3 Things Business Owners Need to Know to Protect Customer’s Information

Business identity theft protection requirements - Latin Biz Today

New privacy policies for business owners responsibility is growing to ensure consumer’s personal privacy and information rights

Editor’s note: This is a third, in a series of three articles, on privacy policies note 

In Part 1 we covered The Corporate Transparency Act for Small Business Owners- 4 Tips , in our last article, “The Protection of Consumers’ Online Privacy: A Revolution of Rights,” we discussed what rights a consumer has to manage their Personal Identifying Information (“PII”) and what terms should  be included in a privacy policy.

In this article, I would like to explore three items, two of which involve mandates that can require additional notifications under the California Consumer Privacy Act (“CCPA”):

1. When PII is procured from minors and, in particular, consumers under the age of 13 years

2. When a company provides incentives, such as discounts, rewards, or other benefits, to their customers to part with their PII

3. The need for businesses to create a privacy rights infrastructure to address customer privacy rights concerns.

1. Minor Children and Children under the Age of 13 years:

In the e-commerce context,  minors, generally persons under the age of 18 years (but this can vary depending on State law), normally do not have the legal  capacity to enter into contracts. As such, it is recommended that businesses should clarify in their websites’ Terms of Use, that it is required that minors purchasing  goods and services obtain the permission of their parents or legal guardians to engage in such transactions and that the vendor shall not be responsible for minors who misrepresent their age and identities.

  • Businesses should reserve to themselves the right to inquire whether a minor is authorized to make online purchases and to provide that parents and guardians shall guaranty and be responsible for paying for the goods and services purchased by the minor child. Businesses should also make it explicit in their Terms of Use that the unauthorized purchase by a  minor child may serve as the basis for terminating the online account in question.
  • In addition to addressing transactions with minors in the Terms of Use, the business should make sure that its privacy policy provides that should a  parent or guardian discover that a minor has disclosed their PII to the business pursuant to a purchase and sale transaction that the parent or guardian may have such PII deleted and expunged.
  • Where minor children under the age of 13 (“young minors”) are involved, specific laws at the state and Federal levels may also come into play.  The most significant law in this regard is the national Children’s Online Privacy Protection Rule (“COPPR”). The COPPR is a federal law that can require, among other things, that “vendors,” which are marketing to young minors, post online notices advising parents and guardians that the business is  targeting this demographic and an explanation concerning the information that is  being collected and how it is being used. The law also requires such vendors to set up a  mechanism to allow parents and guardians to consent to the disclosure of PII by a young minor and afford parents and guardians a reasonable opportunity to review the PII collected and to preclude or restrict its use.

As for other businesses who do not target minors and young minors, their privacy policies should specifically include a provision clarifying that they do not direct their products, services, and marketing efforts to children.

2. Financial Incentive Notices:

In addition to a privacy policy, delineating the rights of costumers to manage their PII, businesses that offer their customers incentives, such as discounts, rewards, or benefits, in consideration for a customer’s parting with their personal information, have  an  added duty to notify customers concerning the existence of a financial incentives program and the terms governing it.

  • Among the representations a Financial Incentive Notice is required to provide is an estimate concerning the monetary value of the incentive being offered. For example, if the financial incentive provided to customers is a 20% discount on the first $1,000.00 of product purchased, the monetary value being offered for the PPI would be $200.00. Not only is it necessary to represent the estimated value of the financial  incentive being offered but the methodology concerning how that value is determined also needs to be explained.
  • Additionally, the terms and conditions  governing the offer of a financial incentive needs to be discussed, i.e., how  would customers qualify for the incentive; when would their incentives expire, how would they be able to opt out of the program.
  • Finally, a Financial Incentives Notice needs to include a non-discrimination statement explaining that customers who decide not to participate in an incentives program will not be discriminated against for not providing their PII, such as by way of limiting their rights vis a vis other customers.

According to one source, the regulatory body charged with enforcing the privacy protection laws of California has recently issued citations to businesses operating in California who have failed to include in their online materials an adequate Financial Incentives Notice.

3. Developing a Privacy Rights Infrastructure

It is important that businesses have privacy policies that clearly explain to customers what their privacy rights are, but it is equally important to be able to process requests from customers concerning their privacy-related concerns. The best privacy policy is worthless if there is no one monitoring the air waves  to see if customers are registering a concern. To be able to develop an infrastructure for handling privacy policy inquiries is, therefore, critical. Email contact information needs to result in a person  receiving the customer email and then a  protocol needs to be in place to guide personnel on how to manage the inquiry. While there is no legal requirement to do so, privacy policy inquiries should be funneled to a designated person (an “Administrator”), who would be responsible initially for vetting the inquiry and then sending it on to legal counsel to assess whether it triggers an obligation on the part of the business.

At the same time, it is important that a business knows  where its customer PII is being held within its information network. Customer PII should be segregated from other information and encrypted or otherwise password protect so that hacking risks  are minimized.

At bottom, the objective in creating a PII infrastructure is to afford a  business the capacity, readily, to locate a customer’s PII and to address customers’ privacy concerns in a timely fashion, which could include expunging, limiting the use of, or even transferring PII to another location.

The take away:

The protection of consumer privacy rights is expected to be a major growth industry that is sure to visit upon businesses more responsibility to protect and manage their customers’ personal identifying information. Such responsibility does not end with posting a comprehensive privacy policy. Other types of notices may also need to be posted. Finally, the development of a  privacy rights infrastructure is recommended, not only to safeguard customer PII but to allow a business expeditiously and effectively to address the privacy rights concerns of its customers.

Related content:

Part 1: The Corporate Transparency Act for Small Business Owners- 4 Tips

Part 2:  The Protection of Consumers’ Online Privacy: A Revolution in Rights

Data Privacy Rights: An Evolving Area That Cannot Be Ignore

Does your Data Asset have an Ownership Certificate?

Who Owns Your Emails?


Hispanic Business Leadership for Uncertain Times

Hispanic Business Leadership for Uncertain Times

How to make delusional optimism work for your Hispanic business this year Congratulations to you and your business if you are in a position to grow your business and bring in a new employee as we progress into this new year. Thank you for your decision to take the...

Reclaiming Our Life In the Age of Technology

Reclaiming Our Life In the Age of Technology

Implementing a digital detox doesn't require drastic measures, but has multiple benefits In an age where technology infiltrates every facet of our lives, the importance of a digital detox has become increasingly apparent. This concept of consciously stepping away from...

Your Brand Is Not What You Think It Is…

Your Brand Is Not What You Think It Is…

Let’s talk about FEELINGS... If you look at today’s marketing and business headlines, there is a lot of chatter about BIG data and AI - it’s everywhere. This compelled me to recently tweet the following “It’s all about BIG data these days but we must never forget the...

Video Gallery


Sign Up for the Latin Biz Today Newsletter

PR Newswire

Featured Authors

Innovation & Strategy





Mi Mamá Es Una Brava

Mi Mamá Es Una Brava

She was fierce, unapologetic, unselfish and brava. Editor's note: This is a reprise piece from Gaby Alcantara Diaz remembering her late parents and brother.   Over 21.2 million (all) immigrant women reside in the United States since 2013 with many traveling by foot,...






Work & Life


Health & Fitness

Travel & Destinations

Personal Blogs

Pin It on Pinterest