With summer just around the corner, many Bow Valley businesses are collecting customer information through bookings, events, and online interactions. From waivers to mailing lists, it’s easy to gather data without thinking through the legal implications. Canmore-based lawyer Austin Ward sat down with Richard Stobbe to discuss how businesses can collect and manage personal information responsibly.
What types of information are businesses collecting from tourists and event attendees?
It can range from basic contact details like names and email addresses to more sensitive information such as payment details, emergency contacts, allergy or health information, or signed waivers. Many businesses also collect data through online booking platforms or marketing tools without fully considering how that information is being stored or used.
Where do businesses tend to run into trouble?
Overcollection is a common issue. Just because you can collect certain information doesn’t mean you should. Businesses need to ask whether the information is necessary for the purpose at hand. Do you really need a "date of birth" or is "age" good enough for your purposes? Another issue is lack of transparency. If people don’t understand why their information is being collected or how it will be used, that can create risk.
What should businesses be doing to stay compliant?
Start by being clear about your purpose. If you’re collecting information for a booking or event registration, say so. Make sure your privacy policy is up to date and accessible. You should also limit access to personal information internally and ensure it’s stored securely, especially if you’re using third-party platforms.
How do third-party tools factor into this?
Many businesses rely on external platforms for reservations, payments, or email marketing. Even if a third party is handling the data, your business is still responsible for how that information is collected and used. Walk through the "data journey". It’s important to understand where the data is stored, whether it’s being transferred outside of Canada, and what safeguards are in place.
Are there practical steps businesses can take right away?
Yes. Review your forms and remove any fields that aren’t necessary. Make sure you’re obtaining meaningful consent, especially if you’re using the information for secondary purposes like marketing. And train your staff so they understand how to handle personal information properly.
Any final thoughts for businesses heading into peak season?
Data collection often increases when business picks up, but privacy obligations don’t change. Taking a few simple steps now can help you avoid issues later and build trust with your customers.
For more information, contact Richard Stobbe at rstobbe@fieldlaw.com or 403-260-8508; or reach out to Austin Ward at award@fieldlaw.com or 587-956-2754.
