Privacy and the Tourism Sector

PRIVACYBULLETIN

Privacy = and the Tourism Industry

David T.S. Fraser[1]

&nb= sp; Since January 1, 2004, every organization in Atlantic Canada that col= lects, uses or discloses personal information in the course of commercial activiti= es has been subject to a new and far-reaching federal privacy law. This includes businesses that oper= ate in the tourism and hospitality sectors. Because the law reaches into the relationship between tourism operat= ors and their customers, it potentially has a profound effect on the organization’s ability to attract and retain those customers.

&nb= sp; The Personal Information Protection and Electronic Documents Act (or “PIPEDA”, as it is often calle= d) came into force for the “federally regulated private sector” on= January 1, 2001. Between 2001 and 2004, provinces w= ere given the opportunity to enact legislation that was considered to be “substantially similar”. None of the provinces of Atlantic Canada did so and, therefore, the = ten principles of PIPEDA and their myriad exceptions began to apply to most businesses in Atlantic Canada as of 2004.

&nb= sp; PIPEDA is based on ten principles drawn from the Canadian Standards Association Mo= del Code for the Protection of Personal Information. In fact, the CSA Model Code is Sch= edule 1 of PIPEDA. The Code has very significant requirements for businesses in the tourism and hospitality sector. To begin with, every affected organization must designate an individual who will be accountable = for the organization’s compliance with the ten principles. This individual is commonly design= ated a Privacy Officer or Chief Privacy Officer.&= nbsp; The organization is required to document all the purposes for which = it collects personal information and to make reasonable efforts to communicate those purposes to customers at or before the time personal information is collected. The law defines pe= rsonal information very broadly to include any information about an identifiable individual, such as name, address, phone number, customer preferences and buying habits. This communica= tion of purposes then forms the basis for mandatory informed consent: “The knowledge and consent o= f an individual are required for the collection, use or disclosure of personal information”. Every organization is also required to have a privacy policy and to make informat= ion about its personal information handling practices available to any individu= al upon request. The organizatio= n is required by law to put in place safeguards to protect the personal informat= ion in their custody. These safeg= uards must be commensurate with the sensitivity of the information. The organization must also provide access to personal information at minimal or no cost. The final principle requires every organization to adopt policies and procedures to deal with inquiries and complaints.

&nb= sp; PIPEDA is complaint-driven legislation, meaning that there are not privacy police poised to pounce on delinquent companies.&= nbsp; Rather, any individual (including an employee or competitor) has standing to bring a complaint to the Office of the Privacy Commissioner abo= ut that organization’s personal information handling practices. The Privacy Commissioner, upon rec= eiving a complaint, is obliged to investigate.&nb= sp; In the course of the investigation, the Commissioner has extremely b= road powers, including powers to compel the production of documents, take testim= ony and evidence under oath and to enter any premises, other than a dwelling, without a warrant. The investigation report, referred to as a “Finding”, is provided to the complainant and the organization complained about. The Finding lists the factual conclusions of the investigation and states whether the complaint is well founded. If the organization = is found to be non-compliant, the findings will contain the Commissioner’= ;s recommendations to fix their practices. The Commissioner does not have the power to order compliance, but both the Commissioner and the individual complainant are able to refer the matter to= the Federal Court of Canada for a hearing.&nbs= p; After a hearing, the Federal Court has the power to order an organiz= ation to change its practices to comply with the law and the Court is also able to award damages to the complainant, including damages for any humiliation he = or she might has suffered. =

&nb= sp; While the cost and inconvenience of dealing with an investigation by the Commissioner, a court hearing and an award of damages would be significant,= perhaps the greatest consequence for an organization is irreparable damage to the organization’s reputation. Tourists looking for accommodation and facilities have virtually lim= itless choices in Atlantic Canada and today’s privacy conscious consumers are most likely to choose a service provider who will respect their privacy. There is a possibility for signifi= cant adverse publicity at the time a complaint is made and the Commissioner is a= ble to make her opinions on an organization’s personal information handli= ng practices public, even before a court has had an opportunity to review the merits of a particular complaint. As soon as any documents related to a court hearing are filed, they become public record and are often the subject of media attention. Today’s consumers are holding their service providers to a very high standard, and it is incumbent upon Atlantic Canada’s hospitality industry to live up to those standards.= As importantly, these standards ar= e now the law.

&nb= sp; National Privacy Services Inc. has designed a Commonsense Privacy Solution for the tourism sector, which provides hospitality operators with all the tools necessary to implement new, mandatory privacy best practices. The Commonsense Privacy Solution includes a multimedia training CD, educational materials about the new priv= acy legislation, model policies, procedures and communication tools for use specifically in the hospitality industry.&= nbsp; National Privacy Services Inc.’s trained and experienced professionals can act as your organization’s designated privacy offic= er, freeing up your organization’s precious resources to focus on busines= s, not regulatory compliance.