Consumer Data Collection and Privacy: Best Practices and Risk Mitigation Strategies for Franchise Systems

[...]Part IV will discuss strategies and best practices to minimize the risk to franchise businesses posed by the collection of consumer data. П. Data Collection Practices Commonly Used by Franchise Businesses "Consumer personal data" generally refers to nonpublic, personal identifying information (PII)-such as birth date, social security number, income level, purchase history, and biometric information-that permits the identity of an individual to whom the information applies to be reasonably discovered.13 As discussed below, businesses commonly collect consumer personal data by (1) direct solicitations; (2) tracking customers via electronic means; and/or (3) purchasing from third-party data collectors or brokers. To be eligible for the rewards program, customers initially had to enroll in Verizon Selects (a targeted advertising program) and agree that Verizon could access their web-browsing history, app usage, location data, and other information to create "specific insights" into the participating customers.17 The program that began as an "opt-in" program (i.e., one where a consumer must take an affirmative step to agree to participate) was subsequently converted into an "opt-out" program.18 Pizza Hut, similarly, introduced its Hut Rewards® loyalty program in 2017, an "opt-in" program that offers customers the chance to earn points redeemable for free pizzas and other discounted items, early access to new products, and birthday rewards.19 Like the Verizon Lip program, participants in the Hut Rewards program agree that Pizza Hut can collect an array of personal information about them, including personal profile, payment card information, location and movement data, address book information, and analytics data.20 Pizza Hut then uses that information to create a more detailed profile, and may share, sell, or disclose such personal data to third parties for marketing and analytics purposes.21 Many other well-known franchise brands, such as Subway, Marriott, and Burger King, have similarly structured rewards programs.22 Consumer feedback, surveys, and interactive social media are other methods of direct solicitation that franchise retailers and service providers use to collect consumer personal data.23 L nlike the personal and engagement data collected through a loyalty or rewards program though, surveys and feedback responses and social media interactions provide qualitative or attitudinal data (i.e., consumers' opinions, interests, preferences, likes or di