Disneyland Paris fails to comply with their own Privacy Policy

Whilst staying at the Premiere Classe Hotel in Meaux, we were looking at possible places to stay. Since we wanted to go to Disneyland Paris, we were looking at how much it would cost their. On their website, they had a short survey that you could fill out to get up to 30% off your accommodation and entry into the park. However, in doing so, I am not to happy that they disclose my full name on the internet for everyone to view. I also don’t think parents would like their family name and their children’s name and age available on the internet to the public after filling out this survey.

I urgently sent this message to Disneyland Paris in which I never got a response.

Subject: Disneyland Paris Failure to comply with Privacy Policy

Hi,
I recently filled out the 5 online questionnaire to see the deals of 30% off for your room accommodation for a planned stay at Disneyland Paris.

However, after filling out the information, I have discovered that your website discloses personal information about myself, and other guests of Disneyland Paris which goes against numerous sections of your privacy policy. Once such example is this:

“This personal information is ONLY used by Disney, carefully selected third parties and the Walt Disney Company group of companies and is NEVER shared with other third parties, unless otherwise clearly stated at the time of collection or registration. Even then, it would only be shared when we have your permission to do so.
When we post information about you on our sites, (for example, if you are a competition winner), we will never disclose personally identifiable information that could let other people know where you live or exactly who you are.”

I consider “Exactly who you are” is information of first and last names

The information, I, and the public can access about me and other people are the first and last name, their children the name and age.

I consider this information as personal information, not aggregated information and that is publicly accessible without my consent.

For example, you sent me the following email http://identification.disneylandparis.com/uk/mail/index/thanks/key/de2343b160b21baa94e35e18dbf173e3

However, in the email, you have this unique link for me: http://identification.disneylandparis.com/uk/index/pdf/qualif/1431XXX/disneyland.pdf

This page contains personal information of my full name.

However, by changing the number in the URL, you can find out the name and children of other people who are also staying at Disneyland Paris, or who are interested in staying here. For example, if change the number to a random number to have this URL http://identification.disneylandparis.com/uk/index/pdf/qualif/1431XXX/disneyland.pdf, and can see the persons last name, and know they have 2 children, 10 and 4 years old.

As I am very concerned about my privacy, I appreciate it if my full name could removed from your website and publicly accessible by the world ASAP.

Please reply back to me regarding this matter.

Regards,
Jack

For this post, I randomised the links to protect my identity, however, even using XXX in the URL, it still shows a family and their children’s name. And for the first link I posted, it shows a really unfriendly error message.