Table of Content<\/h4>\n\n- What is the CPRA?<\/a><\/li>\n
- Does Your Hotel Have to Be CPRA Compliant?<\/a><\/li>\n
- How does the CPRA affect hotel businesses?<\/a><\/li>\n
- How hotel businesses can become CPRA proof<\/a><\/li>\n
\n- Update your compliance documents<\/a><\/li>\n
- Upgrade your systems <\/a><\/li>\n
- Get airtight network security<\/a><\/li>\n
- Make sure your data collection and inventory are compliant<\/a><\/li>\n
- Update and communicate privacy disclosures<\/a><\/li>\n
- What\u2019s up with your data retention practices?<\/a><\/li>\n
- Train your employees<\/a><\/li>\n
- Check the fine print in your third party agreements<\/a><\/li>\n<\/ul>\n
- Get ready for the CPRA<\/a><\/li>\n<\/ol>\n<\/div>\n\n\n\n
What is the CPRA?<\/strong><\/h2>\n\n\n\nYou\u2019ve probably heard about the California Consumer Privacy Act (CCPA) passed in 2018. It laid the foundation for data privacy law in the state of California and came into effect on January 1, 2020. <\/p>\n\n\n\n
With so much of our data being moved around, there\u2019s a need for more regulation and information. <\/p>\n\n\n\n
What\u2019s being done with our data, and what can we do about this? That\u2019s what the CCPA tries to give: more control, more privacy and more information. It intends to provide California residents with the right to:<\/p>\n\n\n\n
- Access their personal data<\/li>
- Know what personal data is being collected<\/li>
- Know if that data is being sold or disclosed to anyone, and to whom.<\/li>
- Control whether or not their data can be sold<\/li>
- Request a business to delete any personal information about them<\/li>
- Not be discriminated against for exercising their (data) privacy rights<\/li><\/ul>\n\n\n\n
This meant a lot of businesses needed to make significant changes in how they handle data and the surrounding communication\u2014and it\u2019s all about consumers. <\/p>\n\n\n\n
So, why the need for the CPRA<\/a>? <\/p>\n\n\n\nThe California Privacy Rights Act amends the CCPA. It isn’t a new law, but rather a rewrite of the CCPA. Together, they form one data privacy regime in the state of California.<\/p>\n\n\n\n
The rewrite included changes that strengthen the rights of California residents, while businesses have to prepare for tighter regulations. Some of the changes include:<\/p>\n\n\n\n
The definition of Personal Information is clarified<\/p>\n\n\n\n
- More certainty about advertising that uses personal information to profile and target California residents<\/li>
- A new government agency for statewide data privacy enforcement called the California Privacy Protection Agency (CPPA) and reporting requirements to them<\/li>
- More limitations on the use of \u201cSensitive Personal Information\u201d<\/li>
- Requirements for data minimization <\/li><\/ul>\n\n\n\n
There are many more changes in the CPRA, all intended to close the gaps that the CCPA<\/a> had or erase any ambiguity. <\/p>\n\n\n\nDoes Your Hotel Have to Be CPRA Compliant?<\/strong><\/h2>\n\n\n\nIt\u2019s quite easy to check if your hotel business needs to worry about the new CPRA. There are three main rules. Your hotel has to be CPRA complaint if at least one of these things applies to you:<\/p>\n\n\n\n
- You buy, sell or share personal information with 100,000+ consumers or households. (Under the CCPA, you have to comply if you collect data from 50,000 households or more.)<\/li>
- You make more than $25+ million in annual revenue<\/li>
- At least 50% of your annual revenue comes from selling or sharing consumer PI<\/li><\/ul>\n\n\n\n
Does that sound like it applies to you, but are you nowhere near CPRA ready yet? <\/p>\n\n\n\n
No need to panic, you have time to get it right and prepare your hotel for CPRA. While it takes effect on January 1, 2023, it only becomes fully enforceable on July 1, 2023.<\/p>\n\n\n\n
