Will this contravene the PDPA?

[Oceanklassik]

This matter came to my mind over my recent experiences with our local watch ADs.

Over the past few months, I have, together with friends/colleagues and family members, went to a few ADs for the viewing and subsequent purchases of watches. And over some friendly conversations I had with several sales execs from the various outlets, I discover that the watch companies have actually created some online data-sharing of their customers' profiles and information. It did not help that any sales staff from a watch company can know, almost immediately:

- the number of watches a customer had bought (since the creation of the system in 2014/2015);
- what type of watches were bought;
- where the watches were bought at;
- who the watches were bought from; and
- the cost of each and every purchases.

I can understand the potential need for this initiative; maybe for the sake of building up their customers' profiles so as to differentiate more distinctively who their VVIP-customers are, how much each customer has spent buying their products, which customer(s) should deserve what watch(es) to buy, who are likely 'flippers' so they can BLACKLIST, etc. But I see many potential problems to it.

Firstly, customers' information is widely shared among all staff within the company. I am not sure if the company has any NDA policy or have instructed the staff not to reveal customers' information freely. Secondly, are all staff trained to handle such information with high confidentiality (apparently not and I will share later). Thirdly, as what my subject title states, does this contravene the law on Personal Data Protection Act?

[Oceanklassik]

Firstly, customers' information is widely shared among all staff within the company. I am not sure if the company has any NDA policy or have instructed the staff not to reveal customers' information freely. Secondly, are all staff trained to handle such information with high confidentiality (apparently not and I will share later). Thirdly, as what my subject title states, does this contravene the law, i.e. Personal Data Protection Act?

During some of those visits we made at the ADs, information regarding some of my friends/colleagues on their purchases with the company were shared openly among the group of us. I came to learn that one of my friends had bought a certain number of watches from several sales staff at various outlets in detail, when the staff who attended to us shared the information freely. My friend blushed and looked astonished. I wonder if he was shocked with the amount of information the AD had, or that he did not want us to know so much about his personal expenditure.

A dating couple I went with to buy a watch at another AD. During the purchase, the staff (I think she acted out of goodwill) mentioned to the couple openly (in front of his girlfriend) that the guy had bought this watch, that watch on this date, that date, and where those watches were bought, and from who and how much. The girlfriend "jaw dropped". Apparently she did not know the boyfriend had bought those watches and on the amount spent! I think the guy did not want her to know until everything was spilled by the staff. I dare not guess the outcome of their relationship.

What do you guys think?

[Oceanklassik]

Another thing that came to mind...

Does the new customer profiling system capture/record those customers who, though do not buy watches very frequently, but often recommend buyers to the ADs? How then can these 'recommenders' be captured in their system?

[triton]

many are not FULLY aware what the PDPA is. it will take a landmark case to make a statement.

as to the sales staff who share what is ok, the sales staff does not know how to practice discretion.

During some of those visits we made at the ADs, information regarding some of my friends/colleagues on their purchases with the company were shared openly among the group of us. I came to learn that one of my friends had bought a certain number of watches from several sales staff at various outlets in detail, when the staff who attended to us shared the information freely. My friend blushed and looked astonished. I wonder if he was shocked with the amount of information the AD had, or that he did not want us to know so much about his personal expenditure.

A dating couple I went with to buy a watch at another AD. During the purchase, the staff (I think she acted out of goodwill) mentioned to the couple openly (in front of his girlfriend) that the guy had bought this watch, that watch on this date, that date, and where those watches were bought, and from who and how much. The girlfriend "jaw dropped". Apparently she did not know the boyfriend had bought those watches and on the amount spent! I think the guy did not want her to know until everything was spilled by the staff. I dare not guess the outcome of their relationship.

What do you guys think?

[triton]

it is up to the company in concern to educate their staff that the information they see if for their eyes only and not to misuse it.

there is a an act that a staff caught in misuse of company information can be taken to task. however, many companies usually don't take their staff to task for fear of reputation.

This matter came to my mind over my recent experiences with our local watch ADs.

Over the past few months, I have, together with friends/colleagues and family members, went to a few ADs for the viewing and subsequent purchases of watches. And over some friendly conversations I had with several sales execs from the various outlets, I discover that the watch companies have actually created some online data-sharing of their customers' profiles and information. It did not help that any sales staff from a watch company can know, almost immediately:

- the number of watches a customer had bought (since the creation of the system in 2014/2015);
- what type of watches were bought;
- where the watches were bought at;
- who the watches were bought from; and
- the cost of each and every purchases.

