Hilton has changed their privacy policy in a positive direction, but hasn't updated what they can do with HHonors information.

More at;
http://weblog.infoworld.com/foster/2004/07/06.html#a124

An excerpt:
"Indeed, not only was there a clear contrast between Hilton and Holiday Inns/Intercontinental, but readers also identified Choice, Marriott, Sheraton, and Westin Hotels as all having reasonable privacy policies in comparison to the Hilton brands. And they didn't just report this to me - they reported it to Hilton, too.

"I have directed my company travel agent to NEVER place me in another Hilton-owned hotel until I receive written notice that you have changed your policy to protect my private information," one reader quoted his letter to Hilton. "I hope you understand that I, and my friends, family, and business associates all consider identity fraud a serious problem, and we are intelligent enough to recognize that your privacy statement is contrary to our interests, contrary to good business principles, and totally unacceptable. I have enjoyed the Hiltons and Embassy Suites I have stayed at. I am sad that I will stay there no more."

Some readers also said they were asking their corporate travel departments to re-evaluate their relationship with Hilton. "These policies are completely over the top," wrote a reader who was one of several pointing out that the terms for Hilton's HHonors frequent visitor program also contain some very dubious privacy provisions. "My department alone spends millions with Hilton every year, and there is no way we will tolerate this if Hilton doesn't change its ways very quickly."

One way or another, it would appear Hilton got the message. On July 1st Hilton and its subsidiaries posted a new privacy policy, separate from its website usage agreement and much more in line with the privacy policies of the other hotel chains. And, while Hilton's revised website usage agreement still has a decidedly UCITA-like aspect in its concept of contract formation, at least the all-your-informations-are-belonging-to-us stuff has been removed. (At this point, however, the dubious HHonors privacy language remains as it was.)"