How does the CPRA affect hotel businesses?<\/strong><\/h2>\n\n\n\nHospitality is all about trust. Your guests will sleep even better if they know their data is in good hands, knowing they have a say in it as well. Communication and transparency are all part of the five-star experience.<\/p>\n\n\n\n
As a hotel, you collect more personal information than you might think. Whether you\u2019re part of a franchise, a family-owned business or part of a chain, you will need to get a clear picture of what data you\u2019re handling, from where it\u2019s coming in, and where it is going. <\/p>\n\n\n\n
This will also give you data insights that you might be sharing with partners and suppliers. You\u2019re going to need to do risk assessments. Who has access to what data? What systems are you using? What about cybersecurity? Once you\u2019ve got your report ready, you\u2019ll need to hand it over to the new California Privacy Protection Agency. <\/p>\n\n\n\n
But there\u2019s much more that needs to be done. While it is good to get an expert or lawyer on board to ensure your systems are airtight, it\u2019s also good to know roughly what needs to be done\u2014so you can decide whom to work with, train your team, and understand why you need an expert. <\/p>\n\n\n\n
Take CCPA and CPRA seriously to keep your guest data safe. Don\u2019t approach it as a DIY project on the side. Because failing to comply is not just a breach of trust, it can also create huge dents in your hotel\u2019s budget. <\/p>\n\n\n\n
Fines are up to $2,500 per violation or even $7,500 per intentional violation. Moreover, the CPRA increases the potential fine for violations involving consumers under 16. It\u2019s safe to say that investing in good legal help is worth the money.<\/p>\n\n\n\n
Let\u2019s look at some things on the to-do list to prepare your hotel for CPRA!<\/p>\n\n\n\n
How hotel businesses can become CPRA-proof<\/strong><\/h2>\n\n\n\nChances are, you won\u2019t be starting completely from scratch if you\u2019ve been keeping up with the existing CCPA. Here\u2019s a checklist to start with and prepare your hotel for CPRA.<\/p>\n\n\n\n
1. Update your compliance documents<\/strong><\/h3>\n\n\n\nYou\u2019ll want to stay up to speed on any changes or new regulations. As data is being collected more and more, you can expect regulations to be updated now and then. In those moments, update your compliance documents. That\u2019s step one.<\/p>\n\n\n\n
2. Upgrading your systems <\/strong><\/h3>\n\n\n\nThe systems you use are essential. Take a close look at your booking tools and other hospitality software and make sure they are up-to-date. <\/p>\n\n\n\n
3. Get airtight network security<\/strong><\/h3>\n\n\n\nYour intentions can be great, but sometimes other people aren\u2019t on the same page. In addition to having safe systems, protect your network the right way to prevent people from taking a peek.<\/p>\n\n\n\n
4. Make sure your data collection and inventory are compliant<\/strong><\/h3>\n\n\n\nOpt-out, opt-in, request extra info: there\u2019s a lot to look into when it comes to data collection. You will need to determine if the personal information you’re collecting is considered profiling under the CPRA. <\/p>\n\n\n\n
If it does, you will need to change your policies and procedures for the disclosure, use and opt-out of automated decision-making technology. This is all about letting your guests know how their data could<\/em> be used if they consent to it. <\/p>\n\n\n\nIt goes beyond cookies, by the way. If you collect data offline, for instance, in forms, you will also have to consider this. (taylorsmithconsulting.com<\/a>) <\/p>\n\n\n\n5. Update and communicate privacy disclosures<\/strong><\/h3>\n\n\n\nMake sure your privacy disclosures are complete, specific and most of all, clear. They help guests understand what is going on in simple language. Also, make sure they are easily found or handed over whenever the CPRA requires that. The same goes for your CCPA notices. If you haven\u2019t communicated those clearly yet, have a read on how a privacy attorney goes on holiday<\/a> to know what it\u2019s all about.<\/p>\n\n\n\n6. What\u2019s up with your data retention practices?<\/strong><\/h3>\n\n\n\nDo you have data retention policies in place? If you are collecting and retaining data from your guests, you will need to rationalize and document the reasons for this.<\/p>\n\n\n\n
