Case Study: The ‘My SHC Community’ Privacy Disaster
In this assignment students are required to read the case study below, conduct research to support discussion, use examples, address the following case study questions and find solutions to problems.
1. Summarize the case study objectives.
2. Identify and discuss the problem described in the case study.
3. What plan did Sears Holdings implement to gain more insight into customer’s online shopping behaviour
4. Why was the plan considered by a Harvard Law Professor and the FTC to be unethical and unlawful?
5. If Sears Holdings had implemented its plan in accordance with FTC guidelines, do you think any customers would have been willing to sacrifice their privacy for $10?
6. What other methods might Sears Holdings and other companies consider implementing to gather information about customers’ online habits and interests?
The ‘My SHC Community’ Privacy Disaster
Sears Holdings Corporation is the third largest retailer in the U.S., owning both Sears Roebuck and Kmart. Like all retailers, Sears is heavily invested in marketing research. Discovering customers’ interests and purchasing habits is essential to successful marketing and sales campaigns. Gathering data on customer interests can be difficult. The Internet helps considerably by allowing businesses to analyse the actions of visitors on their sites. Though helpful, Web analytics provide only a small glimpse into the online activities of customers; businesses cannot see what users do elsewhere on the Web. Some businesses have tried, typically with disastrous effects, to track users around the Web. For example, online advertiser DoubleClick was charged with violations of privacy laws when it placed ads on many Web sites to track users’ movements around the Web. More recently, Facebook has been scrutinized for its Open Graph technology that allows it and its partners to track users’ movements around the Web. Sears Holdings Corporation (SHC) took its stab at tracking customers’ online activities through a program it called My SHC Community. Customers of Sears and Kmart were encouraged to “become part of something new, something different.” My SHC was framed as a “dynamic and highly interactive online community” where “your voice is heard and your opinion matters, and what you want and need counts!” Members were asked to install “research software” on their computers that would allow SHC to track their online browsing. To further entice customers to participate, SHC paid them $10 each. After operating for several months, technology analysts discovered that the SHC “research” software collected a lot more information than users were aware of. It not only tracked URLs of Web pages visited, but also information typed into secure online forms. Such information included user names and passwords, credit card numbers, online shopping cart contents, essentially everything the user typed and every page the user visited. When Harvard Business School Assistant Professor Ben Edelman learned of the situation, he accused SHC of distributing spyware. Shortly thereafter, the Federal Trade Commission (FTC) took up the case. The FTC found that Sears Holdings did not sufficiently notify its customers about what information was being gathered by the software. The only notice of what the software actually did was buried on page 10 of the software license that users may have glanced at before installing the software. The FTC ordered Sears Holdings to discontinue distribution of the software, destroy all data gained from the experiment, and to stop collecting data from copies of the software still running on customer computers. Additionally, should Sears Holdings decide to attempt a similar experiment in the future, it must “clearly and prominently disclose the types of data the software will monitor, record, or transmit. This disclosure must be made prior to installation and separate from any user license agreement. Sears must also disclose whether any of the data will be used by a third party.” Sears Holdings has stated that while the software did collect sensitive user information, the company made “commercially viable efforts automatically to filter out confidential personally identifiable information such as user ID, password, credit card numbers, and account numbers, and made commercially viable efforts to purge our database of any such information if it was collected inadvertently.”
