Like I said earlier, I think self-regulation would be ideal. However, this has very wide implications in the whole "trade/occupation" vs. "profession" debate. At the moment IT services, particularly at the SOHO end of the market are perceived to be a trade/occupation. I would contend that we don't even meet the minimum criteria applicable to a trade (never mind a profession). For instance, electricians here in Ireland serve a 4 year apprenticeship, 3 on the job and 1 in college. In order for an electrician to trade independently he must be a member of one of two publicly recognised standards bodies. He must hold a certificate of competency from one of these bodies and he must renew it yearly. He has to comply with continuing education standards in order to renew. The criteria for a profession such as accountancy or medicine are even more onerous. A different example is mechanics. Anyone in Ireland can call themselves a mechanic however there is a self-regulation organisation for mechanics and most are members. They subscribe to a code of practice, are represented nationally when the interests of mechanics in general are at stake. The guys outside of the organisation find difficulty getting insurance, B2B work etc. and they are a dying breed. No loss coz most are cowboys anyway.
With any occupation it will either eventually regulate itself or it will be regulated for. Which would you choose?
With regard to what a client has the right to expect;
We had a case here a few years ago of a dentist who was molesting his female patients while they were under general anaesthetic. Did those women have a right to expect that no such thing would happen? Private data and private parts are in principle the same thing and a (supposedly professional) third party going where they no right to be is inexcusable regardless of the naivete of the client.
When the whole child pr0n thing on the internet was at it's height I was asked by a local newspaper what I would do if I found such on a clients computer. I said it would never be an issue for me because I never looked at clients private data. The only way I'd ever see it is if they were using it as wallpaper and if I saw that I'd hand it straight over to the cops. Thankfully, I've never had to.
My advice, formulate a written privacy policy. Put a copy on your website, give it to your clients and make it a condition of employment. If you find an employee breaking it fire them. You can be damn sure that YOUR private data isn't safe with them either...
I don't go snooping around in customers systems anymore than I need to, but in the process of backing up data I have seen more than my share of porn, tax papers, personal photos, and other things.
Exactly how much do you need to? I know you can't avoid seeing file names, I know you usually can't avoid seeing thumbnails but why would you ever need to open any particular file, especially if it's obviously private? If you need to check the functionality of Word for instance, then create a test document. Some examples of what I'm missing here would be useful.