7. Train your employees<\/strong><\/h3>\n\n\n\nData protection is a team effort. The ones who are handling data will need to know the rules. Look into training programs or courses, so they are up to speed on what the CPRA is about.<\/p>\n\n\n\n
8. Check the fine print in your third-party agreements<\/strong><\/h3>\n\n\n\nIt\u2019s not just about what you do. If you want to prepare your hotel for CPRA, you will have to look into what vendors, contractors and other partners are doing with data you might have to share with them. CPRA compliance goes beyond the walls of your own hotel.<\/p>\n\n\n
\nPrepare Your Hotel for CPRA (the sooner, the better<\/strong>)<\/h2>\n<\/p>\n
<\/p>\n
While there\u2019s still seemingly a lot of time to get the CPRA in place, it\u2019s smart to start early. There\u2019s a lot to tackle, and it is a rather complex topic. <\/p>\n
<\/p>\n
<\/p>\n
If your hotel business decides to get that head start, you will be able to spot mistakes you\u2019re making and fix them before you can get fined. Plus, the earlier your employees will be working under CPRA compliance, the more confident you will be about your data protection practices when 2023 comes.<\/p>\n<\/div>\n
![\"Get](\"https:\/\/no-cache.hubspot.com\/cta\/default\/502973\/3736b4f0-29b1-4eae-b6c9-e7c7223cb25d.png\")
- \n
- Update your compliance documents<\/a><\/li>\n
- Upgrade your systems <\/a><\/li>\n
- Get airtight network security<\/a><\/li>\n
- Make sure your data collection and inventory are compliant<\/a><\/li>\n
- Update and communicate privacy disclosures<\/a><\/li>\n
- What\u2019s up with your data retention practices?<\/a><\/li>\n
- Train your employees<\/a><\/li>\n
- Check the fine print in your third party agreements<\/a><\/li>\n<\/ul>\n
- Get ready for the CPRA<\/a><\/li>\n<\/ol>\n<\/div>\n\n\n\n
What is the CPRA?<\/strong><\/h2>\n\n\n\n
You\u2019ve probably heard about the California Consumer Privacy Act (CCPA) passed in 2018. It laid the foundation for data privacy law in the state of California and came into effect on January 1, 2020. <\/p>\n\n\n\n
With so much of our data being moved around, there\u2019s a need for more regulation and information. <\/p>\n\n\n\n
What\u2019s being done with our data, and what can we do about this? That\u2019s what the CCPA tries to give: more control, more privacy and more information. It intends to provide California residents with the right to:<\/p>\n\n\n\n
- Access their personal data<\/li>
- Know what personal data is being collected<\/li>
- Know if that data is being sold or disclosed to anyone, and to whom.<\/li>
- Control whether or not their data can be sold<\/li>
- Request a business to delete any personal information about them<\/li>
- Not be discriminated against for exercising their (data) privacy rights<\/li><\/ul>\n\n\n\n
This meant a lot of businesses needed to make significant changes in how they handle data and the surrounding communication\u2014and it\u2019s all about consumers. <\/p>\n\n\n\n
So, why the need for the CPRA<\/a>? <\/p>\n\n\n\n
The California Privacy Rights Act amends the CCPA. It isn’t a new law, but rather a rewrite of the CCPA. Together, they form one data privacy regime in the state of California.<\/p>\n\n\n\n
The rewrite included changes that strengthen the rights of California residents, while businesses have to prepare for tighter regulations. Some of the changes include:<\/p>\n\n\n\n
The definition of Personal Information is clarified<\/p>\n\n\n\n
- More certainty about advertising that uses personal information to profile and target California residents<\/li>
