​Are loyalty programs on shaky ground?

The California Consumer Privacy Act (CCPA) could have nationwide implications for how restaurants manage their data, protect consumer privacy and market their business. The National Restaurant Association hosted a webinar recently with Helen Goff Foster, a partner in the Technology + Privacy & Security for Davis Wright Tremaine, who reviewed the implications of the law, which is set to go into effect next year and could likely set similar legislation in motion in other states. The act will impact how businesses manage the consumer data they collect and the loyalty programs they operate. Unlike GDPR, which is about having consumers opt in to providing personal information, CCPA is about allowing them to opt out. In broad terms, for a wide swath of businesses, the law requires businesses to let consumers access the personal information you track, and gives them the right to delete information, and to opt out of the sale of that information. It also requires you to give consumers two methods of contacting you about it (including an 800 number). Businesses must therefore be able to retrieve consumer information across its affiliates, business units, product lines, etc. The law is intended to prevent businesses from providing discounted service or price to certain customers but not others (which clearly creates some hazy territory for businesses operating loyalty programs). There are fines in the thousands of dollars for violating the law and businesses could also be exposed to a private right of legal action by consumers against the business and its affiliates. Franchises could be especially vulnerable because they could bear legal risk but aren’t able to dictate privacy policies of their parent company. Foster advised that the best thing businesses can do now is identify where their consumer information is and how to access it. You’ll need to determine how to provide opt-outs for most of your consumer data and assess the ability of your vendors to do so as well, so update (or establish) your information security program. For more information about the law’s potential effects on restaurants, access Foster’s webinar and Q&A here.