Privacy Policies & Compliance Issues
Your internship assignment for this week is with the Office of the Corporate Counsel & Chief Privacy Officer.
Padgett-Beale’s Chief Privacy Officer has invited you to “shadow” the company’s internal investigators as they look into a privacy problem that was uncovered in the Resort Operations organization (see “Background Information” at the end of this message). Your recent experience working in that organization is viewed as a plus since you may have seen or heard something during your time in Resort Operations and Guest Relations.
The CPO has also asked you to assist with identifying a set of appropriate and relevant updates to the company’s internal training program for staff members with access to guest information. The goal of these updates should be to strengthen the training provided to staff so that they understand (a) the importance of maintaining guest privacy and (b) the consequences that may be imposed upon staff who are found to have violated company rules and policies regarding guest privacy.
To begin, read the Background Information section below. Then consult the course readings and do additional research into the privacy, data security, and liability issues surrounding the stated privacy problem. Next, identify 3 to 5 specific recommendations for appropriate and relevant updates to the Guest Relations staff training program. Remember to focus your research and recommendations upon the hospitality industry (specifically hotels).
*****
Summarize your research and present your recommendations in a 3 to 5 paragraph briefing paper. Please remember to list and cite your sources (APA format preferred).
*****
Background Information
Special requests from guests are entered into the reservation database for use by front desk, concierge, housekeeping, and maintenance personnel. Food service personnel may also need to access this information in order to address special dietary needs. Guests may enter the information themselves using a web-based form or a call center operator may enter it on a guest’s behalf.
The Chief Privacy Officer recently became aware of a disturbing practice in which anonymous staffers have been posting “outrageous guest requests” under the “Humor” section of employee bulletin boards in the Resort Operations staff locker rooms. Some of these postings have included guest names and room numbers along with names and ages of children. This practice is a shocking violation of guests’ privacy and could seriously harm the company’s reputation if the practice were to continue. The bulletin boards have been moved to the semi-public hallway outside the locker rooms as a first step towards stopping this behavior.
A deeper investigation into the situation revealed that the recently revised guest relations privacy policy has strong protections in place that detail (a) who is allowed to access guest information and (b) the permitted uses of guest information. The consequences for violations, as listed in the policy, range from a two-week suspension without pay to termination of employment.
For examples of guest privacy policies, please see these resources:
1. https://www.lhw.com/Privacy-Policy
2. https://www.ihcltata.com/privacy-policy/
3. https://www.fourseasons.com/privacy/
Sample Solution
There is widespread agreement among academics that privacy policies do not effectively notify users about corporations’ data usage. Privacy policies are usually too long to read quickly and are only a partial description of a company’s activities. They are well-known for utilizing ambiguous phrases that can be perplexing, obscure, and deceptive to the reader (Reidenberg et al., 2015). Because they are so far removed from any common understanding of the concept, there have been proposals to rename them data management policies rather than privacy rules because their content does not adequately express privacy consequences. Recent privacy/data regulations, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), have put pressure on businesses.
