Travel firms warned they must prepare for new data protection rules

ABTA is urging travel companies to begin preparing for the General Data Protection Regulation, which comes into force in less than four months.

From 25 May, the GDPR will affect how businesses collect, use, manage and store their customers’ and employees’ personal data.

Non-compliance with the new laws could result in fines of up to £17,000 or 4% of annual turnover, as well as having other business impacts such a loss of goodwill, employee trust and negative publicity, ABTA is warning.

"Many travel companies will already have processes and systems in place that go a long way towards compliance with the new rules. However, some things will change," it said.

The GDPR will require businesses to be more accountable, and have clearer and more robust processes in place when handling personal data relating to customers, staff and others whose personal data they deal with.

"This is particularly important for the travel industry where there are often multiple uses for data and multiple channels for collecting it too.," added ABTA.

"Similarly, travel companies collect and share customer information with suppliers, often overseas, for booking purposes, so it’s vital that businesses review the contracts they have in place with third-party suppliers."

The Association is urging companies to perform a review of the data they hold and how they handle it, including how it is stored securely, and to make sure they understand what personal data they allowed to process.

Businesses must also update their privacy statements in order to be completely transparent with customers about how they use their data. They need to clearly inform individuals about the purposes of processing their data and what will happen to their data, and bear in mind all the additional details required under the GDPR.

If they haven’t already done so, businesses need to get started with the following three steps as soon as possible: perform a Review, understand the Requirements and collate Relevant records

ABTA director of legal affairs Simon Bunce said: "The GDPR is an evolution in the way that data is protected, rather than a revolution.

"The biggest priority now is knowing what GDPR means for their businesses and having the organisational capacity to start making changes in time for its introduction in May.

"We can expect everyone to demand higher levels of security and compliance following the introduction of the law and any perceived weakness in this area will damage trust.

"ABTA has been helping members prepare for the GDPR since Autumn 2016, raising awareness at regional meetings, developing dedicated events and creating materials which explain what steps they should be taking.

"We have also been pointing people to the ICO’s ’12 steps to take’ guidance document."

Rhys Griffiths, partner and head of travel regulation at Fieldfisher, said: "One new key principle in the GDPR is accountability – it’s no longer enough to comply with data protection laws, businesses must demonstrate how they meet the new regulation.

"It’s not too late to make these changes to help your business be compliant with the GDPR and those which have processes and policies in place to adhere with the Data Protection Act will find that there is a lot of existing resource which can be re-utilised for GDPR compliance purposes. It’s also important to remember it will be an ongoing process, rather than a race to May 25."