Northstar

Feature GDPR 44 NOV-DEC 2018 MEETINGS & CONVENTIONS MCMAG-ASIA.COM "You are foolish to think that your company will not hold you accountable." KEVIN IWAMOTO, SENIOR CONSULTANT, GOLDSPRING CONSULTING CONSULTING anyone on the team to follow the proper protocol could be the mistake that causes the company to pay heavily — in nes, reputation, customer retention or all of the above. "I still see a lot of denial going on with many planners," notes Kevin Iwamoto, senior consultant with GoldSpring Consulting. "A lot of them strongly feel — maybe rightfully so — that this is not their core area of responsibility. But you can't just ignore it and hope that it goes away. You've got to raise your hand and ask the questions — is somebody in the company working on this?" As of May 25, the EU began enforcing GDPR compliance. Cases can now be led, and the EU court can levy nes. The regulation applies to data belonging to anyone holding an EU passport or residing in the EU — including US expats on work assignments. Despite a two- year warning period provided by the EU, many US companies are only now scrambling to put proper processes in place. "We've seen things evolve pretty slowly," says Patti Tacke, president of the strategic meetings and event management technology platform Lenos Software. "In the fourth quarter of 2017, most people in the meetings industry hadn't heard of GDPR. In the rst quarter of this year, people began to ask what it was. And even in the second quarter, people were saying, 'No worries, we'll be ready on the 25th. Take our word for it.' " Since its launch in the late 1990s, Lenos was built on privacy- by-design principles. Co-founder and CEO Debbie Chong had been a regulatory lawyer focusing on cybersecurity issues in the nancial services industry before she and Tacke launched the business. In January of this year, Lenos released its GDPR Consent and Data Management Module, a tool that applies the company's data-privacy management expertise and understanding of the regulation to help streamline compliance, and it already has proven an essential aid for multinational clients. But even as of mid-May, says Tacke, many in the meetings industry weren't on board with compliance eorts. "We're still hearing meeting professionals say that privacy is not high on their requirements list," she says. Iwamoto, who has been an outspoken proponent of GDPR readiness eorts for more than a year and a half, agrees that preparations have progressed very slowly. A collective epiphany occurred a few months before implementation, he acknowledges, but compliance remains far from universal. Iwamoto points to a survey GoldSpring conducted several weeks before May 25, which found that 13% of respondents — including meeting mangers, travel managers and industry executives — still had done "absolutely nothing to prepare". It isn't too late GDPR is complex and, in many facets, open to interpretation. No doubt that is why many planners have been reluctant to put related data concerns on their already overowing plates. But deadlines aside, GDPR readiness should be thought of as a continuing process — an opportunity to clean up our industry's collective act. "In the case of an incident," says Iwamoto, "if you can demonstrate that you're in process, it will probably go better for you in the courts. If you're one of the 13% that hasn't done a thing [to prepare], it will probably not go well." If someone else at your organisation is heading up compliance eorts, adds Iwamoto, now's your chance to get involved. "If you're working for a multinational company, someone is probably already doing this," he notes. "And that can work to your benet, but you have to nd out who it is. If you don't ask the questions and something happens on your watch, you are foolish to think that your company is not going to hold you somewhat accountable." The basics of GDPR Whether you need to jump-start data- protection eorts at your organisation or get up to speed to assist a compliance team, planners do need to take specic actions, advises Kevin Iwamoto. The GDPR essentially divides parties into data controllers and data processors. Data controllers are the ones for whom the data is collected; corporate planners represent the controller. Data controllers are ultimately responsible for compliance — and will be held accountable for missteps. Data processors are any other parties that might touch the data — technology platforms, event management companies, DMCs, hotels, etc. They must be compliant, of course, but it is up to the data controller to ensure they are — to ask the right questions and design contracts accordingly. Doing the right thing While the above three action items are important, GDPR regulations are quite intricate, and interpretations of the new rules vary. No one knows exactly how the courts will enforce certain aspects of the law; it's best to consult multiple sources and a legal expert before nalising policy or agreements. (A frequently updated list of helpful resources can be found on the Empowerment+ site at bit.ly/2wYtRCF, and see this month's Checklist, "Complying With GDPR" on page 14 for some supplier tips.) Despite the uncertainties, "GDPR is the best regulatory solution to data protection that we have seen so far worldwide," says Alison Cool, a University of Colorado professor of

• Cover