May is that customers are being charged twice  for transactions. In effect, the “hold” is being called on the double.

    Back in May, Bank of Ireland explained this as being (variously):

    • A problem caused by a software upgrade
    • A problem caused by retailers not knowing how to use their terminals properly
    • A combination of these two

    The Software Upgrade theory would impact on steps 3,4, and 5 of the “strawman” Laser process I have outlined above. The Retailer error theory would impact on steps 1 and 2 of that process, with potentially a knock on onto step 5 if transactions are not voided correctly when the Retailer makes an error.

    But ultimately, the problem is that people are having twice as much money deducted from their accounts, regardless of how it happens in the course of this process. And as one of the banks that owns and operates Laser Card Services, Bank of Ireland has the ability to influence the governance and control of each step in the process.

    The Risk of Poor Information Quality

    Poor quality information is one of the key problems facing businesses today. A study by The Data Warehousing Institute back in 2002 put the costs to the US economy at over US$600billion. Estimated error rates in databases across all industries and from countries around the world range between 10% and 35%. Certainly, at the dozens of confernces I’ve attended over the years, no-one has ever batted an eyelid when figures like this have been raised. On a few occasions delegates have wondered who the lucky guy was who only had 35% of his data of poor quality.

    The emerging Information Quality Management profession world wide is represented by the International Association for Information & Data Quality (IAIDQ).

    Information Quality is measured on a number of different attributes  (some writers call these Dimensions). The most common attributes include:

    • Completeness (is all the information you need to have in a record there?)
    • Consistency (do the facts stack up against business rules you might apply- for example, do you have “males” with female honorifics? Do you have multiple transactions being registered against one account within seconds of each other or with the same time stamp?)
    • Conformity (again, a check against business rules  – does the data conform to what you would expect. Letters in a field you expect to contain just numbers is a bad thing)
    • Level of duplication ( simply put… how many of these things do you have two or more of? And is that a problem?)
    • Accuracy (how well does your data reflect the real-word entity or transaction that it is supposed to represent?)

    In models developed by researchers at MIT there are many more dimensions, including “believability”.

    In Risk Mangement there are three basic types of control:

    • Reactive (shit, something has gone wrong… fix it fast)
    • Detective (we’re looking out for things that could go wrong so we can fix them before they become a problem that has a significant impact)
    • Preventative (we are checking for things at the point of entry and we are not letting crud through).

    Within any information process there is the risk that the process won’t work the way the designers thought/hoped/planned/prayed (delete as appropriate) it would.  In an ideal world, information would go in one end (for example the fact that you had paid €50 for a pair of shoes in Clarks on O’Connell Street in Dublin on a given day) and would come out the other end either transformed into a new piece of knowledge through the addition of other facts and contexts (Clarks for example might have you on a Loyalty card scheme that tracks the type of shoes you buy) or simply wind up having the desired outcome… €50 taken from your account and €50 given to Clarks for the lovely pair of loafers you are loafing around in. This is what I term the “Happy Path Scenario”.

    However lurking in the wings like Edwardian stage villains is the risk that something may occur which results in a detour off that “Happy Path” on to what I have come to call the “Crappy Path”. The precise nature of this risk can depend on a number of factors. For example, in the Clarks example, they may have priced the shoes incorrectly in their store database resulting in the wrong amount being deducted from your account (if you didn’t spot it at the time). Or, where information is manually rekeyed by retailers, you may find yourself walking out of a shop with those shoes for a fraction of what they should have cost if the store clerk missed a zero when keying in the amount (€50.00 versus €5.00).

    Software upgrades or bugs in the software that moves the bits of facts around the various systems and processes can also conspire to tempt the process from the Happy Path. For example if, in the Laser card process, it was to be found that there was a bug that was simply sending the request for draw down of funds against a “hold” to a bank twice before the process to clear the “hold” was called, then that would explain the double dipping of accounts.

    However, software bugs usually (but not always) occur in response to a particular set of real-world operational circumstances.  Software testing is supposed to bring the software to as close to real-world conditions as possible. At the very least the types of “Happy Path” and “Crappy Path” scenarios that have been identified need to be tested for (but this requires a clear process focus view of how the software should work). Where the test environment doesn’t match the conditions (e.g. types of data) or other attributes (process scenarios) of the “real world” you wind up with a situation akin to what happened to Honda when they entered Formula 1 and spent buckets of cash on a new wind tunnel that didn’t come close to matching actual track conditions.

