Evan Schuman's StorefrontBacktalk

Now, this is not what either Euclid or Nordstrom are doing. That’s fine. Except that Euclid is collecting and storing the raw MAC address and traffic data. What can it do with it? The Nordstrom privacy policy doesn’t explicitly say. How does Euclid protect the data? How does the vendor store it? How and when does it purge that data? Can Euclid aggregate it and sell the same data to third parties? (As the initial story noted, Euclid says its policies do not permit such sales. But policies can be changed, and there is nothing in the law that would restrict the vendor from doing so.) When I walk past a Euclid sensor, say a Starbucks (NASDAQ:SBUX) in Denver, can that Starbucks know I was at a Nordstrom in Dallas a week earlier? Can the vendor know I was at the shoe department? It’s not so simple to say, “we don’t share this information” or “it’s not personal information.”

Is it profitable?
Footfall data is supposedly useful to retailers, because they can use this anonymized and aggregated data to determine things like store locations, product placements, and where and when customers go. So footfall data is clearly profitable for Euclid, and it may ultimately be profitable for Nordstrom or other retailers.

Is it Wise?
The final question is whether this is a good idea. Nordstrom made good strides by doing two things. Apparently, the retailer placed notices outside its stores, offering some information about the policy, and provided the quoted privacy policy with more information. Euclid’s Web site provides a way for users to opt out of the data collection if they provide their MAC address to Euclid and type in a Captcha (those annoying letters and numbers to prevent fraud). It’s not very difficult to do, but it is a pain.

At the end of the day, anytime a retailer is collecting, storing, using, selling, transferring or analyzing data about a customer, that retailer needs to put itself in the shoes of its customers (in Nordstrom’s case, very nice shoes) and ask, “what would I want to know about this?” As a retailer, you want trust, which comes from openness, honestly and, potentially, an “opt in” rather than an “opt out.” And ask hard questions of the vendors, too. Find out how they will use the information collected, whether they will sell it and secure it, and how they will delete it. And put that in your privacy statement, too. Another question to ask is, “if my customers knew I was doing this, would they be upset?” If the answer to that question is “yes,” then maybe you should rethink the policy. If the answer is “no,” then hey, just tell them.

If you disagree with me, I’ll see you in court, buddy. If you agree with me, however, I would love to hear from you.