![\"multiple-visitor-sign-in-sheets\"](\"https:\/\/cdn2.hubspot.net\/hubfs\/437856\/multiple-visitor-sign-in-sheets.jpg\")
<\/p>\nThe last thing I think about when I’m on vacation is “GDPR.”<\/p>\n
<\/p>\n
Yet last month, when I was staying at a lovely hotel (who shall not be named in this blog), I was faced with a wholly non-GDPR-compliant scenario.<\/p>\n
After a good night’s sleep, my son and I made our way down to hotel’s scrumptious breakfast spread. As the host greeted us, I noticed on his stand a few pieces of paper.<\/p>\n
<\/p>\n
On one of them, my name stood out to me immediately and next to it: my room number, home address, and telephone number. Even the smell of crisp bacon in the air didn’t help ease my anxiety.<\/p>\n
I asked the kind gentleman to “cover the guest info, please,” and he didn’t understand why. After two cups of coffee in my system, I went back to explain to him why.<\/p>\n
The very essence of General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and by virtue of the authority vested in the UK’s Information Commissioner’s Office (ICO), is data privacy.<\/p>\n
As such, GDPR fines exist to keep businesses accountable. If you need a bit more background before diving deeper into this topic, then please do head over to our GDPR guide and I’ll see you back here shortly. <\/span><\/p>\n These fines are actually avoidable, especially around your visitor management. But like the saying, “it takes a village,” it really does take a holistic approach from your organization. <\/span><\/p>\n You can definitely start with saying goodbye to the sign-in sheet. Why?<\/span><\/p>\n This was just one revelation we had when we asked 2,000 business professionals around the US and UK about their experiences in corporate lobbies around the world. <\/span><\/p>\n There’s more about it in our Front Desk Experience Survey 2018. But your business can get fined for this very cause, so don’t believe anyone telling you otherwise. <\/span><\/p>\n GDPR myths are the new urban myths of our time.<\/span><\/p>\n Fun Fact:<\/strong> If an organization has been fined for multiple GDPR violations, it will only be penalized for the most severe one.<\/p>\n But no two GDPR fines are alike and depending on the violation, your business will be penalized more severely.<\/p>\n To break it down into simpler terms, there are two possible degrees of severity:<\/p>\n Monetarily, you can be fined 2%, up to $12 million<\/strong>, of your organization’s worldwide annual revenue from the prior year. They include any violation of the articles specific to:<\/p>\n These are the heavier fines for more serious violations. Read: Stomping on the very principles of the right to privacy and the right to be forgotten.<\/p>\n This is where the fines jump to 4% or up to $24 million<\/strong>, of your organization’s worldwide annual revenue from the prior year.<\/p>\n By now we’ve all seen the headlines about the big hitters:<\/p>\n They’re going through the ringer for falling short of doing everything they could to comply with GDPR.<\/p>\n With fines in amounts upwards of $229 million, it’s important to note that it’s not only big names getting hit with penalties.<\/p>\n There are hundreds of GDPR penalties that have been doled out since the regulation’s passing in March of 2018, just not as massive or hurled into the public eye as the ones mentioned above.<\/p>\n So not only will you be able to more easily comply with data minimization, but you’ll be able to show the automated process you have in place when it comes time for an audit.\u00a0<\/p>\n","protected":false},"author":26,"featured_media":37892,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":"","_wpscp_schedule_draft_date":"","_wpscp_schedule_republish_date":"","_wpscppro_advance_schedule":false,"_wpscppro_advance_schedule_date":"","_wpscppro_dont_share_socialmedia":null,"_wpscppro_custom_social_share_image":0,"_facebook_share_type":"default","_twitter_share_type":"default","_linkedin_share_type":"default","_pinterest_share_type":"default","_linkedin_share_type_page":"","_instagram_share_type":"default","_medium_share_type":"default","_threads_share_type":"","_google_business_share_type":"","_selected_social_profile":[],"_wpsp_enable_custom_social_template":false,"_wpsp_social_scheduling":{"enabled":false,"datetime":null,"platforms":[],"status":"template_only","dateOption":"today","timeOption":"now","customDays":"","customHours":"","customDate":"","customTime":"","schedulingType":"absolute"},"_wpsp_active_default_template":true},"categories":[7,1],"tags":[419],"class_list":["post-37684","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-eptura","tag-blog"],"acf":[],"yoast_head":"\nGDPR fines come in tiers<\/h2>\n
Tier One<\/h3>\n
\n
Tier Two<\/h3>\n
Some notable GDPR fines: Google et al.<\/h2>\n
\n
<\/div>\n\n\n\nFailure to delete data gives Denmark’s Data Protection Authority (DPA) their first acts of power<\/h3>\n
In April 2019, data deletion and data minimization took the GDPR spotlight in Denmark for the first time.<\/div>\n<\/div>\nClear in GDPR’s bylaws, it states: Data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.<\/div>\n<\/div>\n\n
The data subject shall have the right to withdraw his or her consent at any time.\u2014 Article 7(3) of GDPR<\/div>\n<\/blockquote>\nHowever, Danish taxi company Taxa failed to delete customer data\u2014telephone numbers to be exact\u2014inside the 2-year data retention period. Their fine was to the tune of roughly \u20ac160,000.<\/div>\n<\/div>\nFurthermore, in June 2019, the Danish DPA also proposed a fine of \u20ac200,000 on IDDesign, a trendy Scandinavian interior design company\u2014and this also for failure to delete data of its customers.<\/div>\n<\/div>\nBut remember, it’s not only your customers’ data you must manage.<\/div>\nYes.\u00a0Your company’s visitors’ details also fall under GDPR’s data minimization. So it’s important to make sure the visitor management solution you implement allows you to set your visitor data retention periods.<\/div>\n<\/div>\nSo not only will you be able to more easily comply with data minimization, but you’ll be able to show the automated process you have in place when it comes time for an audit.<\/div>\n<\/div>\nThe hotel sign-in sheet scenario revisited<\/h3>\n
In July 2019, World Trade Center Bucharest, was fined \u20ac<\/strong>15,000 for the very scenario I started this blog with.<\/div>\n<\/div>\nA hotel employee left a printed list of their guests laying around their restaurant’s front desk. The list was photographed by passerby and subsequently shared publicly, leaking the personal data of said guests!<\/div>\n<\/div>\nNot only is this a nightmare for the guests\u2014can you imagine having your personal info passed around without your knowing? But it also resulted in a sanctioned fine of \u20ac<\/strong>15,000.<\/div>\n<\/div>\nHaving a digital visitor management system like Eptura, with granular access privileges, could have saved Work Trade Center Bucharest much time and trouble\u2014and reputation to boot. (More about how we handle security here)<\/div>\n<\/div>\nTruth be told, I didn’t know about this particular hotel’s “breach in data” until recently. I’d be lying if I said I wasn’t tempted to send this blog post back to the lovely hotel I stayed at last month just so they’re aware of the risks.<\/div>\n<\/div>\n<\/div>\n\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"