    This would be loosely akin to giving a child a biscuit and then promising them a second it if they tidied their room, but failing to actually check if the room was tidied before giving the biscuit. You are down two bikkies and the kid’s room still looks like a tip.

    In this case, there is inconsistency of information. The fact of two “draw downs” against the same “hold” is inconsistent. This is a scenario that software checks ont he bank’s side could potentially check for and flag for review before processing them. I am assuming of course that there is some form of reference for the “hold” that is placed on the customer’s account so that the batch processing knows to clear it when appropriate.

    In the case of my horrid analogy, you just need to check within your own thought processes if the posession of two biscuits is consistent with an untidy room. If not, then the second biscuit should be held back. This is a detective control. Checking the room and then trying chasing the kid around the houseto get the biscuit back is a reactive control

    Another potential risk that might arise is that the retailer may have failed to put a transaction through correctly and then failed to clear it correctly before putting through a second transaction for the same amount. This should, I believe, result in two “holds” for the exact same amount being placed on the customer’s account within seconds of each other. One of these holds would be correct and valid and the process should correctly deduct money and clear that hold. However it may be (and please bear in mind that at this point I am speculating based on experience not necessarily an in-depth insight into how Laser processing works) that the second hold is kept active and, in the absence of a correct clearance, it is processed through.

    This is a little more tricky to test for in a reactive or detective controls. It is possible that I liked my shoes so much that I bought a second pair within 20 seconds of the first pair. Not probable, but possible. And with information quality and risk management ultimately you are dealing with probability. Because, as Sherlock Holmes says, when you have eliminated the impossible what remains, no matter how improbable, is the truth.

    Where the retailer is creating “shadow transactions” the ideal control is to have the retailer properly trained to ensure consistent and correct processes are followed at all time. However, if we assume that the idea of a person validly submitting more than one transaction in the same shop for the same amount within a few moments of each other is does not conform with what we’d expect to happen then one can construct a business rule that can be checked by software tools to pick out those types of transaction and prevent them going through to the stage of the process that takes money from the cardholder’s account.

    Quite how these errors are then handled is another issue however. Some of them (very few I would suggest) would be valid transactions. And this again is where there is a balance between possiblity and probability. It is possible that the transaction is valid, but it is more probable that it is an error. The larger the amount of the transaction, the more likely that it would be an error (although I’ve lost track of how many times I’ve bought a Faberge egg on my Laser card only to crave another nanoseconds later).

    Another key area of control of these kinds of risk is, surprisingly, the humble call centre. Far too often organisations look on call centres as being mechanisms to push messages to customers. When a problem might exist, often the best way to assess the level of risk is to monitor what is coming into your call centres. Admittedly it is a reactive control once the problem has hit, but it can be used as a detective control if you monitor for “breaking news”, just as the Twitter community can often swarm around a particular  hashtag.

    The Bank of Ireland situation

    The Bank of Ireland situation is one that suggests to me a failure of Information governance and Information risk management at at least some level.

    1. It seems that Call Centre staff were aware in May of a problem with double dipping of transactions. This wasn’t communicated to customers or the media at the time.
    2. There was some confusion in May about what the cause was. It was attributed variously to a software upgrade or retailers not doing their bit properly.
    3. Whatever the issue was in May, it was broken in the media in September as an issue that was only affecting recent transactions.

    To me, this suggests that there was a problem with the software in May and a decision was taken to roll back that software change.

    • Where was the “detective” control of Software Testing in May?
    • If the software was tested, what “Crappy Path” scenarios were missed from the test pack or test environment that exposed BOI customes (and potentially customers of the other 7 banks who are part of Laser) to this double dipping?
    • If BOI were confident that it was Retailers not following processes, why did they not design effective preventative controls or automated detective controls to find these types of error and automatically correct them before they became front page news?

    Unfortunately, if the Bank’s timeline and version of events are take at face value, the September version of the software didn’t actually fix the bug or implement any form of effective control to prevent customers being overcharged.

    • What is the scenario that exists that eluded Bank of Ireland staff for 4 months?
    • If they have identified all the scenarios… was the software adequately tested and is their test enviroment a close enough model of reality that they get “Ferrari” performance on the track rather than “Honda” performance?

