18
| Hospitality Today | Feb / March 2017
This is a complex task , so where do you start ?
The first task must be : to define the hotel ’ s core principles with respect to the guest data as it relates to GDPR . This will define the way forward , and may require a complete change of mind-set , since current industry thinking is that guest data belongs to the hotel - and not the guest . The second task must be : to define the hotel ’ s guidelines for collecting and managing PII data . The third task must be : to establish a code of conduct for the hotel and all its staff . And finally : the hotel must define audit questions that enable it to self-regulate and audit itself against its declared ambitions . Only when this is achieved can the hotel begin to address the IT security and personnel challenges .
The output from all this hard work is likely to be much the same for most hotels , and industry organisations such as Hotel Technology Next Generation ( HTNG ) are working on a core set of principles for the industry . Once completed , an audit of the hotel is likely to address such questions as :
Personnel Challenges
Is guest data used for the purposes it was specifically gathered for ? Do you ensure safeguarding guest data is the responsibility of every member of the organisation ? Are policies and procedures to best protect guest data understood by relevant staff ? Are data security issues addressed in accordance with GDPR ? Do you adequately train and instruct employees to follow procedures for protecting guest data ?
Website challenges
Does the website publish a policy where guests are asked to ‘ opt-in ’ and to provide their consent to use data for purposes other than the primary business needs ? Is this information available in clear language , and easily accessible ? Can guests remove any data that is no longer required ? Are different policies applied to each jurisdiction the hotel operates in ? Can guests easily request corrections to their information , and are they informed on the status of requested changes ? Do you communicate how long guest data is kept , and do you remove data that is no longer required ?