In a marketing drive, a retail chain issued customers with "membership cards" on which customers were required to fill in their names, identity card numbers, addresses, telephone numbers, sex and age. A chop was stamped on the card with every purchase over a certain amount. When a certain number of charges has been accumulated the card could be exchanged for gift. A customer was concerned about how the shop would use his personal data and referred the matter to the PCPD.
On investigation it was ascertained that the retail chain used the data about the sex and age of customers for customer profile analysis purpose. The names and contact details were kept to facilitate future liaison to promote customer loyalty. On the advice of the PCPD the retail chain revised the format of the cards so that identity card numbers were no longer required and a statement about the use of the data was included on them. During the interim period before new cards were produced, notices were put up to inform customers of the new arrangements.
The Commissioner's views on the matter
DPP1(1)(c) provides that personal data should not be collected unless the data are adequate but not excessive in relation to the purpose of use of the data. The collection of the identity card number is generally excessive for a gift redemption scheme. For the customer profile analysis purpose in this case it was considered acceptable to collect data relating to the sex and age of customers. However, in relation to age it would normally be sufficient for this purpose to invite a customer to indicate what range of ages his or her age falls into, e.g. "15-20" etc. Lastly, the retail chain had failed to comply with DPP1(3), which requires all practical steps to be taken to inform a person of, inter alia, the purposes for which his or her personal data are to be used when personal data of which he or she is the subject are collected from him or her. A warning notice was issued to the retail chain following investigation.