I can understand the potential need for this initiative; maybe for the sake of building up their customers' profiles so as to differentiate more distinctively who their VVIP-customers are, how much each customer has spent buying their products, which customer(s) should deserve what watch(es) to buy, who are likely 'flippers' so they can BLACKLIST, etc. But I see many potential problems to it.

Firstly, customers' information is widely shared among all staff within the company. I am not sure if the company has any NDA policy or have instructed the staff not to reveal customers' information freely. Secondly, are all staff trained to handle such information with high confidentiality (apparently not and I will share later). Thirdly, as what my subject title states, does this contravene the law on Personal Data Protection Act?

[triton]

if it is the same company that i am aware. i will let you know later.

Another thing that came to mind...

Does the new customer profiling system capture/record those customers who, though do not buy watches very frequently, but often recommend buyers to the ADs? How then can these 'recommenders' be captured in their system?

[Oceanklassik]

many are not FULLY aware what the PDPA is. it will take a landmark case to make a statement.

as to the sales staff who share what is ok, the sales staff does not know how to practice discretion.

Awareness is not an excuse in the eyes of the law. I can tell the NEA officer I did not know that I cannot smoke at the children's playground but I will still have to pay the fine..hahaha.. when a law is in place, the onus is on you to find out before you carry out any activity. Moreover, this is a business entity which I think must build/create their company policies in accordance with the laws of the country. So, if the watch company wants to create a customer profiling and information system, they must, at the same time, put in place 'safeguards' of customers' information.

Some of the ways can include limiting access of such information to only the store manager. Means other sales staff cannot suka-suka check at will and start to share the information freely. Make the staff sign NDA to not disclose such information to any customer at all because such information should only be kept within the company. You cannot rely on staff's discretion when it comes to information like this.

[triton]

i am not referring to the organization, i am sure the organization has taken steps in ensuring data protection.

but the sales person may not be aware of the dire consequences.

what kind of information do you feel should be restricted to higher management.

i do agree on the non disclosure of information of customers.

Awareness is not an excuse in the eyes of the law. I can tell the NEA officer I did not know that I cannot smoke at the children's playground but I will still have to pay the fine..hahaha.. when a law is in place, the onus is on you to find out before you carry out any activity. Moreover, this is a business entity which I think must build/create their company policies in accordance with the laws of the country. So, if the watch company wants to create a customer profiling and information system, they must, at the same time, put in place 'safeguards' of customers' information.

Some of the ways can include limiting access of such information to only the store manager. Means other sales staff cannot suka-suka check at will and start to share the information freely. Make the staff sign NDA to not disclose such information to any customer at all because such information should only be kept within the company. You cannot rely on staff's discretion when it comes to information like this.

[Oceanklassik]

i am not referring to the organization, i am sure the organization has taken steps in ensuring data protection.

but the sales person may not be aware of the dire consequences.

what kind of information do you feel should be restricted to higher management.

i do agree on the non disclosure of information of customers.

In fact, I feel almost all information relating to a customer should be restricted to the higher management/HQ. Except maybe, the customer's name and contacts such as mobile no. and/email address. This is especially so because the company cannot regulate and instruct every sales staff what the staff should/should not reveal/share. And the only way the company can safeguard such information is to limit a customers' data to the HQ, and to only allow limited information at the retail outlets.

As of now, the sales staff has to seek approval from the HQ if a customer 'deserves' to be sold a popular watch model. So, if such a decision can only be made by the HQ, there's no need for the ground staff to have access to so much information of a customer.

I think this not only protects their customers; it also safeguards the company's interests. For example, a staff who has been with the company for many years, now intends to resign. He/she may move on to a competitor company, or remain in the same industry but operating independently. So, the customers' information will be a 'gold mine' for the staff who is resigning.

What do you think?

[triton]

i wont say the company cannot regulate but rather is hard to enforce what the staff can/cannot say/share/reveal. then again, who is to say the HQ staff won't reveal or share the information to others?


currently sales staff says customer wants to buy a submariner date 116610LV aka hulk and inform HQ. HQ staff will have to check customer prior purchase history if any, then say yay or nay. if sales staff does have the purchase history on hand and notice that customer had not purchase any not so popular model before, then sales staff can at least say why not purchase a DJ model to increase chances.

i do agree with you to a certain extent such information should be restricted to a certain level of management level and above. more important is who should be trusted with the information.


companies like this will enforce a "blackout" period for a sales staff who resigned not to be able to join a competitor company as a sales staff.

a company's customer profile has been a gold mine for previous years. that is why one tend to get unsolicited calls from insurance companies, etc.

