By Karen Blotnicky SMALL BUSINESS

ALL CANADIAN businesses will have a New Year's gift in the form of privacy legislation. Most would argue that the time has come for such legislation.

Many consumers, some of whom are also entrepreneurs, know first-hand the frustration and insecurity that can come from anonymous organizations using our personal information.

So what does the privacy legislation mean to the small-business owner?

Your company must meet certain requirements if you are collecting personal information from customers, or potential customers, and using it in any way. These rules apply to both online and offline information gathering.

Businesses use a variety of techniques to gather such data.

Customers and prospects need to be motivated to hand over personal information. They are enticed to register for buyers' clubs, loyalty programs, newsletters or other incentives.

Other uses for personal information include compiling new mailing lists, e-mail soliciting and selling the information to third parties for their use.

You may have to contact all customers in your database to get their written permission to use their information for such purposes. You also have to give each one the option of opting out of such activities. For example, a customer may agree to receive e-mail newsletters but opt out of letting you share their information with third-party vendors who may sell similar or complementary products.

Under the new law, consumers must be able to review the information you have about them, upon request. This means that you need to make staff available to cover such requests or create an online function that allows access.

The new legislation requires that your firm spell out its privacy policy. You must indicate what information you are collecting, why, and how it will be used. You must also give the customer details of who has access to the data and how long you will hold on to it. These requirements go beyond the posted privacy policy of most companies.

How long you keep the data is important. You must destroy it when you have finished using it for its intended purpose.

If you wish to continue to use it for a longer period or for another purpose, it is essential to contact the individuals to get their permission and update the information.

The new law finds your firm is responsible for protecting the information from theft. This means you have to use reasonable security methods that may include, but need not be limited to, Internet firewalls, locking up sensitive documents or using burglar alarms.

These rules apply to home-based businesses as well.

Your firm must allow for consumer protection within its policy by having a clear method of managing complaints. This includes informing the complainant of his or her rights and investigating any complaint made against your business.

People must also be informed that if they are not satisfied with your firm's internal handling of the complaint, they may approach other bodies for assistance, including the Privacy Commissioner of Canada.

You must appoint a member of your staff as a privacy officer, who must ensure that all regulations are being met and must communicate the company's privacy policy to all.

Ultimately, the privacy officer is responsible for confirming to authorities that the organization is respecting the legislation.

The privacy law affects businesses of all sizes. But such legislation is essential to help legitimate businesses compete using a variety of communications technologies. It can also enhance your firm's image while increasing overall customer service.

Karen Blotnicky is president of TMC The Marketing Clinic and a professor at Mount Saint Vincent University.

kblotnicky@herald.ns.ca