The General Data Protection Regulation or GDPR is a EU led piece of legislation designed to standardise the protections available to individuals regarding their personal data. GDPR is often misquoted and incorrectly viewed as being an impediment to businesses of all sizes, limiting what they can do with customer data and how they can conduct their business. While this may be true for those businesses that operate on the fringes of what was legal or engage in predatory practices, for the vast majority of businesses it simply formalises many of the processes that they would’ve engaged in regarding their customer data.
At the core of GDPR is the concept of user consent. This doesn’t just mean ticking a quick box, but rather that users/ customers are freely giving specific and informed consent to how their data will be used. For most operators in the Irish tourism sector this is very straightforward, as most of their customers will engage with the business in person at some point meaning that questions can be answered, and most of the data gathered is simple pieces of personal information well within the scope of the act as necessary for the conduct of business.
Where tourism and hospitality businesses need to be most careful is regarding how they use that data for marketing purposes. If a business wants to use data they’ve gathered from their customers for marketing purposes they must get their consent for that, separate from the consent for the data needed to conduct their primary business. They also need to have a clear system with all data to remove consent and remove customer data from the system at the request of the customer.
GDPR also has the benefit of making it extremely clear what your obligations are, unlike some of the older data protection rules. This makes compliance relatively straightforward and perhaps more importantly, due to high quality enforcements, allows you to build trust in your brand through high data protection standards.
-- Aaron Bowman
Comments
• Ask consent from users that they will be using their data
• Audit previous contact lists that might have not consented to their data being used
• Appoint a data protection officer
Source: (Altexsoft, 2018)
-Jerli Padios