The General Data Protection Regulation (GDPR) in the  Leisure Industry

The General Data Protection Regulation

You know the upcoming General Data Protection Regulation (GDPR) has moved from being the preserve of lawyers, marketeers and IT boffins to the mainstream when it gets a mention in the 8 o’clock headlines on Radio 4… closely followed by a feature about toe-sucking on the BBC’s Poldark!

The GDPR has been waiting in the wings for some time, but next year – on May 25th, 2018 to be precise – it officially comes into force, and it will alter the way all UK businesses handle personal data forever. No wonder it’s elbowing Poldark out of the way on primetime radio. For many operators, data protection can be a bit like health and safety – just one more job you’ve never really got enough time for. But with the GDPR introducing considerably heftier fines for data breaches – four per cent of your annual global turnover or a whopping €20 million, whichever is higher – it’s time to give it more attention than a niggling task at the bottom of your to-do list.

What is the driving force behind GDPR?

In today’s society, we hear a lot about the proliferation of data, how much more is collected now than ever before, allowing organisations to offer tailored, targeted and personalised products and services. Both in business and personally, we’re all ‘data subjects’ – increasingly reliant on our smartphones, computers, the internet and social media, all of which accumulate data at our every click and tap.  

Our lives will be ever more determined by the data held about us. But that same data is more open to compromise than ever, which goes way beyond what the current data protection law (the Data Protection Act, which came to be in 1998) is designed for, or able to legislate against. The GDPR will bring data protection bang up to date by giving all EU citizens greater control of their personal data – how it’s collected, where it’s held, by whom and for how long. It will affect all leisure operators who hold personal data about customers, prospects and employees plus the government has confirmed it won’t be affected by the UK’s decision to leave the EU.

What are the main categories of GDPR?

Breaches

In the UK at present there’s no legal requirement to report data breaches – if your personal data is stolen or compromised, you may never even be aware of it. In the event of a breach under the GDPR, controllers must notify their appropriate supervisory authority – in the UK that’s the Information Commissioner’s Office (ICO) – “without undue delay and, where feasible, not later than 72 hours after having become aware of it.” If the breached data wasn’t encrypted, you’re also responsible for informing the data parties involved (your customers). So, no burying heads in the sand, pretending a slip hasn’t happened. From next May, if a personal data breach occurs, you’re compelled to ‘fess up.

Personal data

What counts as ‘personal data’ is getting an upgrade. Online identifiers like IP addresses and cookies will now count. ‘Special category’, sensitive personal data such as information relating to someone’s political opinions, religious or philosophical beliefs will now also include genetic and biometric data. So, any data used to measure athletic performance or health now counts. Lastly, beware of any under 13’s and presume you have to class their data as more sensitive than an adult’s. If you’re signing up children, ensure you now get a parent’s signature, even if they’re a teen.  

Consent

No more hiding consent for email marketing in T&Cs; going forwards it must be validly collected - it’s not enough to presume you have customers’ consent, and implied consent won’t work either. Consent tick boxes will need to be separate elements, with their own specific, time bound and age appropriate wording. You’ll also need to name third parties – just saying ‘selected third parties’ won’t be enough anymore plus make sure you give a clear option to withdraw consent and keep records that prove consent has been given.  

The right to be forgotten

Your customers can ask to be completely forgotten, and all their data to be removed from your records, so you’ll need to ensure your database allows this to happen swiftly and easily.

Let’s start at the very beginning

Perhaps Julie Andrews had a point when she sang about starting at the very beginning, because in this instance it is a very good place to start. “Begin by getting organised,” advises Joanne Barton, Product Design Leader and GDPR Lead at Gladstone. “Think about what data you have, why you have it, how you manage it, where it’s stored, who’s responsible for it and who has access, why you’re keeping it and for how long. If you really need it all, how long do you keep it? The days of just collecting data and keeping it forever are gone. All leisure operators will need positive policies about what they’re keeping and why. Map it all out so there’s no confusion. And look across all your systems – digital and manual, Gladstone and third party – they all count.”  