    However, BOI’s response to this issue would seem to suggest an additional level of contributory cause which is probably more far reaching than a failure to test software or properly understand how the Laser systems are used and abused in “the wild” and ensure adequate controls are in place to manage and mitigate risks.

    A very significant piece of information about this entire situation is inconsistent for me. Bank of Ireland has stated that this problem arose over the past weekend and was identified by staff immediately. That sounds like a very robust control framework. However it is inconsistent with the fact that the issue was raised with the Bank in May by at least one customer, who wrote about it in a very popular and prominent Irish blog. At that time I also wrote to the Bank about this issue asking a series of very specific questions (incidentally, they were based on the type of questions I used to ask in my previous job when an issue was brought to our attention in a Compliance context).

    I was asked today if Simon’s case was possibly a once off. My response was to the effect that these are automated processes. If it happens once, one must assume that it has happened more than once.

    In statistical theory there is a forumla called Poisson’s Rule. Simply put, if you select a record at random from a random sample of your data and you find an error in it then you have a 95% probability that there will be other errors. Prudence would suggest that a larger sample be taken and further study be done before dismissing that error as a “once off”, particularly in automated structured processes. I believe that Simon’s case was simply that random selection falling in my lap and into the lap of the bank.

    Ultimately,  I can only feel now that Simon and I were fobbed off with a bland line. Perhaps it was a holding position while the Bank figured out what was going onand did further analysis and sampling of their data to get a handle on the size of the problem. However, if that was the case I would have expected the news reports to day to have talked about an “intermittent issue which has been occurring since May of this year”, not a convenient and fortuitous “recent days”.

    Unfortunately this has the hallmark of a culture which calls on staff to protect the Bank and to deny the existence of a problem until the evidence is categorically staring them in the face. It is precisely this kind of culture which blinkers organisations to the true impact of information quality risks. It is precisely this kind of culture which was apparent from the positions taken by Irish banks (BOI included) in the run up to the Government Bank Guarantee Scheme and which continues to hover in the air as we move to the NAMA bailout.

    Tthis kind of culture is an anathema to transparent and reliable managment of quality and risk.

    Conclusion

    We will probably never know exactly what the real root cause of the Bank of Ireland double dipping fiasco is. The Bank admitted today in the Irish Times that they were not sure what the cause was.

    Given that they don’t know what the cause was and there are differences of record as to when this issue first raised its head between the Bank and its own customers, it is clear that there are still further questions to ask and have answered as to the response of Bank of Ireland to this issue. In my view it has been a clear demonstration of “mushroom management” of risk and information quality.

    Ultimately, I can only hope that other banks involved in Laser learn from BOI’s handling of this issue which, to my mind, has been poor. What is needed is:

    • A clear and transparent definition of the process by which a laser transaction goes from your fingers on the PIN number pad to your bank account. This should not be technical but should be simple, business process based, ideally using only lines and boxes to explain the process in lay-person’s terms.
    • This can then form the basis in Banks and audit functions for defining the “Happy Path” and “Crappy Path” scenarios as well as explaining to all actors involved what the impact of their contribution is to the end result (a customer who can pay their mortgage after having done their shopping for example)
    • Increased transparency and responsiveness on the part of the banks to reports of customer over charging. Other industries (and I think of telecommunication here) have significant statutory penalties where it is shown that there is systemic overcharging of customers. In Telco the fine is up to €5000 per incident and a corporate criminal conviction (and a resulting loss in government tendering opportunities). I would suggest that similar levels of penalties should be levied at the banks so that there is more than an “inconvenience cost” of refunds but an “opportunity cost” of screwing up.
    • A change in culture is needed away towards ensuring the customer is protected from risk rather than the bank. I am perfectly certain that individual managers and staff in the banks in question do their best to protect the customer from risk, but a fundamental change in culture is required to turn those people from heroes in the dark hours to simply good role models of “how we do things here”.

    There is a lot to be learned by all from this incident.

  • Bank of Ireland Double Charging

    I read with interest a story on the Irish Times website this morning about Bank of Ireland double charging customers for Laser transactions in “recent days”. What interested me is that this was not something that happened in “recent days”. Far from it.

    Back in May 2009, Simon over on Tuppenceworth.ie reported this problem to Bank of Ireland and blogged about his customer service experience. On foot of what Simon had written, I emailed Bank of Ireland to try and get details on the issue before I wrote it up over at IQTrainwrecks.com.

