I participate in an electronic community (aka online community, social network) that is aimed at business professionals. It is very likely that you or one or more of your employees are one of the more than 18 million people who are part of this one community or one of many more like it. During the last couple of weeks I noticed and answers are clearly inappropriate. Some members of the community argue that being professional excludes having fun, and all they are trying to do is liven up the community by having fun. What it really comes down to is appropriate vs. inappropriate -- not fun vs. boring agony.

 In a business forum I recently asked the question, "does your business have a privacy officer?"  A young attorney quipped, "hire an attorney, they'll tell you if you need one?"  According to best privacy practices; a National Academy of Sciences report, numerous other compliance bibles; and a multitude of federal and many state laws, all enterprises should have a privacy advocate, typically called a chief privacy officer (CPO) no matter whether your business comprises one or tens of thousands of associates.

Education on identity theft and privacy is not discretionary; it is required as part of a defensible best practices program and mandated by federal and state laws.

The consequences for a privacy or information security breach can be devastating to enterprises in terms of hard and soft costs. I have been told more than once by leaders of both large and small enterprises that they purchased a paper shredder and that performing privacy and information security risk assessment is no longer necessary. Really?