This is especially so because the company cannot regulate and instruct every sales staff what the staff should/should not reveal/share.

As of now, the sales staff has to seek approval from the HQ if a customer 'deserves' to be sold a popular watch model. So, if such a decision can only be made by the HQ, there's no need for the ground staff to have access to so much information of a customer.

I think this not only protects their customers; it also safeguards the company's interests. For example, a staff who has been with the company for many years, now intends to resign. He/she may move on to a competitor company, or remain in the same industry but operating independently. So, the customers' information will be a 'gold mine' for the staff who is resigning.

What do you think?

[Oceanklassik]

i wont say the company cannot regulate but rather is hard to enforce what the staff can/cannot say/share/reveal. then again, who is to say the HQ staff won't reveal or share the information to others?


currently sales staff says customer wants to buy a submariner date 116610LV aka hulk and inform HQ. HQ staff will have to check customer prior purchase history if any, then say yay or nay. if sales staff does have the purchase history on hand and notice that customer had not purchase any not so popular model before, then sales staff can at least say why not purchase a DJ model to increase chances.

i do agree with you to a certain extent such information should be restricted to a certain level of management level and above. more important is who should be trusted with the information.


companies like this will enforce a "blackout" period for a sales staff who resigned not to be able to join a competitor company as a sales staff.

a company's customer profile has been a gold mine for previous years. that is why one tend to get unsolicited calls from insurance companies, etc.

"then again, who is to say the HQ staff won't reveal or share the information to others?"

At the very least, access of private information can be better contained and managed. Agree leaks (of information) happen every where, every day. But at the very least, if only a handful of people are entrusted with the information, any leakage can be traced to the source. Furthermore, if you compare the retail stores and the HQ, which one is more 'public'? When you have a piece of information lying on your desk in the office, only people within the office may see. But when you have information openly lying around in a store where the public walks around freely, then the information naturally becomes 'public info'.

"currently sales staff says customer wants to buy a submariner date 116610LV aka hulk and inform HQ. HQ staff will have to check customer prior purchase history if any, then say yay or nay. if sales staff does have the purchase history on hand and notice that customer had not purchase any not so popular model before, then sales staff can at least say why not purchase a DJ model to increase chances."

Maybe I didn't make myself clear or you're confused. If a customer requests to buy a HULK for example, whether the customer is known to the sales staff or not, whether there's information of that customer in hand (at the store) or not, the staff would still have to send the customer's request to the HQ. So my point is, if such a request must be sent to the HQ and an approval can only be given by HQ, why does the sales staff need the customer's profile readily in hand?

Unless, the HQ gives discretion to the store manager to decide whether a particular customer 'deserves' to be sold certain watch(es) and at certain discount, then yes, the customer's information must and should be readily accessible to the store manager only. At it is now, I heard the ADs are controlling the sale of popular watches very tightly.

And on the part of 're-directing' or 'counter-suggesting' the customer to buy another watch(es), it is a rather sensitive issue. I can share this with you more in-depth when we next meet.

"companies like this will enforce a "blackout" period for a sales staff who resigned not to be able to join a competitor company as a sales staff."

Yes I do know that. To a certain extent, this is one of the 'preventions' most companies are applying in certain industries. And since this is the case, shouldn't it be more logical and sensible to limit the access of customers' information and not have every sales staff in the company to see ALL CUSTOMERS' DATA FREELY?! Some 'black-out' measures can only curb so much, and not prevent totally.

Using the same example, in the past when there's no such system of customer database FREE ACCESS TO EVERYONE, if a sales staff resigns and leaves the company, he/she (at most) can reach out to those customers he/she had serviced and are still in regular contact, correct? If this sales staff is a 'star salesperson', the company would probably lose SOME customers once he/she resigns. Now, with the free access database, any sales staff can leave the company with a whole load of information accumulated over a long time, and these are not superficial information.

I just hope that nothing seriously bad will happen and people will continue to buy watches (of their choices) from the various ADs we have here.


Have a good weekend, everyone

[triton]

thanks for your insights

hope to hear from other members