After four years of deliberation, the General Data Protection Regulation (GDPR) was officially adopted by the European Union in 2016 and officially rolled out on 25th May 2018.
The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens’ data privacy and to reshape the way organizations across the region approach data privacy.
A large number of Kenyan Travel Agents will be impacted by the GDPR. The travel industry in general holds huge amounts of vulnerable personal information such as basic information, passports, identification cards, contacts, location, cultural and social identity, photos, bank accounts (financial information), health information and even people’s income records.
These new privacy laws have attracted mixed reactions from travel agents in the country.
Ms. Julie Dabaly Scott, Managing Director at Carlson Wagonlit Travel welcomes the new rules terming the move good in order to respect clients’ data. “It will for sure give us extra work, before we add or send mails to our client we will need to get permission and approval”.
After the roll out of the GDPR, travel agents have had to communicate with their clients to update their information or unsubscribe themselves from receiving communications.
On the other hand, the process of compliance may be a major headache for some travel agents depending on their relationship with EU clients.
Mr. Patrick Kamanga, Managing Director at Deans Travel Centre Ltd states that it will take time for travel agents to clean up operations for their EU customers. “I sent out my mail to all our clients and I did have one client based in UK requesting for her details to be removed. We had to delete all records of her passport, Airline cards, cell phone contacts, emails on newsletters etc. yet she selects still to be our client, my dilemma is how to operate her reservation?”
The GDPR does not only affect firms based in EU but worldwide if they collect and use personal data of EU residents. This will require travel agents to assess whether they currently comply with the new rules and restructure how they do business in order to be compliant.
Unfortunately, currently in Kenya we do not have any data privacy laws in place. Mr. Sam Kiragu a financial regulatory compliance professional advices travel agents to protect themselves from possible legal issues by conducting gap analysis if the agency has internal data privacy policies and procedures then deal with the identified gaps to make sure they are GDPR compliant.
Breaching of GDPR attracts a penalty of up to 4% of annual global turnover of EUR 20 Million (KES.2.4 billion) whichever is greater. This is the maximum fine that can be imposed for the most serious violations.
There is a tiered approach to fines e.g;
- A company can be fined 2% for not having their records in order(article 28)
- Not notifying the supervising authority and data subject about a breach or not conducting impact assessment.
Altexsoft gives practical recommendations that travel agents can prepare for this regulations;
- Obtain explicit consent for each specific data use case
- Audit their current data and its purpose
- Review contracts about personal data exchange with partners and clients
- Be ready to present data, explain the purposes of collection and delete it
- Appoint a data protection officer in charge of data processing and security
- Enable data breach notifications to ensure effective reaction
- Provide data portability
The General Data Protection Regulation will affect travel agents in one way or another but may end up being a positive issue rather than a negative one. Majorly because clients who give consent for the use of their data will feel more safe and secure hence enhancing a trustworthy relationship between the client and the travel agency.
Also when clients update their information when giving consent they may add more information which may lead to delivery of more personalised travel packages from the travel agents.
By Kenya Association of Travel AgentsBack to news articles