Data protection

[Whatever]

I think the answer to this is "yes" but wanted to be sure. Do I need to register with the Information Commissioner's Office as a data controller? I take bookings through TripAdvisor and directly and use the PIMS system.

Thanks

[Moliere]

I would say that life's too short - don't overthink things.

Mols

[greenbarn]

I would say that life's too short - don't overthink things.

Mols

Indeed - there's plenty of time to think about things when you're languishing in jail........

Obviously all of us in this business are bound by the DPA, but do we have to register?
It's interesting to look at the self-assessment guide on the ICO website: https://ico.org.uk/for-organisations/re ... ssessment/

When you get to question 8,

Do you only process personal data for staff administration, advertising, marketing or public relations, or accounts or records?

answer "Yes" and you get a further breakdown, and you'll end up with this question:

Do you process individuals’ information for accounts or financial records?

You should answer ‘Yes’ if you:
only process information necessary for undertaking and managing transactions with your suppliers and customers; and
• only share the information with people and organisations necessary to do this. Important - if individuals give you permission to share their information, this is also allowed; and
keep the information while you have a relationship with the supplier or customer it refers to or as long as necessary for your accounts and financial records.

It was trying to understand that one that gave me a problem, not being a legal type or anything like that.
Be interesting to know how others see it. Any DPA experts?

[Moliere]

Ah, perhaps it's the legacy of my finance / legal career - i always believed in keeping it simple. Enjoy your pondering, Greenbarn, you know you love it really!

Mols

[newtimber]

I had hoped that PIMS would have some privacy statement on their website but couldn't find it...

I think you're fine so long as you don't copy personal data from one site to another. So copying personal data from people who booked on your site and giving them to TA is not allowed.

Similarly if the guests enter personal data themselves onto PIMS, then they are covered by PIMS data protection policy whatever that happens to be...

[AndrewH]

Obviously all of us in this business are bound by the DPA ...

Well I'm not GB . I think I will go with Mols .

[greenbarn]

Obviously all of us in this business are bound by the DPA ...

Well I'm not GB . I think I will go with Mols .

Is that because you're in Greece Andrew, or am I missing something that it would be really useful to know?!

[AndrewH]

Yes, it's because I am in Greece and the long arm of the law isn't quite long enough. I expect there are similar data rules imposed by the Greek government, but only because Brussels has told them they must. Like with many other things, Greek authorities tend to look the other way, unless it is a genuinely serious matter or there is money in it.

[greenbarn]

Yes, it's because I am in Greece and the long arm of the law isn't quite long enough. I expect there are similar data rules imposed by the Greek government, but only because Brussels has told them they must. Like with many other things, Greek authorities tend to look the other way, unless it is a genuinely serious matter or there is money in it.

I suppose Greek civilisation has had rather more time to sort itself out that most!

[Joanna]

I can't remember the details but I did look into this when we started out and the conclusion I came to was that we didn't need to register. I think it was because we don't take any financial details from guests such as credit card numbers, etc. Although my memory is a bit hazy on the exact reasons.

The Data Protection rules still apply whether you have to register or not - for example you must keep guests data secure behind a firewall, not pass data on to a third party without the guest's permission and dispose of it properly when you no longer need it.