    The response I received from Bank of Ireland on the 4th of June was:

    When BoI receives an authorisation request from a retailer, a ‘hold’ is placed on those funds until the actual transaction is presented for payment. The transaction is posted to the customer’s account on receipt from the retailer.

    Relative to the number of transactions processed there are a very small number of instances where a transaction may appear twice. For example these may occur if the retailer inputted the wrong amount and then re-input the correct amount or the transaction is sent in error twice for authorisation. These types of transactions are not errors or a system issue created by the Bank. The Bank receives an authorisation request and subsequently places a hold on those funds. These types of transactions are not unique to Bank of Ireland.

    Bank of Ireland responds to all customer queries raised in connection with above.

    (I have the name and contact details of the Bank of Ireland Press Office person who sent me that response).

    So. Basically the response in June was “those kind of things happen. They happen in all banks. If customers complain to us we sort it out on a case by case basis”.

    These are the questions I submitted to BoI in June. The quote above was the response I received to these detailed questions. (more…)

  • Golden Databases – a slight return

    Last week I shared a cautionary note about companies relying on their under-touched and under-loved Customer databases to help drive their business as we hit the bottom of the recessionary curve. The elevator pitch synopsis… Caveat emptor – the data may not be what you think it is and you risk irritating your customers if they find errors about them in your data.

    Which brings me to Vodafone Ireland and the data they hold about me. I initially thought that the poor quality information they have about me existed only in the database being used to drive their “Mission Red” campaign. For those of you who aren’t aware, “Mission Red” is Vodafone Ireland’s high profile customer intimacy drive wher they are asking customers to vote for their preference of add-on packages. Unfortunately, what I want isn’t listed under their options.

    What I want is for Vodafone Ireland to undo the unrequested gender reassignment they’ve subjected me to. (more…)

  • IQ in the Real World (a leadership return)

    I recently had to spend some time engaging with an Irish Government agency as a result of my voluntary redundancy from my former employer. Now, while I’ll admit I am perhaps over sensitive to information quality issues, having had a lot of experience with them and having written about them a lot over the years, I do find that I am also a magnet for these things.

    So I was not surprised to learn that, according to the Irish government’s computer, my wife was married to me but I was not married to my wife. The Computer Says No.

    While this took only a second for the very nice and personable civil servant to correct, it does beg these questions:

    1. How was one part of the relationship between my wife and I populated but the other wasn’t? (What process failed)?
    2. How was that incomplete relationship not identified (What checks are performed on the quality/completeness/consistency of information in the Irish Civil Service)?
    3. What down stream systems might have been making incorrect decisions based on that broken relationship (what processes might fail)?
    4. How far might that error have propagated?

    For example, if my wife died (heaven forbid) would I have had difficulty in claiming a widower’s pension because while the computer says she is my wife, it doesn’t say that I’m her husband?

    I was surprised to hear the civil servant complain then about the quality of the information and how it made life difficult. I was doubly surprised when he told me he’d been trying to explain to his boss about how if you set up a database correctly it can help prevent errors.

    Unfortunately, he works in the real world, in the Civil Service. Having had experience with civil service type cultures in the past, my fear is that the enthusiasm that that young civil servant showed for finding and fixing errors and trying to understand the root causes of the problems and how to prevent them will be ground down by management attitudes of “that’s above your pay grade”.

    And so we return to the theme of leadership versus management in the context of information quality. To achieve quality you need to foster a culture where even the lowest member of staff can make suggestions for improvement and can be empowered to lead on their implementation or to find out more about how the problem can be solved.  Waiting for inspiration to strike from on high and trickle down often leaves the crud problems backing up in the process pipelines as the 2 minutes to fix becomes 10 minutes, or (even worse) becomes “oh, I’m not paid to do that”.

    Environments which rigidly enforce and demand respect for the “chain of command” often only find their bottom up leaders during a significant crisis. Think “battlefield promotion” in the context of military matters and you have the closest parallel I can think of (at the moment). Until then, they promote on seniority rather than merit (“Hey Bob, you’re still not dead, so here’s a promotion”) and newer staff members who have ideas that are going in the direction of a solution often get tagged as the “squeaky wheel”.

    However, even in those type of environments, it is possible for the squeaky wheel to have some influence on the thinking of management. It just takes time and perseverance and not a small amount of pure unadulterated pig headed self belief to keep on pushing the question. Eventually the squeaky wheel gets a little oil and, with every win, the squeaky wheel helps the business move smoother and has to squeak less.

