On-site tracking refers to the practice of scanning attendees’ badges manually (e.g., bar code) or automatically (e.g., RFID chip in badges read at doorways). Organizers track this information for various reasons, such as to award credit for attending various panels (e.g., continuing education verification) or for their own analytics (e.g., to track session attendance for future room allocation or to determine future programming).
- If the organizer intends to sell the data to third parties, the organizer will need to provide a “Do Not Sell my Information” link in their online privacy notice.
- An organizer may receive a request from an attendee for access to their information. In response to such a request, they may need to disclose all of the data collected about a particular attendee (e.g., locations tracked, activities recorded).
- An organizer may receive a request from an attendee to delete their information. In response to such a request, they may need to have the ability to selectively delete information about the attendee, or to explain to the attendee why such information is not required to be deleted. For example, if the information is being collected for a purpose other than marketing – such as security at the conference – the organizer may be able to deny the request on those grounds.
- If the organizer transfers the personal information to a third party, and allows that third party to use it for their own purposes (e.g., to directly market to California residents), the organizer would have to include a “Do Not Sell My Information” link on their internet home page1 and within any only privacy policies.2 Further, the organizer cannot discriminate against any attendees who opt not to have their information sold by offering them fewer benefits or charging higher prices.3