hi welcome to another episode from our GDPR our IQ thought leadership series
here we'll be discussing how to prepare your hotel for GDPR are the e use general
data protection regulation GDPR are as shown a bright spotlight on the
vulnerabilities in hotel's GDPR our compliance for hotels requires a
detailed assessment of hotels business processes supplier relationships
technology partnerships and personal data protection procedures the
regulation strengthens the rights of EU citizens and residents while placing
responsibility for compliance on the individual Hotel or hotel group the data
controller hotels are awash with personal data and remain a favorite
target of fraudsters due to their numerous customers touch points
customers make online reservations present passports payment cards at the
front desk and sign up for loyalty programs link to credit cards for hotels
offering a wider array of guest services the threat is multiplied exposing the
interconnection of business entities within a hotel and external suppliers a
2017 survey by strategic payment consulting firm
Edgard Dunn & Company found that most medium and large hotel brands operate
with a highly fragmented or poorly defined data management system some 57
percent of respondents admitted that they had not started gdpr implementation
while the findings also revealed a huge lack of GDPR are planning or
implementation amongst medium and smaller hotels those with less than
2,500 rooms
senior management must understand the main issues and risks involved
everything in gdpr is driven by one or more of the seven core principles so it
pays to understand them as you take steps towards gdpr compliance for hotels
article 5.1 states that personal data shall be processed lawfully fairly and
transparently collected for a specific purpose be limited to what is necessary
be accurate kept for no longer than is necessary and be processed using
appropriate security measures article 5.2 emphasizes accountability stating
that the data controller shall be responsible for and be able to
demonstrate compliance with the above principles key stakeholders must buy
into this standard of data privacy as the new norm and ensure an
implementation plan is formed and executed the crucial early step provides
the foundation for gbbr compliance the regulations requirements cannot be met
without answering key questions such as what personal data does your
organization hold how did you get it what do you do with it and how long is
it stored for hotels are bombarded with information from numerous sources
including their own booking engine point-of-sale systems third-party
booking systems email messages telephone calls and even written notes all these
data inflows and outflows must be captured and a data asset register or
inventory created a common misconception about the gdpr
is that the only option available to marketers is consent which must be
freely given specific informed and unambiguous in many cases however
legitimate interest should be preferred due to its flexibility using legitimate
interest requires a balancing assessment where the interests of the business are
weighed against the rights of the individual once passed it can be used as
the lawful basis for both b2c and b2b marketing
under the privacy and electronic communications regulations or PE CR it's
also possible to carry out b2c direct marketing where there an existing
relationship with a customer using the soft top end they offer the chance for
hotel marketing departments to get creative and remind customers of brand
value and what they'd be missing out on thanks for watching the GDPR for hotels
GDPR for hotels video subscribe to our channel for more on how to tackle the EU GDPR
and feel free to watch more videos from our GDPR IQ series here don't forget to
check out our website or follow us on our social channels thanks again and
looking forward to seeing you