    To the young civil servant who corrected that small error on a government file….. Well done. Thank you for your focus on the customer, your sense of humour about the issue, your insight into some of the fundamental issues in Information Quality. I doubt you will read this, but if you do, join the IAIDQ where you can learn from other squeak wheels how to get the oil you need. By being part of a community populated by people who’ve been there and done that, you’ll get the support you need to be pig headed about the need to tackle processes, system design and simple governance to ensure the quality of information in key functions of your organisation.

    Quality is not job one. Meeting or exceeding the expectations of your customers is job one.  Or to put it another way…

    Quality is not Job One (from http://gapingvoid.com)
    Quality is not Job One (from http://gapingvoid.com)

  • #BGas- Bord Gais loses 75000 customer records

    The Bord Gais story

    First off, I am a Bord Gais (Irish Gas Board, now an electricity supplier) customer. I switched to them earlier this year to save money. I provided personal details about myself and my wife along with details of the bank  account our bills get paid out of. So, my wife and I are almost certainly included in the 75000 people who have recently heard about how four laptops were stolen from the Bord Gais HQ two weeks ago, one of which had our personal data on it in an unencrypted form.

    Oh… we are assured it was password protected. Forgive me if I don’t feel the love about that assurance. Passwords were made to be broken, and in my experience they are often not very strong. (“P@ssword”).

    Everything reported in the media thus far suggests to me that this incident stems from yet another chronic failure to recognise the value of the “Information Asset” and treat it with the care and respect that it deserves.

    What do we know?

    • The laptops were stolen in a burglary.

    Unless the burglars had ample time to wander around the headquarters of a blue chip company rifling presses looking for laptops, it would seem to me that the laptops were left on desks unsecured.  A basic practice for the physical security of laptops is to either lock them  away or take them home with you and secure them there. Leaving them sitting on your desk invites larceny.

    • This laptop ‘fell through the cracks’ for installing encryption software

    OK. Mistakes can happen. However a simple check for the existence of encryption software is an obvious preventative control that could have prevented the unencrypted laptop from being put out into use.  Of course, just because there is encryption software on a laptop doesn’t mean that the user will actually encrypt their files in all cases.

    Reliance on policy and technology without ensuring control, culture and people changes are implemented as well (such as changing work practices or giving the lowest techie the right to tell the CEO to bugger off if he wants his laptop before it is encrypted) invites a false and unwarranted sense of security.

    Also, I am aware of one large company which has rolled out encryption on laptops, but only to senior management and primarily to protect documents relating to management strategy. The fact that the proletariat knowledge worker with a laptop can have spreadsheets a-plenty chock full  of personal data doesn’t seem to have registered. They are protecting the wrong asset.

    • The file was password protected

    OK. Two points here… is it the file or the operating system? How secure is the password? If the password is on the file might the password be stored in a text file on the laptop, or in an email, or on a post-it note stuck to the lid?

    Even if the spreadsheet (and inevitably it will be a spreadsheet) is password protected, there are a number of free utilitites for recovering passwords on Microsoft office documents. It took me all of 15 seconds to find some on Google.

    MS Access is a little trickier, but where there is a will (and a basic knowledge of Access) there is a way.

    When it comes to securing personal data, passwords should be seen as the last (and weakest) line of defence.  Passwords, like promises, are all to easy to break.

    • The break in happened 2 weeks ago

    So, what we know from the media is that the thieves (or the people who eventually wound up with the laptops) have had 2 weeks to do the google searches I’ve done to find the tools necessaray to crack a password on a file.

    they’ve had two weeks to go to market with their asset to see what price they can get. They’ve had two weeks to start applying for loans or credit cards.

    What I know from the media now is that Bord Gais is more concerned with the Regulator and the Data Protection Commissioner than they are with their customers.

    What I don’t yet know from the media

    • What the fricking hell was my data doing on a laptop?

    OK,  so I’ll accept that there can be reasons for data to be taken onto laptops or local PCs from time to time (migrations, data profiling, reporting, remediation of compliance issues etc.).

    But ALL the records and ALL the fields in those records? That’s just ridiculous.

    And was that purpose consistent with the purposes for which I provided the data in the first place?

    Having ALL the eggs in one unsecured basket invites loss and security breaches.

    • Was the laptop securely stored or locked in any physical way?

