4.1 Privacy Issues

Data and the Law

Recent changes to Canadian Criminal Code require business handling personal data to operate under 10 basic principles.
The code’s 10 principles required to be in compliance with PIPEDA (Personal Information Protection and Electronic Documents Act) as described by the Justice Department are:

1. Accountability: An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization's compliance with the following principles.
   
   Who is your privacy officer?
   
   
2. Identifying Purposes: The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.
   
   How do you inform guests about the use of their information?
   
   
3. Consent: The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except when inappropriate.
   
   If guests refuse to share data, do you make them aware of the consequences of not doing so?
   
   
4. Limiting Collection: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.
   
   Safeguard you business by only handling essential information about your guests. Do you time the collection of your data so that you are handing only the minimum amount of information you need to service your guests?
   
   
5. Limiting Use, Disclosure, and Retention: Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by the law. Personal information shall be retained only as long as necessary for fulfillment of those purposes.
   
   What happens to guest data after guests leave? How is access to data controlled? In some cases remote wilderness activity providers require health and allergy information about their guests. What sensitive data do you have in your possession? What data would you not want held by a third party after your travel experience?
   
   
6. Accuracy: Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
   
   What steps to you take to minimize the errors in your data?
   
   
7. Safeguards: Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
   
   What kind of sensitive data do you take from guests? What risk is there of inappropriate distribution?
   
   
8. Openness: An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
   
   Posting a Privacy Policy isn't required by the law, but it makes good business sense as a credibility builder with potential guests. Do you have a privacy policy? Where is it posted, is it easily accessible for those who request it?
   
   
9. Individual Access: Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
   
   
10. Challenging Compliance: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals for the organization's compliance.
    
    Are you prepared to address challenges to your responsible use of guest data?

Creating your Privacy Policy

If you haven't got a policy regarding privacy, take some time to see how others have done it, and draft one for yourself.

Are you ready to share this policy with your guests if they ask for it? Do you have the capacity to follow through with what you say you will do?

Sample Policy:Your trust and privacy is of the greatest importants to the ..... Inn. Our success depends on our ability to deliver useful and accurate information, and to maintain your trust. We may ask for your opinion or interests in certain services from time tot time. This information is used to customize our emails to your tastes and preferences. We will not sell, share or rent this information.

Create or modify your Privacy Policy and take steps to ensure your are in compliance with legislation.

Treat your guests information as carefully as you hope your own is treated.

Privacy Information at PrivacyInfo.ca
- a great Canadian reference

Privacy Highlights of Legislation

For more information contact: The Privacy Commissioner of Canada
112 Kent Street, Ottawa, ON K1A 1H3
Tel.: 1
Fax 1
E-mail: .
www.privcom.gc.ca
1-