PRIVACYBULLETIN

Privacy and
the Tourism Industry

David T.S. Fraser[1]

Since
January 1, 2004, every organization in Atlantic Canada that collects,
uses or discloses personal information in the course of commercial activities
has been subject to a new and far-reaching federal privacy law.  This includes businesses that operate in
the tourism and hospitality sectors.
Because the law reaches into the relationship between tourism operators
and their customers, it potentially has a profound effect on the
organization’s ability to attract and retain those customers.

The
Personal Information Protection and
Electronic Documents Act (or “PIPEDA”, as it is often called)
came into force for the “federally regulated private sector” on January
1, 2001.  Between 2001 and 2004, provinces were
given the opportunity to enact legislation that was considered to be
“substantially similar”.
None of the provinces of Atlantic Canada did so and, therefore, the ten
principles of PIPEDA and their myriad exceptions began to apply to most
businesses in Atlantic Canada as of 2004.

PIPEDA
is based on ten principles drawn from the Canadian Standards Association Model
Code for the Protection of Personal Information.  In fact, the CSA Model Code is Schedule
1 of PIPEDA.  The Code has very
significant requirements for businesses in the tourism and hospitality
sector.  To begin with, every
affected organization must designate an individual who will be accountable for
the organization’s compliance with the ten principles.  This individual is commonly designated a
Privacy Officer or Chief Privacy Officer.
The organization is required to document all the purposes for which it
collects personal information and to make reasonable efforts to communicate
those purposes to customers at or before the time personal information is
collected.  The law defines personal
information very broadly to include any information about an identifiable
individual, such as name, address, phone number, customer preferences and
buying habits.  This communication
of purposes then forms the basis for mandatory informed consent:  “The knowledge and consent of an
individual are required for the collection, use or disclosure of personal
information”.  Every
organization is also required to have a privacy policy and to make information
about its personal information handling practices available to any individual
upon request.  The organization is
required by law to put in place safeguards to protect the personal information
in their custody.  These safeguards
must be commensurate with the sensitivity of the information.  The organization must also provide
access to personal information at minimal or no cost.  The final principle requires every
organization to adopt policies and procedures to deal with inquiries and
complaints.

PIPEDA
is complaint-driven legislation, meaning that there are not privacy police
poised to pounce on delinquent companies.
Rather, any individual (including an employee or competitor) has
standing to bring a complaint to the Office of the Privacy Commissioner about that
organization’s personal information handling practices.  The Privacy Commissioner, upon receiving
a complaint, is obliged to investigate.
In the course of the investigation, the Commissioner has extremely broad
powers, including powers to compel the production of documents, take testimony
and evidence under oath and to enter any premises, other than a dwelling,
without a warrant.  The
investigation report, referred to as a “Finding”, is provided to
the complainant and the organization complained about.  The Finding lists the factual
conclusions of the investigation and states whether the complaint is well
founded.  If the organization is
found to be non-compliant, the findings will contain the Commissioner’s recommendations
to fix their practices.  The
Commissioner does not have the power to order compliance, but both the
Commissioner and the individual complainant are able to refer the matter to the
Federal Court of Canada for a hearing.
After a hearing, the Federal Court has the power to order an organization
to change its practices to comply with the law and the Court is also able to
award damages to the complainant, including damages for any humiliation he or
she might has suffered.

While
the cost and inconvenience of dealing with an investigation by the
Commissioner, a court hearing and an award of damages would be significant, perhaps
the greatest consequence for an organization is irreparable damage to the
organization’s reputation.
Tourists looking for accommodation and facilities have virtually limitless
choices in Atlantic Canada and today’s privacy conscious consumers are
most likely to choose a service provider who will respect their privacy.  There is a possibility for significant
adverse publicity at the time a complaint is made and the Commissioner is able
to make her opinions on an organization’s personal information handling
practices public, even before a court has had an opportunity to review the
merits of a particular complaint.
As soon as any documents related to a court hearing are filed, they
become public record and are often the subject of media attention.  Today’s consumers are holding
their service providers to a very high standard, and it is incumbent upon
Atlantic Canada’s hospitality industry to live up to those standards.  As importantly, these standards are now
the law.

National
Privacy Services Inc. has designed a Commonsense Privacy Solution for the
tourism sector, which provides hospitality operators with all the tools
necessary to implement new, mandatory privacy best practices.  The Commonsense Privacy Solution
includes a multimedia training CD, educational materials about the new privacy
legislation, model policies, procedures and communication tools for use
specifically in the hospitality industry.
National Privacy Services Inc.’s trained and experienced
professionals can act as your organization’s designated privacy officer,
freeing up your organization’s precious resources to focus on business,
not regulatory compliance.

[1] The author is general counsel to National Privacy Services Inc, the
Chair of the Privacy Law Group at McInnes Cooper and a part-time member of the
Faculty of Law at Dalhousie University.