Employee training a key factor in effectively satisfying customers’ requests about an organization’s personal information handling practices
Early resolved case summary #2015-07
August 14, 2015
Lessons Learned
- An organization must provide specific details and be able to answer individuals’ questions about its policies and practices relating to the management of personal information.
- Organizations should ensure their employees are adequately trained and knowledgeable about their policies and practices related to handling and managing personal information.
Complaint summary
An individual alleged that a car dealership was not able to readily provide details about its personal information handling practices when she asked for the information in person and by email.
The individual went to the dealership for routine vehicle maintenance and requested a loaner car while her vehicle was being serviced. An employee asked for her driver’s license and credit card to proceed with the request. He then copied her driver's license and credit card. The individual asked why her personal information was being collected and what safeguards were in place to protect it. She was dissatisfied when the employee explained that this was the procedure he was told to follow. The complainant then sent an email to the dealership’s privacy officer asking the same questions, as well as additional questions about retention periods. She did not receive a response. Unsatisfied, the individual filed a complaint with our office seeking answers to her questions.
Outcome
Our office conducted a site visit of the dealership. During the visit, we reviewed the dealership’s policies and practices relating to its handling of personal information and its privacy training for employees. While our office was satisfied with the policies and practices in place related to the dealership’s handling of personal information, we stressed that all employees who collect personal information from individuals must be able to answer individuals’ questions. This includes advising why personal information is being collected and addressing any concerns related to safeguards and retention.
The dealership agreed to hold a review session with employees to ensure that its policies and practices relating to the handling of personal information were known and followed by staff. Our office subsequently contacted the individual and provided her with an overview of the site visit. She was satisfied with the results achieved and the matter was considered early resolved.
- Date modified: