SOMBA K'E/YELLOWKNIFE
Small businesses are falling behind when it comes to privacy obligations.

Brent Homan, director general of the office of the Privacy Commissioner of Canada, speaks about small businesses and good privacy practices at a Business Club Luncheon in Yellowknife on June 23. - Robin Grant/NNSL photo

That's why Brent Homan, director general of the office of the Privacy Commissioner of Canada, is on a Canada-wide tour to talk about small-business privacy obligations, what's expected under the federal privacy legislation and how to avoid costly and reputation damaging privacy breaches.

Homan was in Yellowknife on June 23 to attend a Business Club Luncheon organized by the Yellowknife Chamber of Commerce.

"What we found is that, as a group, small businesses are much less likely to be aware of their privacy obligations or even be aware that these privacy laws exist," he said, adding that certain sectors now have access to more consumer information and don't know what to do with it.

For example, he said restaurants and other small businesses now collect people's e-mail addresses, phone numbers and postal codes on a daily basis via online reservations, third-party apps and even loyalty programs.

"The availability of information and the cost of information is having a revolutionary impact on businesses being able to use that information," he said.

But many businesses are making mistakes when it comes to using it correctly.

Homan referred to a local cable television provider Senga Services in Fort Simpson, that posted a list of customers with overdue accounts and the amounts they owed on Facebook late last year, making international headlines. Because of the sensitivity of the information, the Office of the Privacy Commissioner of Canada contacted the cable provider and requested that it remove the posting.

But if small businesses make greater efforts to use information in a privacy compliant way, those businesses will attract more customers.

He said businesses can become more compliant by conducting simple procedures such as looking at what type of information they collect, consider how they use it, and consider what they say to their customers. "Are you doing it in a way that privacy protective?" he asked. "Are you only collecting the information that is necessary?"

There are other common things that businesses can do better to protect people's information, such as locking filing cabinets and encrypting hard drives and asking whether they actually need certain information.

"We have heard from Canadians that they care about happens to their information and they are willing to do business with companies if they demonstrate that they care about people's personal information," said Homan.

A 2015 public opinion survey conducted by the Office of the Privacy Commissioner of Canada reported that only 16 per cent of Canadians believe businesses take their privacy obligations seriously and nearly one-third said they have suffered negative consequences as a result of releasing personal information.

Eighty-one per cent said they would do business with companies with good privacy practices, according to the report.

Homan said one company wanted to validate the identity of their members and were asking to see driver's licenses.

"But you don't need to go so far as to actually make a photocopy of those driver's licenses," he said. "And certainly not keep it in a book that could be accessible at the front desk of a company."

We welcome your opinions. Click here to e-mail a letter to the editor.