After the fateful May 25, and with some more perspective, we observe disparity of strategies and tactics that hotels are using to comply with the new data protection regulation. We will highlight some aspects that we are finding, and that we believe positive to discuss approaches in an open and constructive way. We use the question / answer format that we believe facilitates understanding and analysis.
Is it ALWAYS necessary to ask for the clients consent of the client?
Not always. The RGPD specifies in Article 6.1, when the processing of personal data is lawful. Of course, the treatment is lawful when the client gives you consent, which is the assumption 6.1. a). But in many cases, the consent of the interested party is not necessary. Specifically, there are three reasons why a hotel can treat or transfer to third parties personal data of its clients without their consent:
1. For the execution of the accommodation contract. It is understood that, without the identification and contact of the client it is not possible to lodge the client, nor give him information about the hotel and the destination (which, as a counseling service, is included in the broader hospitality service). This falls within the assumption 6.1. b) of the RGPD.
2. To offer hotel services, as specified in the course 6.1. f) of the RGPD when "processing is necessary for the purposes of the legitimate interests pursued by the controller".
3. The “processing is necessary for compliance with a legal obligation to which the controller is subject” (as in the case of communication of identification of the guest to the police), as indicated in the case 6.1. c).
To give the service of "wake up call" you have to register the time you want to get up, but it is not necessary to ask the client to give you express consent for us to write it down. Let's not go crazy.
What should I change in my customer opinion forms?
Gathering the opinion about a service provided is part of the service and is a legitimate interest of the hotel, and as service provider you have the right to request your client´s opinion, in case you already have their contact information. There are hotels that do not request the opinion if the users have not accepted the sending of communications in the "welcome form" when doing the check-in. We believe that this is a very restrictive vision of the regulation.
When you collect feedback, via a form, to an identified client, you must request consent for the purpose of the treatment: the analysis of the service provided. You probably are already doing this in your forms: a checkbox, at the end of your questionnaire, requests the affirmative and clear (not tacit) consent to the use of their opinions. and a link to the details of the treatment that you are doing with the data collected.
Should we mention the data processors in our information to?
It is not necessary, if it's about that: data processors. There are several and of different type of companies (PMS, booking engine, channel managers, CRM) that use the data of your client that , provide their data processing services ALWAYS on your behalf.
A very different thing is that you transfer your customers data to third parties. For example, if you use TripAdvisor's Review Express service, to send forms for that comparator / metasearch engine, make sure that you have the consent of your clients to transfer their data to TripAdvisor, otherwise it would constitute a personal data breach., since you would be transferring personal data of your clients to TripAdvisor without the explicit consent of your client.
If I have the customer data provided by a channel (Travel Agencies, Tour Operators, Events Organizer, …), can I get in touch with the client?
The channel gives you the customer data for the purpose of the provision of your service, therefore, it is lawful to send a pre-stay communication, where you include information about the hotel or destination while offering other related services that may be of interest to your client. This does not require an express consent.
Do you agree with our interpretations? Do you want to make a comment?
In our next post we will address issues such as: what is the best time to request acceptance to be able to send commercial information later? or what do I have to include in the mail when sending a communication?