Privacy concerns haunt Sony

Only a month after hackers broke into Sony’s PlayStation network and stole the personal information of more than 100 million users, the company has been attacked again.

This time the hackers targeted the Canadian website of Sony Ericsson, a mobile phone joint-venture between Sony and Sweden’s Ericsson. Sony said the personal information of about 2,000 users of its online shopping site was obtained but assured customers that credit card information wasn’t hacked – only names, email addresses and encrypted passwords.

The Canadian attack came within hours of attacks on Sony websites in Greece, Thailand and Indonesia and is another smudge on the reputation of a company that was already struggling with privacy concerns.

No one has claimed direct responsibility for the attacks, but the hacker group Anonymous – the same group that attacked Visa and Mastercard’s sites over the companies’ opposition to Wikileaks – has been raised as a possible culprit. Anonymous said it would retaliate after Sony sued a customer for posting information on how to modify the PlayStation game console online.

But Anonymous said it has never stolen credit card information and called Sony “incompetent.”

The company has warned investors that last month’s attack will cost it approximately 14 billion yen ($167 million). This will further hurt a company that expects to post a 260 billion-yen ($3.1 billion) loss in the fiscal year ended March 31 due to a one-time tax charge and the ongoing disruptions caused by the earthquake in Japan.

So what lessons can be learned from Sony’s struggles? Ann Cavoukian, Ontario’s Information and Privacy Commissioner, advocates what she calls “privacy by design,” or embedding privacy into all technologies, business practices and infrastructure.

“Embed privacy proactively. Don’t wait for an after-the-breach solution. Don’t wait for privacy by disaster. Do it beforehand by design,” Cavoukian tells BNN.

She added that companies like Sony should automatically encrypt all customer data so that hackers won’t be able to access it even if they do manage to break into a website or network.

And if a company experiences a data breach, governments should consider levying big, punitive fines – an argument that has also been made by Federal Privacy Commissioner Jennifer Stoddart.

But as technology – and hackers – become increasingly sophisticated, will the threat of government fines be enough to protect Canadians’ privacy? Or will companies like Sony have to learn the hard way how to win consumers’ trust?