The key, says Barton, is to design a security aware culture, so every staff member knows what journey data should take through your organisation. Manage your data in a structured way and protect anything you wouldn’t want to be disclosed. “The weakest point is often the human hand; you can enforce strict security protocols but if your staff aren’t aware of data protection requirements, there will be unknowing mistakes that cause a breach.”  

Adopting strong passwords goes without saying and encryption of key data is recommended – it’s the best way to keep your customers’ data safe, especially for new ‘special category’ sensitive information like ethnicity, gender and health issues. If a breach does occur, but proper data encryption standards have been used, for the large part your data is useless to an attacker.  

“Expect the best, but be prepared for the worst,” says Barton. “The average cost of a data breach is $3.4M. Make sure you plan and rehearse a contingency plan of what you’ll do and who’ll do it.”  

Lastly think very carefully about what you keep. If a member leaves your centre, how long do you retain their details? And if you delete, purge or archive how is it handled? A cross customer who’s still being contacted again and again will be the first to report you to the ICO.  

What about sleepers? Is it safe to let sleeping members’ lie? “In reality, you may not be able to carry on relying on them as a safe income stream,” says Barton. “If you’ve been efficient with consent upfront you may be ok, but it’s unwise to presume. The only way to ensure compliance is to re-establish contact and collect consent at the level you need.”

GDPR Checklist for Operators

1. Review your business processes, from initial prospecting to archiving of data.
2. Identify all your systems, formal and informal, manual and digital. Review how employees currently handle data and where processes overlap.
3. Determine what you need to improve and how, noting who is responsible for what
4. Communicate necessary changes clearly to all employees
5. Consider hiring a GDPR specialist to review your current data handling processes

How is Gladstone helping its customers with GDPR?

While software products alone can’t ensure your business is compliant, Gladstone has meticulously delved into the GDPR fine print and identified specific areas across both its platform and service offerings, that are being enhanced to more easily facilitate the customers obligation to meet the new requirements. It’s changing 80 per cent of products across all areas, and is using specialist lawyers and Data Privacy experts to review the changes so nothing’s been missed. 

“The majority of our modules and products will need some changes to align with the GDPR legislation. We’re looking at access to systems, introducing secure passwords and https by default and adding another layer of encryption at key sensitive points,” says Joanne Barton, GDPR Project Owner at Gladstone. “We are building new versions of products according to the ‘Privacy by Design’ principle, enabling our customers to fulfil their duties in adhering to the GDPR.  As our review progresses, we’ll advise the schedule for software updates; new versions of products will begin with Early Adopter versions from FY17-Q4 to FY18-Q2. All Gladstone customers will have the option to book an upgrade to GDPR-ready versions at General Release prior to the May timeframe” 

It’s worth remembering that every system upgrade is only as good as the person using it. “Take secure passwords,” says Barton. “If a staff member accidentally allows someone to shoulder surf and write their secure password down on a Post It and then place it under the keyboard, there are obviously going to be problems! It’s about changing your culture, not just the software.” 

“Using Gladstone products alone will not make you GDPR compliant,” says Barton. “It’s your business, as the primary data holder, that needs to be compliant. We can provide resources to help clean up databases but responsibility resides with you.”

More than just compliance 

If you’re reading this with a sinking heart, try thinking about it in a more customer-centric way. “Don’t forget, all the GDPR’s really about is personal privacy, equality and trust. 

We all care about that and expect the businesses we give our details to will keep them safe,” says Barton. “Customers must feel they have control over data you hold. Get this right and they’ll know you respect them.

Think of the new rules as a way to help you manage data more effectively, both internally and externally. Build privacy into your organisational culture, rather than seeing it as your enemy. Ultimately, customers who feel they can trust you with their data will know you respect them and be more loyal.”

Don’t think GDPR’s not for me! 
It impacts everyone and it’s all our responsibilities.

In summary remember:-

If you are starting from the beginning you can watch a 30 minute GDPR overview for Operators.

1. Know what data you have, when it was captured, and who was responsible 
2. Understand what your customer is happy for you to do with their personal data (and when they are not happy for you to share it) 
3. Encrypt key data to retain your customers’ details securely 
4. Allow your customer to feel in control of the data you keep