    I have to assume no on this one, but who knows… the theives may just have been very lucky that the first four presses they broke open happened to have laptops in them.

    No amount of software security or business practice will prevent a theft if the actual physical security of the asset is not assured. The asset in this case isn’t the laptop (value no more than €600),  but the data is worht a whole lot more.

    75,0000 records at around €2.00 a record is an easy€150,000.

    • Will Bord Gais compensate customers who suffer loss or damage through their negligence?

    OOOh. Negligence is a strong word. But leaving unencrypted, unsecured data (yes it is password protected but that’s not much comfort) lying around is negligent. If I suffer loss or injury (such as being liable for a debt I didn’t incur or having my credit rating trashed, or having my identity stolen) will Bord Gais compensate me (without me having to sue them first)? (more…)

  • The Customer perspective on Information Quality

    A short post today. I promise.

    Yesterday’s Dilbert made me laugh. As a telco guy I’m familiar with the lengths my industry will go to to create complicated contracts that can ‘obscure’ the total cost of a phone package. It was nice to see that getting a character all to itself in Dilbert.

    But what made me laugh most of all was the number of root causes of Information Quality problems which are mentioned in just two boxes of this strip:

    Dilbert.com
    Dilbert (c) Scott Adams, 19th April 2009
    1. Unlabelled strings of code – this is DATA, not INFORMATION because it lacks CONTEXT to make it ACTIONABLE
    2. Web forms or applications not designed to make sense with the information requested (fields too short for the code).
    3. Letters looking like numbers (and vice versa).

    If your customer can’t complete a rebate process due to any of the above issues (or similar), then your information quality focus is wrong (or non-existent) and your customers will go elsewhere eventually.

    Wooing price sensitive customers (and aren’t we all these days?) with rebates or discounts but then having processes which fail to successfully operate due to poor quality planning for quality information and quality outcomes means that any competitor who comes close to you on price but can make the customer experience easier and more transparent is likely to win business from you.

    Begin with the end in mind. Isn’t the end you want a happy customer who will buy again from your company (and maybe refer their friends to you)?

  • Data Protection Awareness

    This post has been triggered by two things.

    Firstly, I had a nice chat with Hugh Jones who is running the ICS’s Data Protection training (see www.ics.ie/dp) for details. Hugh is interested in raising awareness of data protection issues both for businesses and for individuals. I wholeheartedly agree with him that this is important, not least because Data Protection has a strong Information Quality component.

    Secondly, just yesterday I saw two very clear examples of poor data protection practices. And that is not counting the dozen or so CCTV cameras I saw in the Dundrum Town Centre without any notification signage alerting me to the cameras or who to contact to get a copy of my personal image. Both of the incidents I saw related to sign up sheets for various things which were left in public places.
    The first Data Protection heeby-jeeby
    The least worrying one was in Wexford, where the sign up sheet for a contact list for a community group was left lying on a table that was unattended (although staff were standing near by). The information being captured was names, email addresses, mobile phone numbers and postal addresses. Each of those records would be worth approximately €100 to the right people. At 20 lines per sheet, each sheet would be worth €2000.

    That pays my mortgage for 2 months.

    Ideally, the voluntary organisation in question should have put someone sitting on a chair beside the clip pad to keep an eye on one of the most valuable things in the room.

    The second Data Protection Heeby-Jeeby (and this one scared the bejesus out of me)

    A car dealership has a display model parked up in the hallways of a large shopping mall in Arklow. On the table beside the car they have a sign up sheet (ho hum) inviting you to leave your personal details in order to be entered into a raffle.
    The first problem here is that this is very obviously a way for them to collect sales leads, contact details for people who they can phone or write to to offer test drives and such like. However the sign up form doesn’t say that. There is no information about what the information is being captured for, what uses it may be put to, or who to contact if you have a query about the information. So, it is not being captured fairly for a specified use – that’s the first Data Protection breach.

    More worrying is that the table (and the sheets and box full of personal data) were left unattended when I walked past yesterday afternoon. Personal data for about a dozen people was clearly visible on the table, unsecured, unprotected. I took a photograph with my phone. I had considered uploading it to this blog post, but there is some personal information clearly visible. So I won’t. But I have 19 rows of personal data, including at least 1 mobile phone number in an image on my (secure to a point of paranoia) archive drive at home.

