Q: How quickly will regulators levy major fines if a hotel or hospitality-related business is not GDPR compliant?
A: Before a fine is levied, an offence must be established. This may be due to an incident impacting personal data of an employee or a guest or a defined regulatory audit. Hence, establishing an offence in this matter would require evidencing several criteria, performing audits, assessing the knowledge of the offender to the offence, i.e. establishing intent and the level of due diligence the offender had met. Taking all factors into consideration, previous court rulings in the EU have taken time to give a ruling in data protection and privacy matters. Article 83 states: "In any event, the fines imposed shall be effective, proportionate and dissuasive." This will be case dependent and influenced by the legal proceedings in the jurisdiction in question as defined by the regulatory body.
A: In my opinion, not only will GDPR regulation significantly help future innovation, but it will also establish an absolute maximum of the necessary level of "trust" required to have a flourishing use of any future innovation.
Q: Will the GDPR regulation help or hinder my hotel's global marketing efforts?
A: Understanding that establishing "trust" is the cornerstone of any successful marketing effort, there is nothing better than upholding a basic "undeclared human right" in any company's effort to commercialize their product. Adapting to new processes and marketing efforts will be necessary, but it's also addressing an important need in the minds of most consumers.
Q: What do hotels need to do to maintain their opt-in-subscriptions? What will this mean to customer loyalty and bottom line revenues for the future?
A: It is helpful if businesses/hotels recognize that personal data is not a free commodity and there is an ownership title associated with the personal data to the data subject. Safeguarding this is all GDPR requires. Incentives, or any form of compensatory measures of interest to the data subject, may result in maintaining a higher customer loyalty. It is important to note, however, that customer loyalty and bottom line revenues were only impacted for businesses/hotels with a model to use a "free commodity = personal data" to generate income. As we all know, in a free economy, this itself is considered an unfair distribution of resources and a disadvantage for a healthy economy and it is not tolerated in many countries.
Q: What happens if there is a third-party breach? For example, a hotel uses WhatsApp to stay connected to their employees. What happens to that hotel if WhatsApp is not compliant? Is it liable for the breach or is WhatsApp solely responsible?
A: One of the points that GDPR addresses clearly is the responsibility of each party in the processing life cycle. In this respect, although GDPR has a "pass through" approach, it is the responsibility of the controller to be transparent towards the data subject and manage such risks with the processors and the involved third parties. For example, having a data processing agreement in place between the involved entities, performing risk assessments and taking other risk mitigating measures are the norm in managing this type of risk. In the example stated, since the hotel is considered as the controller, certainly the hotel will be audited to establish whether it had performed its due diligence towards managing this risk or not. Basic assumption is that the data subject was informed and consented to in the first place to allow WhatsApp to have possession of their personal data. If not, clearly the hotel will be held liable in a first instance.
Q: Understanding that GDPR is not a one-off compliance effort (like the rush to fix the Y2K Millennium Bug) and continuous changes will need to be made, is there a grace period on updates? Will there be a global schedule specifying when updates need to be made? How does a company know if it's up-to-date with all the recent regulations?
A: GDPR is the law and became enforceable on May 25th, 2018. The grace period for meeting GDPR requirements started in April 2016, with a 2-year period allowed for compliance. Although, it has happened in the past that regulators have "extended" enforceability timelines, to date, I am not aware of any extension periods for the start of enforcement of GDPR.
Beekeeper's mission is to transform the way 2 billion frontline employees work with a mobile-first communication platform that reaches every shift, location, and language through real-time one-on-one and group messaging. Dedicated streams deliver important operational communications to your entire workforce or specific subgroups. Managers keep staff productive and turnover low by automating workflows and messaging to their teams, while leveraging an analytics dashboard to measure engagement. Quick to implement and even easier to use, Beekeeper integrates with the existing operational systems you rely on and makes them accessible to everyone in one central access point. Learn more at beekeeper.io. The company is based in Zurich and San Francisco and supports users in more than 130 countries. Clients include Heathrow Airport, Seaboard Foods, and Marriott.