18 October 2021 - Virtual
10 November 2021, Virtual
London, UK - November 2021
Companies with European Union citizens among their workforce
have until May 2018 to ensure their travel programs comply with a new data protection
regime that punishes transgressors more harshly than previous legislation. The General
Data Protection Regulation requires businesses to take responsibility for understanding
where personal data about their employees is held and verifying that the information
is protected in line with European privacy standards, which are among the strictest
in the world.
"Wherever data of a person from the EU is processed, it
will need to comply," said Marta Dunphy-Moriel, an associate with London-based
law firm Fieldfisher. "One of the key principles GDPR puts in place is accountability.
Travel managers need to know what is happening to their data at every stage. That
was previously best practice, but it's now a statutory requirement." Putting
heads in the sand is therefore "not an option" for travel managers, Dunphy-Moriel
continued. "It is better to get started now rather than wait until you are
exposed to a massive fine." Companies can be penalized up to 4 percent of their
global revenue for breaching the regulation.
What's Different About
According to Soeren Schoedt—managing director of Copenhagen-based
purchasing consortium TravelpoolEurope, which manages travel for 30-plus companies
in 27 countries—"The rules are more or less the same, but what is new is that
they will be policed more and businesses will face higher fines for noncompliance.
We must show we have done everything we can."
The rules to which Schoedt refers govern issues like how data
is secured, how long it is retained, who has access to it and, in some cases, whether
the data subjects, the travelers, have consented for their data to be held and processed.
Tracking and securing traveler data is particularly difficult because there is so
much of it and it is held by so many different vendors. On the other hand, said
Schoedt, he found only two circumstances where traveler records include so-called
"sensitive" personal data that demands the very highest levels of protection.
One is airline meal selections, which may reveal a passenger's ethnicity. The other
is freeform notes added to a traveler profile that indicate a health issue that
requires special treatment by the supplier—use of a wheelchair, for example.
Under European data protection principles, the greatest responsibility
for ensuring data protection compliance lies with the data "controller,"
which makes decisions and gives orders about how to handle data. Where companies
have a written contract with a travel management company, the TMC is usually considered
to be the controller. "GDPR provides specific requirements for companies that
control or process personal information," said Carlson Wagonlit Travel global
privacy officer Samantha Simms. "TMCs will now need to demonstrate accountability
for the personal information. Ultimately, responsibility to manage and protect personal
data rests with the TMC."
However, Dieter Koeve, senior partner with Koeve + Koeve, the
law firm that advises German travel management association VDR, takes a more nuanced
view. He believes GDPR implicitly prevents clients from hiding behind their nominated
data controllers if laws are breached. "Companies need to be more aware of
what is happening to their employees' data," said Koeve. You can't just assume
that Lufthansa and United Airlines will handle your data correctly. We have a new
age regarding data protection in which you are responsible, even if you are not
the data controller."
Getting Ready for GDPR
Almost all travel managers lack competence to handle this issue
alone. They need to talk to their legal teams and, above all, their company data
protection officers; certain businesses—such as those that do large-scale, systematic
monitoring of individuals—are obliged to appoint data protection officers under
the GDPR. Travel managers should approach these officers, said Dunphy-Moriel, and
tell them: "This is what we process. This is what we need it for. This is who
we share it with. These are our contracts. Are there any clauses we need to renegotiate
and any other changes we need to make?" Schoedt has already been through that
process with his company's lawyers. They asked him to group the different kinds
of suppliers to which personal data is sent. They totaled 17 groups, such as airlines,
credit card issuers and global distribution systems.
Once TravelpoolEurope understood its data flow better, it introduced
a series of compliance measures. It beefed up IT security, ensuring encryption of
all personal data. It also created two templates to address consent issues. It has
inserted one into its travel policies to explain how travel suppliers deploy employee
data. The other is a page with similar information for the website that the travelers
use. The page pops up the first time travelers log on, and the website asks them
to approve it.
