Reference no: EM132529438

You work for a tourism board at a top destination within the United States that among other tasks, sends information out to potential visitors, performs direct mailing campaigns, solicits newsletter sign ups, and helps drive economic growth by attracting visitors to the destination. The direct mailing team for your organization accomplishes this through email blasts, mailing flyers, and texting campaigns. The address list the organization has in place is seen as a strategic advantage, as it has extensive information about potential and repeat visitors, and has been compiled from various sources over the years.

The organization has recently developed a mobile application and hopes to leverage mobile devices and tablets to help make obtaining information easier for the visitors, as well as collecting more information on patterns of consumer behavior. Since the mobile application will have access to a great deal of personal information belonging to the users (email address, GPS data, phone number, etc.), it has been suggested this information be automatically uploaded to the direct mailing database, and signing them up for various promotional efforts and communications. It had also been suggested there may be an opportunity for the marketing department to partner with the local theme parks and attractions within the area, sharing the databases from each to form one large database to reach more users.

The idea has been presented to the organization's legal counsel for review, as the IT team is fairly certain the end user agreement for the mobile application states the collected information can be reused and sold as needed. The public relations team has taken a different position and feels there is potential for backlash in social media as well as other public outcries should the data be sold to or shared with other organizations, and questions whether the data should even be stored since there are additional pieces of data being collected that have no purposeful use for the tourism board. They have asked for your input on the matter.

The questions they are presenting you with include:

1. What are the general practices surrounding data collection?

2. How can privacy violations occur?

3. Are there any risks, issues, or problems associated with collecting and storing data that isn't needed now, in the event it may be needed in the future? What information do other organizations collect?

4. The end user agreement says we CAN collect, reuse, and sell data as needed, but does that mean we should? Is there a level of ethical data collection and storage that we should be considering?