    Unfortunately, I suspect that someone else took something more as the sheet was gone a few minutes later. 19 rows of data at €100 a pop… not bad for 3 seconds work. The sheet may have fallen on the floor. However, even in that case the data was no longer in the control of the Data Controller.

    So, to the car dealership that put that blue Hyundai I20 in the Bridgewater Shopping Centre in Arklow: you REALLY REALLY should consider sending a few of your staff to the Data Protection Lunch & Learn session or to the 1 day or 3 day Data Protection courses run by the ICS. Currently your entire marketing set up in the Bridgewater Shopping Centre is in breach of the Data Protection Act.

    Conclusion
    I would advise everyone to make themselves aware of the provisions of the Data Protection Act and to evaluate every time someone asks you for personal information. Don’t give your information to anyone who isn’t capturing it fairly, processing it fairly or treating it as a valuable asset. If they leaving it lying around in a public place unattended and unsecured… think twice.

    If you are a person or organisation capturing personal information about people, then you should put some time and effort into planning how you will capture the information, secure it, prevent it being photographed, swiped or mislaid, and ultimately put it to use. You should avoid the temptation to promote your data capture as something that it is not… yes, offer a raffle prize but let people know if you are planning to use the data to drive a marketing campaign.

  • The 12 Days of Blogger Christmas

    This is inspired by a post over on the Crabbling Otter (greetings and felicitations Mr Byrne).

    He got the flyer below in to work. Commenters over at the ‘Otter have found upwards of 12 errors. So, for the next few days I’ll be running “The 12 Days of Blogger Christmas”. What I’d like commenters to do here is to suggest the festive (and appropriate) gift that would be sent to Christmastreesdirect.eu in this season of giving.

    So, I’ll start the ball rolling….

    “On the First day of Christmas, the Bloggers gave to me….

    A brand new spell checking dictionary”….

    duff flyer frontduff flyer back

  • Bogger Broadband

    Regular visitors to this blog will know about my trials and tribulations getting a half way decent broadband service that works.

    After a tormented experience dealing with a useless local service provider who admit to owing me money but haven’t gotten around to sending me the cheque (but in fairness, I haven’t gotten around to sending in ComReg either) I’ve been using Vodafone’s 3g broadband which I find to be a lot like the little girl with the curl in her forehead… when it is good, it is very very good, but when it is bad it makes me want to throw my laptop at a wall.

    Good news reaches me though from a contact in the telecoms industry. The diggers i saw digging and new cabinet I saw being cabineted on the side of the road in Castlebridge recently is evidence of an exchange upgrade which will enable broadband over copper. Yippee… actual technology I can touch!

    Forecast dates are November this year, over a year late (the original date was September 2008). So I’ll expect it around May 2009.

    And to my former broadband provider (who I still haven’t named publicly)… I will be passing your details along to ComReg (again).

  • How not to handle a customer (part 2)…

    This post is an update to the previous post today…
    I definitely think I’ll have to consider the Data Protection request as one of the top dogs in this company I’ve been dealing with has just emailed me to say that they only had an email address for me from today. Despite the fact that

    1. When I signed up for their service I had to give an email address
    2. I included an email address in my letter of complaint
    3. One of their Customer Service people had emailed me to the email address I had given on my complaint letter not 4 weeks ago

    Basically this senior person, sent me an email (and I won’t do a ‘Mulley’ on it and publish the email.. YET) which basically reads like “it’s your fault we couldn’t contact you because you didn’t answer your phone”, despite the fact that I have no voicemails (no answer, pissed customer, leave a voicemail to say you tried to contact them… common sense) or missed calls in my missed call log from this company in the past month.

    Not a whiff of mea culpa about it at all… Which is just plain stupid from a Customer Service perspective.

    Years ago I started my career in a call centre. We had an excellent external training consultant for a team leader course I did. He gave one piece of advice (and only one) about dealing with customer complaints… the customer may not always be right, but it’s suicide to try to make them feel they are wrong. I’ve tried to follow that mantra when dealing with customers in my day job (internal customers, project stakeholders, information consumers, managers, co-workers).

    Apparently making people feel they are wrong just gets them peeved and then they go and write blog posts about their experiences that might get linked to your company.

    And as for the Data Protection implication… they captured information about me and either had no use for it or have failed to ensure it is stored safely and securely as per their obligations as data controllers. Even if it is on paper in a filing cabinet it is governed by the Data Protection Act.

    Read the original post to put this in more context…