Issues to Watch
BCG head of global travel Gehan Colliander has started working
through the ramifications of GDPR with her firm's legal team. In her view, travel
managers need to give three matters special attention:
Profiling. Normal data can usually be processed without
consent, but "for sensitive data, you need explicit consent and additional
security measures," said Dunphy-Moriel. "Or you could build a case that
the data is not sensitive. You need to think about it and have a position."
However, while traveler profiling based on ethinicity or other
sensitive data is clearly a no-no, Colliander's discussions with her company's lawyers
raised uncertainties about whether any kind of profile-based marketing is compliant
with the regulation. "Is it legal to push certain fares to a traveler depending
on their travel profile?" asks Colliander, who also is president of GBTA Europe.
"Marketing based on profiling is not illegal so long as there is consent, but
how suppliers obtain that consent is unclear. Will suppliers be seeking to obtain
the consent of every traveler, and, if so, why are they doing that when they should
be directing marketing to the corporate client instead? Absolutely there are question
marks over supplier marketing. Targeted marketing does appear in the directive.
There are restrictions on data processing and decisions based on that processing,
to the extent that this could be considered profiling," said Colliander.
This gray area is exactly what persuaded U.K. TMC Norad Travel
Group to pause its consideration of introducing chatbot booking technology. "GDPR
is all about explicit consent and an individual's right and a legal basis for processing
that data," said CEO Mick Gibbs. "Who owns the artificial intelligence
inside a robot?"
Vendor Certification. Suppliers need to confirm they are
compliant with GDPR, ensuring, for example, that they will provide immediate notification
in the event of a breach or that they will delete data as soon as they are notified
an employee no longer works for a client company. Colliander's legal team has advised
her that suppliers must sign a contractual assurance that they are compliant with
BCG's 15-page data processing agreement.
The problem, according to Schoedt, is that "some vendors
are prepared and some are not. In the EU, they are knowledgeable about the situation
and have timetabled their preparations. Outside the EU, they don't know how to address
it. We had a contract with a U.S.-based car rental company that went back and forth
with the lawyers for months because they didn't understand what we were asking for."
Plenty of time is needed, therefore, to ensure all suppliers
will be compliant by the May 2018 deadline. An example of just how much work that
requires: "Now that we are a year away from implementation, we have a project
team working on ensuring compliance with the specific details of GDPR," said
CWT's Simms. "Key areas currently being addressed include an updated privacy
impact assessment framework; updating our privacy notices and mechanisms for obtaining
consent; refreshing our approach to handling questions from travelers on access,
correction and deletion of information; and formally appointing a data protection
Crossborder Data Transfer. Only a small number of countries
and territories outside the European Economic Area—which encompasses the EU, Iceland,
Norway and Liechtenstein—are deemed by the EU to offer adequate data protection:
Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel,
Jersey, New Zealand, Switzerland and Uruguay. The GDPR permits data transfer to
countries with inadequate protection so long as approved mitigating measures are
One of the most common mitigating actions, the one adopted by
TravelpoolEurope, is to draft model contractual clauses, also known as standard
contractual clauses, that leave a supplier in breach of contract if it does not
protect transferred data to the same standard as required within the EU. Another
option is Binding Corporate Rules in which a multinational company provides evidence
to an EU member state's data protection authority that it has taken steps to ensure
For the U.S. specifically, there is also the Privacy Shield framework,
although some European companies are becoming nervous about transferring employee
data across the Atlantic and instead are insisting that U.S. service providers keep
information within the EU.
Though these principles seem straightforward, Colliander
and her legal team are uncovering questions around which data requires compliant
treatment for crossborder transfer. "Treatment of non-EU citizens' data is
still not clear," she said.
South African Airways' board has voted to put the carrier into a "business rescue" bankruptcy protection program to save it from collapse. ...
Corporates could lose their ability to reclaim value-added tax on hotel and other bookings in Germany after the country's parliament last week approved...
U.S. Customs and Border Protection last week introduced two features to the Electronic System for Travel Authorization, the online portal through which...