Protecting Your Clients' Private Information
by David Appleby

article continued

This information includes, but is not limited to, financial data such as bank and credit card accounts, passport information, driver’s licenses, birth dates, anniversaries, family names, and in some cases their medical details. Add to this all of the personal preferences and habits information we include in our data bases, and you can see that we really do have a lot of their personal information in our possession. All of this information is essential to serving our clients' travel needs more efficiently and effectively.

However, we have a responsibility to our clients to protect that information and to make every effort to keep it out of the hands of unauthorized persons. We also have a responsibility to our agencies to reduce our liability for the loss of such information. Below are a few ideas that should help insure that you accomplish both.

First and foremost, develop a privacy policy. This policy should be detailed enough so that there is no doubt as to what is included. Make sure all employees, outside agents, and independent contractors are familiar with the policy and understand exactly what the policy requires of them. Most importantly, practice the policy! It is not enough to just have the policy statement. You must ensure that it is put into practice on a daily basis. Do this by monitoring the implementation of the policy by your staff.

Publish your policy. Web sites should have a page that details your privacy policy and spells out how personal information will and will not be used. This disclosure page should include an opportunity for clients to opt out of sharing their information with your vendors and suppliers beyond what is required to arrange their travel. Your privacy policy should also be available to clients in other formats, so those not visiting your Web site can have access to it. Making your privacy policy known to both potential and existing clients helps protect your business and at the same time fosters the client’s trust in your business practices.

You should also have a filing system that protects your clients' information. This means that, if you are operating in the “old fashioned” way (file folders in a file cabinet), this information is under lock and key and not readily accessible to unauthorized persons. If you use an electronic data base (CRM) program, it should be encrypted and password protected. If you are using an online CRM, you should get an assurance in writing from the company providing the service that states its privacy policy and how the data in its system is protected.

Travel agents and consultants rely heavily upon laptop computers and personal communication devices to conduct business. These often contain clients' personal information. Make sure that any device containing client information that leaves your office is adequately protected by encryption and passwords. Do not leave this equipment unattended in your automobile, the airport waiting area, or other places where they are subject to theft. These devices are often stolen for the sole purpose of obtaining identity information.

Additionally, you should make certain that your computer has a good firewall program and that it is functioning correctly. You might also want to invest in anti-hacking software.

When obtaining information from your clients, get only the information necessary to serve their travel needs. If you do not need a piece of information, don’t ask for it. In this same vein, if you no longer need the information, destroy it. Invest in a good crosscut shredder, and learn to use it regularly. It is more difficult to electronically shred information stored in an electronic data base, but every effort should be made to make sure that deleted information in the data base is not easily recoverable (be aware that people with sophisticated computer skills can often retrieve deleted information).

Lastly, constantly monitor and review your policies and how they are being carried out. Remember that you are responsible for protecting all of your client’s personal information that is in your possession.

David Appleby serves as director of the OSSN Austin Chapter. He may be reached at austintx@ossn.com.

(Credit: David Appleby)