In the past couple of days I've written about how both British Airways and Marriott are facing nine figure fines for GDPR violations related to their data breaches. These fines can be up to 4% of a company's annual revenue, so the fines have the potential to be massive. While not nearly as big, @Dailybits…
Continue reading: Hotel Fined For Breakfast List Data Breach
Share your questions, experiences, and thoughts below.
You're not missing anything. Hotels and other similar businesses in the service industry are flippant with PII. Hopefully after seeing these "smaller" (non fortune-500) fines they industry takes a cue and starts trending in the right direction.
It's stupid. Where ist this all supposed to go? I've just been at a desk and I've been told that they can't call me by name because of GDPR. They now have to hand out numbers. Sorry, but that is totally absurd and I don't want to live in a world like this. But on the other hand, my government forces my to tell the whole wide world where I live, my pone number, just because I habe a website.
The fact that it might be commonplace does not mean that it's also good. Hopefully this will increase awareness everywhere.
I'm with @Betty. A list of restaurant customers??? Who cares??? It's not like a list of people who have herpes. It's just a restaurant. It doesn't need to be protected like some national secret. People need to chill out.
@Lucky, how is the fact that you used the gym at the hotel a "huge violation"? Of what consequence is that fact to anyone? Maybe if you're a celebrity you want to put down a fake name just so you're not hassled by any other guests who come in after you, but for normal people, what difference does this make?
Someone enlighten me please. A breakfast list for guests should only have the name of the person and their room number, and not their credit card information or any other personal information. How is this considered a violation? What damage can be done if someone takes a picture of my name and room number?
Shakedown policies of the EU. Increase revenue through fines and fees.
I’ve noticed some hotels color coding room #s on breakfast lists to indicate status.
We need to stop assuming that “small breeches” can be ignored. They can’t. These fines will finally get these corporates to wake up and the executive boards to stop being so complacent
Name and room number on a list can be an issue because then thieves can find out if you're onsite simply by using the house phone and asking for you. I actually thought about this the last time a hostess at breakfast drew a line through my name and room number on a list like that, to show that I had already been admitted.
@Chris@oak
“Shakedown policies of the EU”
That makes absolutely zero sense. The legislation is EU law, operating across the EU.
But it is national governments, not the EU, which are responsible for implementation AND WHICH RECEIVE ANY FINES.
The UK is very hot on data protection, and the relevant government agency - the ICO - is efficient and effective. Note that they don’t receive any of the fines either.
How about issuing numbers at the dr.'s office? Isn't a breach of confidentiality to call out patients' names in front of everyone in the waiting room?
@ Billiken
It’s only a breach if they are using your data in a way for which you have not given permission, or which a reasonable person would not expect.
Most of us expect our name to be called out at the Doctor’s office. Therefore there’s no breach (unless you had specifically agreed with them that your name would not be used like that. Though you might then be waiting for a long time...).
I guess pretty soon we’ll have someone describe this as “political correctness gone mad”, probably based on a fake story to illustrate the point.
These regulations are verry... broad. I work in tax collection, so can basicly see everything about everyone. But oh no, got to keep that email inbox empty because of personal data I'm not allowed to store...
I hope they don't take down these lists. It can often be used to get free breakfast when the reservation doesn't include it.
More ridiculous bureaucracy that punishes businesses and their customers (more hassles, less perks, higher room rates) for doing nothing wrong. Why are the people who steal these lists, access them illegally or hack never fined but these companies are. If someone walks behind a front desk and sees the list the hotel would be fined according to the logic of the regulator. It’s absurd.
I was in a hotel in Manchester, UK over the weekend. The list of customers having breakfast that was included in the room rate was inside a folder and only opened when a guest needed to be checked against the list when they entered the restaurant area
The list at a hotel in Amsterdam last month (owned by a US chain) was held behind a desk which was very difficult for anyone to over look and also in a folder.
Simple, cheap measures to protect personal data. And easily replicated by any other hotel.
How much does a folder cost - €5?
I work at a hospital. I'm beginning to think everyone should be issued a mask and a code name before they arrive. The privacy thing has just gotten ridiculous.
Remember the old days when they published hospital admissions in the local paper? And everyone knew their neighbors .. and cared about them?
GDPR is a big issue and EU is trying to keep our data safe.
Is it overkill? Yes
Are people trying to get our personal data? Yes
There will not be perfect solution and is a matter of adapting to new regulations that will make this event risible in a few years.
I don’t think this is overkill. I work with PII a lot and I can think of several ways a list of names and room numbers could be misused, even without any other PII.
Hotels should be more careful, not least because the first and easiest thing a miscreant could do would be to charge something to the room of someone on the list; a direct loss to the hotel.
GDPR is actually some pretty good legislation and hopefully this first round of fines will encourage companies to take data protection seriously.
I'm in the over the top camp on this one.
Don't get me wrong, hotels really do need to up there game on IT, especially the 'legacy' chains. There is no reason they shouldn't have an electronic breakfast list in this day in age, needing only a room number or tap of the room key or loyalty card to cross you off the list.
That said though, if Europe wants to go off on a tangent with this kind of nonsense that's fine. Although given these costs are basically always passed onto consumers in one way or another the companies subject to this kind of compliance should charge a 'Europe Levy' to EU / EEA customers so the rest of us around the world that don't care to be subject to EU rule from afar don't have to wear the financial consequences.
I'll take any government agency in charge of enforcing data rules seriously when the government actually leads the way and stops breaches and handles information properly. I suspect I'll be waiting a while.
How many times have you seen a flight manifest lying around a galley? I don’t see it as often now but it does occur.
In addition, I’m CX Diamond and on 100% of my CX flights there is a post it note in the nearest galley with my full name and seat number listed. Not the biggest violation...but still.
@ Nicholas Wall
“the rest of us around the world that don’t care to be subject to EU rule from afar”
An extraordinarily ironic post to a US-based blog.
The US, the land of extra-territorial sanctions against any company which has the audacity to do business with, say, Cuba...
So what about those of us who don’t care to be subject to US rule from afar? Or is that somehow different...?
If a hotel can be so sloppy with names/room numbers on a breakfast list, I can only imagine how bad they are about keeping my other information secure.
It's sad how Facebook and its creepy tracking measures have changed everyone's level of tolerance of personal privacy.
Glad to see the EU step up GDPR violation enforcement!
Ok, this is completely bonkers. I also agree with Betty... I don't want to live in a world like this.
This happens at the Club Lounge of larger domestic Sheraton hotels too....
In fact one property in particular LEAVES the list on the podium and at 10pm - it's still there!
SO one time I snagged it and checked it out - That's how I was able to see the status classification codes. Not to mention arrival dates & departure dates, VIP's, room numbers etc.
This should be a training wakeup call for domestic and intl properties
@ The nice Paul
Quite different. If the USA says a company/country can do business with the USA or Cuba that really doesn't impact me.
When the EU decides to pursue some ambitious regime and tries to apply it around the globe by stealth and pushes up the prices of every day goods in the process it does have impact. When the EU proposes to break the internet and push out by stealth with their out those proposals to tax hyperlinks and ban memes as they did recently that impacts me.
They are within their rights of course to pursue their GDPR regime within the EU. It might even be well intentioned (if not fundamentally flawed). Regardless, EU / EEA citizens should be the ones wearing the cost of it and be charged the "compliance surcharge" to deal with the drama it causes.
What you're missing is that nobody has thought to take this GDPR breach to the regulators before.