When a Customer Asks What You Have on File

An email asking what you know

Today is Data Privacy Day, a reasonable excuse to prepare for a question most small businesses have never been asked: what information do you have about me?

It usually arrives as a short email from a customer, a former client or someone on the mailing list. Sometimes it follows a complaint. Sometimes it is plain curiosity.

Under Canadian privacy law the person is entitled to an answer. For most businesses the difficulty is not willingness but knowing where to look.

This is a general guide for business owners, not legal advice.

What the law expects

PIPEDA, the federal privacy law, covers personal information in commercial activity in most provinces. Some provinces have private-sector privacy statutes of their own; which one governs depends on the province and what the business does with the information.

Under PIPEDA, a person can ask whether an organisation holds personal information about them, what it is, how it has been used, and to whom it has been disclosed. The provincial laws give a similar right.

The request should be in writing. A business is generally expected to respond within thirty days, at minimal or no cost to the person, and to correct anything shown to be inaccurate.

The right covers information in any form. Emails, paper files, spreadsheets and recordings all count.

There are exceptions, for example where answering would reveal personal information about someone else. Anything beyond a straightforward request is worth taking to a professional.

Where website data actually lives

• The inbox that receives contact and quote form emails.
• The form plugin, which may keep its own copy of each entry.
• The mailing list, with sign-up dates, opens and clicks.
• The shop or booking system, with orders, accounts and notes.
• Spreadsheets kept for follow-ups, quotes and events.
• Texts and messages on work and personal phones.
• Backups of the website and of the email.

The second is the copy most owners have never seen. Plenty of form plugins save every submission in the website's database alongside the email, and hold on to it until someone deletes it.

Notes and opinions count too

Personal information is not only names and addresses. It includes what has been written about a person: a comment in the booking system, a remark in a spreadsheet, an assessment after a meeting.

Those can be requested like anything else. The practical rule is to write every note as though the person may one day read it, because they may.

Analytics, by contrast, should hold nothing that identifies an individual. Google's terms for Analytics forbid sending it personal details, so a setup that does needs fixing anyway.

Confirm who is asking

Before sending anyone information about themselves, make sure it is really them. A request from an unfamiliar address asking for someone's order history and home address could come from anyone.

Reply to the contact details you already hold, or ask something only the customer would know, and never send the information to a new address without checking first.

Note the date the request arrived, since the time allowed to respond runs from then.

A worked example

A sales trainer runs workshops for small sales teams, in hotel meeting rooms and at clients' offices, and takes bookings for her public workshops through a form on her website.

A former participant emailed to ask what information she held about him. He had attended a two-day workshop the previous spring, paid for by his employer.

She found more than she expected. The booking form had emailed her and kept its own copy, and the mailing list held his address with a record of every newsletter he had opened.

A spreadsheet of participants held her notes from the role-play exercises, and a shared folder held a video of his practice sales call, recorded for feedback on the day.

She answered within the month with copies and a plain summary: what she held, where it was, why she had it, and what had gone to his employer and to her mailing service.

She kept everything until the request was settled. Then she set a rule for the future: practice videos are deleted a month after each workshop.

Answering the request

Reply in writing and in plain language. Say what you hold, where it came from, what it is used for, and which other organisations have it, such as a mailing service or payment processor.

Provide the information in a form the person can understand. Copies of form entries and notes are usually simplest, with any codes or abbreviations explained.

Correct anything that turns out to be wrong, and say that you have.

Do not delete anything the request covers while you are answering it. Tidying up can wait until the matter is settled.

Making the next request easy

The first request takes hours. The second takes minutes, provided somebody wrote down where everything was found.

Keep a one-page list of every place personal information goes: each form and where it sends, each list, each system and shared folder, and who can open it.

Add how long each is kept. Information you no longer need is information you do not have to search, protect or explain.

Name a person to handle privacy questions, and put a working contact address in the privacy policy on the website.

The counter-case

Most small businesses will receive few of these requests, and some will never receive one. The value of preparing lies as much in knowing what you hold as in the request itself.

A business with one contact form, no mailing list and invoices on paper will find a request quick to answer.

Some requests are not simple at all: from a former employee, in the middle of a dispute, or involving health information. Those deserve professional advice before any reply.

For the ordinary case, know where the information lives before anyone asks, and answer in writing within the time allowed.

For Data Privacy Day

1. List every form and where it sends.
2. Check whether form plugins store entries.
3. See what the mailing list records about subscribers.
4. Find the spreadsheets and notes staff keep.
5. Name a privacy contact with a working address.
6. Decide how long each kind of record stays.
7. Write it all on one page.

Step four is where the surprises are. Notes and spreadsheets are personal information too, and they are usually the records written with the least care.

The date and source of each subscriber's consent belong in the same records, as covered in customers whose implied consent runs out this year.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.