Contributed by Mr Jonathon Grech, Senior Vice President, Group General Counsel and Company Secretary for Millennium & Copthorne Hotels plc (M&C).

General Data Protection Regulation (GDPR), which came into effect on 25 May 2018, is one of the most wide-ranging and substantial pieces of legislation passed by the EU in recent years. The regulation strengthens existing data protection requirements and expands their territorial scope so that they apply not only to EU-based companies and organisations, but also to non-EU organisations which offer goods and services to people in the EU or which are monitoring their behaviour.

This means GDPR will impact virtually all of M&C’s subsidiaries and operations globally, to varying degrees. M&C’s Group General Counsel and Company Secretary leads the GDPR implementation project, with support from the European legal team in the UK and external counsel.

We left no stone unturned as we have delved into our booking, guest registration, customer relationship management, sales and marketing, and recruiting and employment practices. If it sounds exhausting, it is! However, with potential penalties and fines of up to the higher of 4% of M&C’s annual global turnover (or approximately £40 million based on M&C’s full year 2017 results), or up to 20 million Euros, whichever is higher for significant violations – it is important that we get this right.

What is M&C’s process for becoming GDPR compliant?

1. Data inventory and data mapping – This work has been completed, as required by the GDPR, through surveys and interviews with members of the working group and their teams in order to understand what data we gather, why or for what purposes we gather it, how we gather it, and what we actually do with it.
2. Gap analysis – The work produced from the data inventory and data mapping exercises was reviewed and gap analyses for the various functions were prepared. These identified the areas where further work needed to be done in order to become compliant with GDPR.
3. Implementation – The initial implementation phase – in which the key requirements identified during the gap analysis phase were operationalised and incorporated into M&C’s policies, procedures and practices – was substantially completed by the 25th of May 2018, in anticipation of the GDPR going live.
4. Ongoing compliance – Generally, we have adopted and will continue to follow a risk-based approach to compliance, with the greatest focus on higher risk areas or areas where larger amounts of personal data are processed.

What have we done so far?

• Changes to the booking process and M&C’s global website privacy policy – We updated our booking process to communicate more clearly how we use the personal data of our website customers and to give them greater control over marketing consents. The new website privacy policy was launched on Tuesday 22 May 2018.
• Changes to our loyalty programme registration processes and marketing consent procedures – We instituted stricter controls so that marketing campaigns will be run through a centralised process and will be handled in compliance with GDPR requirements. It’s important to note that members of the My Millennium programme were not removed from the programme if they did not reaffirm their marketing consents, they simply were removed from the marketing database.
• Changes to M&C’s CRM system – Bespoke and practical guidelines were developed for our CRM and central reservation system activities. These guidelines included data retention requirements and marketing consent procedures, and they were vetted with the relevant business teams that have responsibility for the CRM system. Technical changes to the CRM system are being scoped out, and will be implemented in due course, to make sure the system will be able to handle the various GDPR requirements.
• Changes to M&C’s guest registration cards globally – Since the guest registration/check-in process is the one single point of contact for all of M&C’s guests, the marketing consents on our guest registration cards are being aligned globally, subject to local legal requirements. All major operating regions of M&C have implemented the required changes. We have adopted a policy to retain such consent information for a period of at least 6.5 years, subject to certain additional requirements and exceptions.
• EU employment contracts and recruiting processes – We have informed all EU employees of amendments to the data privacy provisions in their employment contracts arising from GDPR, and we have adopted a new employee data privacy notice that applies to all EU employees. Finally, we are working on a new external privacy policy to be used for recruitment efforts in the EU.
• Supplier and intra-company data processing agreements – In order to process guest, employee and other personal data, we are in the process of including GDPR compliant clauses in our supplier and other contracts and putting in place internal/intra-company data processing agreements among the relevant M&C entities around the world to the extent they process personal data. All of these clauses and agreements will include required protections for data subjects.
• New or updated internal policies and procedures – In conjunction with functional stakeholders, we are revamping our internal data protection policies and creating new ones as well, including a fully revised global data protection policy applicable to all employees within the Group, a data retention policy, an information security policy, an EU employee privacy notice (mentioned above), a data protection impact assessment policy, a comprehensive data breach policy, among others.
• Confirmation of data controllers and registration with the authorities – We are finalising the analysis and identification of the data controller and data processor entities within the Group. To the extent any new data controllers (those M&C entities that collect and control personal data of others) are identified as a result of GDPR, then we will proceed to register those entities with the UK Information Commissioner’s Office as appropriate.

Please click here for more details on M&C’s implementation of GDPR.