Privacy Ref Blog

Preparing your customer-facing staff

My wife and I went to a favorite pizza place the other day. It is a small chain that has a loyalty program. The server, having seen us on a few other occasions, asked us if we wanted to sign up. All we needed to do was provide an email address, phone number, and name then we would be good to go.

My wife gave me “the look”, knowing what was coming next. I asked the server “can you tell me about your privacy policy?”

“I have no idea” was the response. “No one explained anything about it.” I asked if there was a document with it somewhere in the restaurant, so off she went to look. As expected, nothing was found.

While the server was off searching for a copy of the privacy notice, I brought it up on my phone.

Reviewing the notice

As I read the document, I was pleasantly surprised. It was well written and comprehensive. The notice had not been updated since October 14, 2016; no GDPR update which is not a surprise given the nature of the business.

The first red flag came when I read the following statement statement in the section on consent:

If you are unsure whether this Privacy Statement is in conflict with the applicable local rules where you are located, you should not submit your or any other persons personally identifiably information to us.

My interpretation…”we’ll do what we please, and if it is illegal it is up to you not to participate.”

All of the chains operations, from the website to the restaurants, were covered by the scope of the notice.

The next sentence in the notice stated that anyone who “accesses, uses or interacts” with the chain’s services gives affirmative permission for the company to use the personal information collected. SO, if I want to eat their pizza, I give affirmative consent.

What information is collected

The chain collects and uses personal information in ways you would expect. Information you provide when you register with them, your transactions, employment information, customer service information, your userids and passwords, and pictures and comments were all listed as information collected.

Further down in the notice there is a section called “Other Ways We Collect Personal Information“. There is a paragraph in this section that discusses information the restaurant may collect from mobile devices.

“In certain restaurants we use a service that analyzes Wi-Fi signals from mobile devices to measure restaurant occupancy and to identify guest traffic patterns in the restaurant. The service determines the location of a smartphone or wireless device by observing Wi-Fi or Bluetooth signals that are broadcast from that device. Individual devices are identified by a media access control (“MAC”) address that was assigned to the device when it was manufactured.”

The notice goes on to describe how the information is protected and aggregated. It also states that if you are connected to the WiFi network, a just-in-time privacy notice seeking consent will be provided to you on your device. Finally, it also notes that the information is collected by an unnamed third party (what else are they doing with the data?).

Why is all this important?

Let’s go back the beginning of this note. The server did not have  any idea about the company’s privacy policies or what is contained in the restaurant’s notice. There was no copy of the privacy notice at the restaurant location.Yet, personal information was being collected both passively and actively (potentially even if it was not legal).

When I give privacy classes, I usually ask who has read their company’s privacy notice. On average, less that 50% of the class has read their company’s notice. (Now keep in mind that these are people who are interested in privacy.)

Everyone on your customer facing team should be familiar with your privacy notice. Regardless of their being a server, a manger, a customer service representative, a receptionist, a professional providing services, or any similar function, these team members should be expected, be required, to at least read your privacy notice. Of course, if you provide regular privacy training, the privacy notice should be covered during the class.

Your privacy program can be a differentiator for your company. If your customer-facing team members do not understand your program, you may lose an advantage.

  • author's avatar

    By: Bob Siegel

    Bob Siegel, the founder and President of Privacy Ref, Inc., has extensive professional experience in the development and improvement of privacy policies and procedures, the definition of performance metrics to evaluate privacy maturity, and the evaluation of compliance. He utilizes a combination of alignment, adaptability, and accountability strategies to guide organizations in achieving their privacy goals.

    He is a Fellow of Information Privacy (FIP) and a Certified Information Privacy Professional, awarded from the International Association of Privacy Professionals, with concentrations in U.S. private-sector law (CIPP/US), US public sector law (CIPP/G), European law (CIPP/E), and Canadian law (CIPP/C). He is also a Certified Information Privacy Manager (CIPM) and Privacy Technologist (CIPT).

    Siegel is a member of the IAPP faculty, has served on the Certification Advisory Board for the CIPM program the Publications Advisory Board.

    Siegel also writes the blog “Operational Privacy” on

  • author's avatar

  • author's avatar

    What you don’t know may (pleasantly) surprise you
    CNIL’s Google Fine of 50 million Euros
    In praise of a privacy compliance program
    Looking to 2019 Privacy Plans
    Automation for Privacy

    See all this author’s posts

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at

Posted on September 19, 2018 by Bob Siegel

« »

No Responses

Comments are closed.

« »

Subscribe to our mailing list

Please fill out the form below.


Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to or call (888) 470-1528.


April 5, 2019

See you at the Summit
Visit us at Booth 500 at the IAPP Global Privacy Summit. Bob Siegel will be facilitating the CIPM course. April 30th-May 1st, 9 am - 5 pm. Meeting time available to discuss your privacy needs is available for signup here.

Latest Blog Posts

April 19, 2019

Do you have 1 minute? Check out our New weekly Quick Privacy Ref-erence series.

At Privacy Ref we are always thinking of ways to improve the experience of our followers and clients alike. Weekly on our YouTube channel you will find a relevant privacy topic being discussed in a 1-minute video such as: 

  • Cookies walls and the Dutch DPA - Ben Siegel discusses his research on the Dutch Personal Data Authorities' guidance on cookies walls and freely given consent. A cookie wall is a notice from the website, informing the user about the use of cookies on the website, without a reject option. Ben provides insight into the difference between functional cookies and tracking cookies and why the Dutch DPA's advises that websites’ basics functions are to remain available for everyone and not just for those that accept all cookies (including tracking cookies).   
Continue reading this post...

April 12, 2019

Protect Your Privacy Spring Cleaning

I’ll be honest, my blog idea was generated from an article about spring cleaning.  Let’s face it, lots of things could benefit from spring cleaning:  homes, cars, desk drawers… How about your inbox?  Maybe the ever-growing number of presentation drafts in your documents folder?  How about the flash drive in your desk drawer?  Anything in the cloud that’s been hanging out for years?  Maybe there’s a number of bookmarks or favorites on your list that hasn’t been used or accessed in a while.

Continue reading this post...

Other Recent Posts