As we write this, we are weeks away from hosting our inaugural event: the K(NO)W Identity Conference in Washington D.C. We aren’t event planners, marketing gurus or even avid conference-goers. We are professionals who spend our time building identity-management and verification solutions for companies like Google, Deloitte and Citibank.

When we set sail on our journey last year to host a large conference, we thought we knew what was in store for us, but we had no idea. With help from our ConferenceDirect partners, and many late night coffees, we’ve been able to find our north star and chart a path to success. One area that’s been eye-opening for us as experts in identity verification systems, is how vulnerable attendee registration data can be. We’ve compiled a list of seven recommendations to keep to attendees safe from potential identity theft and other issues.

1. Recognize that personal data is an asset and liability. Data on participants can bell you the demographics of your audience, show around which speakers and topics were most attended, and much more. We can use this data to contact attendees to offer special offers, provide details surrounding the event, and ensure sponsors are reaching their target audiences.

However, collecting and using attendee personal data also carries a liability. The last thing you want is for your participants’ personal data to be breached. In fact, if you operate in Europe, personal data breaches can lead to fines of up to 4 percent of global operating revenue! These penalties do not include the reputational damage and subsequent potential lawsuits.

2. Ask: Do we need all of that data about attendees? When we set up our registration flow, we were shocked at the “suggested” set of questions to ask our participants, such as date of birth and social security number. Collecting more information than you actually need actually puts your event and your attendees at risk.

It may be tempting to collect as many fields as possible and then have the data available “just in case,” not only could you be creating a bad experience for registrants but you may also be exposing yourself to the liability of the data. Not sure which data fields you should collect? Start by drafting key performance indicators and then marry those with relevant data fields. For example, if you want to attract 50 C-suite level executives, then ask for “Current Role.”

3. Have a plan for how you are going to use the information you collected.
Once you’ve set up the registration flow to capture the information you truly need, it is time to determine how you will use that data. For example, we capture “Job Title” during sign-up and use it to understand the demographics of our attendees. By understanding our attendee demographics, we can enhance our marketing strategy accordingly.

If you are using session or space tracking, ensure that you have a plan ahead of time for how the data will get shared and for what purposes. Do this even internally, for example, asking whether marketing and sales need the same data. Already collected this data but don’t need it? Delete it. Having dormant files with attendee information, which in some cases may contain Personal Identifiable Information, is a disaster waiting to happen.

4. Ask your vendors. When you are choosing suppliers, be it for a mobile app, registration or anything else, ask them what their security practices are, specifically how do they treat your data? Don’t panic if they can’t immediately answer the question, but they should have someone around who can get back to you quickly. By asking, not only will you understand the product’s security risks (i.e., how easy/hard it is for someone to get ahold of your customer data), but you are also letting the vendor know that information security is important to you. If your vendors don’t think information security is a concern, we recommend looking elsewhere.

5. Be wary of the “export” button. Many registration systems make it very easy to export attendee data into one spreadsheet on your computer. You may think that’s convenient, but, as noted above, anytime you are collecting or saving customer information to your computer, you are increasing the risk of your data falling into the wrong hands.

6. Use dummy data for tests. Need to generate some sample badges, test a new registration flow, try out that shiny new app? It is tempting to send over the first few rows of your real attendee data. We recommend you create a few fake profiles in a new data set for testing. By doing so, you are reducing the risk of accidental data leakage.

7. Beware QR codes. QR codes are convenient to scan, but they’re just as convenient for potential fraudsters to decode. If you’re encoding any personal attendee data, be aware that the QR code image can easily be read by anyone using a smart phone. — Travis Jarae, CEO, and Dasha Cherepennikova, executive director, One World Identity

Editor’s Note: ConferenceDirect Global Project Manager Nancy Fisher made initial contact with One World Identity, and since then she and ConferenceDirect Global Account Executive Kim Struble are partnering to make the company’s inaugural K(NO)W Identity Conference a success. The K(NO)W Conference will be held May 15-17 at the Ronald Regan Building and International Trade Center.