The price you’re paying for loyalty

INTIMATE data about your shopping habits collected by Coles and Woolworths is being sent all over the place, a new report warns.

How much information are you giving away? Picture: Eugene Hyland

INTIMATE data about your shopping habits collected by Coles and Woolworths is being sent overseas to countries as far flung as South Africa and the Philippines.

Australia’s privacy tzar has issued a warning to shoppers following an investigation into Coles Flybuys and Woolworths Rewards programs.

While the privacy check-ups did not find any mishandling of customers’ personal information, Privacy Commissioner Timothy Pilgrim said there was “no such thing as a free lunch, nor a free flight”.

The review found that while Coles and Woolworths send user data overseas, both rewards programs make their data sharing practices clear in their privacy policies in accordance with the Privacy Act.

Coles outsources some functions to companies in South Africa, the Philippines and the US, while Woolworths’ contractors include a contact centre New Zealand and a cloud service provider in the US.

“While it’s encouraging to see that Coles’ Flybuys and Woolworths Rewards each had appropriate privacy notices that were consistent with their practices, it’s important that all Australians understand the bargain we strike with a retailer when we join a loyalty program,” Mr Pilgrim said.

“There’s no such thing as a free lunch, nor a free flight. The data that loyalty programs collect is valuable, and personal. So in this case, there is a price for the rewards from these programs.”

While the personal details collected might seem insignificant on their own, when merged together “they can paint a picture of who we are, what we do and how we behave”, he said.

“This information is worth a lot to organisations. So it’s important that we understand the terms of the programs we join — especially what privacy protections they include.

“So I’d ask Australians to think about how many loyalty cards they have right now, and ask themselves if they know what can happen to the personal information they have handed over to get the card.”

Mr Pilgrim recommended shoppers read the card issuer’s privacy policy before signing up to any rewards scheme.

HOW DOES WOOLWORTHS USE MY DATA?

• Held in central systems managed and maintained by Woolworths. A limited number of people within Woolworths Rewards have access to the data.

• Primarily used to analyse past purchasing behaviour in order to determine which products and offers are most relevant for members.

• Analysis uses de-identified information but includes info like basket contents, store location, register number, date, time and any offers used by the customer.

• Some analysis outsourced to part-owned Quantium. Quantium uses Customer Reference Numbers which it cannot link back to an individual’s personal information.

• Woolworths Rewards outsources some functions to overseas operators which include a contact centre located in New Zealand and a cloud service provider is located in the US.

HOW DOES COLES USE MY DATA?

• Access to data limited to the Flybuys division within Coles and further restricted within this division, with only one team having access to identifiable personal information.

• Data analysis conducted internally by a separate analytic area which has a restricted view into the Flybuys system and only sees member numbers, transactional data and points balance.

• Primarily used to conduct targeted marketing campaigns. Flybuys analyses the data to identify purchasing patterns and deliver relevant campaigns to members.

• Flybuys conducts analytics on behalf of partner entities. Coles says it does not attempt to build profiles about individual customers but keeps a record of campaigns sent to avoid repetition.

• Flybuys outsources some functions to overseas operators located in South Africa, the Philippines and the US.

Source: Office of the Australian Information Commissioner

[e-mail]