- A new government agency for statewide data privacy enforcement called the California Privacy Protection Agency (CPPA) and reporting requirements to them<\/li>
- More limitations on the use of \u201cSensitive Personal Information\u201d<\/li>
- Requirements for data minimization <\/li><\/ul>\n\n\n\n
There are many more changes in the CPRA, all intended to close the gaps that the CCPA<\/a> had or erase any ambiguity. <\/p>\n\n\n\n
Does Your Hotel Have to Be CPRA Compliant?<\/strong><\/h2>\n\n\n\n
It\u2019s quite easy to check if your hotel business needs to worry about the new CPRA. There are three main rules. Your hotel has to be CPRA complaint if at least one of these things applies to you:<\/p>\n\n\n\n
- You buy, sell or share personal information with 100,000+ consumers or households. (Under the CCPA, you have to comply if you collect data from 50,000 households or more.)<\/li>
- You make more than $25+ million in annual revenue<\/li>
- At least 50% of your annual revenue comes from selling or sharing consumer PI<\/li><\/ul>\n\n\n\n
Does that sound like it applies to you, but are you nowhere near CPRA ready yet? <\/p>\n\n\n\n
No need to panic, you have time to get it right and prepare your hotel for CPRA. While it takes effect on January 1, 2023, it only becomes fully enforceable on July 1, 2023.<\/p>\n\n\n\n
How does the CPRA affect hotel businesses?<\/strong><\/h2>\n\n\n\n
Hospitality is all about trust. Your guests will sleep even better if they know their data is in good hands, knowing they have a say in it as well. Communication and transparency are all part of the five-star experience.<\/p>\n\n\n\n
As a hotel, you collect more personal information than you might think. Whether you\u2019re part of a franchise, a family-owned business or part of a chain, you will need to get a clear picture of what data you\u2019re handling, from where it\u2019s coming in, and where it is going. <\/p>\n\n\n\n
This will also give you data insights that you might be sharing with partners and suppliers. You\u2019re going to need to do risk assessments. Who has access to what data? What systems are you using? What about cybersecurity? Once you\u2019ve got your report ready, you\u2019ll need to hand it over to the new California Privacy Protection Agency. <\/p>\n\n\n\n
But there\u2019s much more that needs to be done. While it is good to get an expert or lawyer on board to ensure your systems are airtight, it\u2019s also good to know roughly what needs to be done\u2014so you can decide whom to work with, train your team, and understand why you need an expert. <\/p>\n\n\n\n
Take CCPA and CPRA seriously to keep your guest data safe. Don\u2019t approach it as a DIY project on the side. Because failing to comply is not just a breach of trust, it can also create huge dents in your hotel\u2019s budget. <\/p>\n\n\n\n
Fines are up to $2,500 per violation or even $7,500 per intentional violation. Moreover, the CPRA increases the potential fine for violations involving consumers under 16. It\u2019s safe to say that investing in good legal help is worth the money.<\/p>\n\n\n\n
Let\u2019s look at some things on the to-do list to prepare your hotel for CPRA!<\/p>\n\n\n\n
How hotel businesses can become CPRA-proof<\/strong><\/h2>\n\n\n\n
Chances are, you won\u2019t be starting completely from scratch if you\u2019ve been keeping up with the existing CCPA. Here\u2019s a checklist to start with and prepare your hotel for CPRA.<\/p>\n\n\n\n
1. Update your compliance documents<\/strong><\/h3>\n\n\n\n
You\u2019ll want to stay up to speed on any changes or new regulations. As data is being collected more and more, you can expect regulations to be updated now and then. In those moments, update your compliance documents. That\u2019s step one.<\/p>\n\n\n\n
2. Upgrading your systems <\/strong><\/h3>\n\n\n\n
The systems you use are essential. Take a close look at your booking tools and other hospitality software and make sure they are up-to-date. <\/p>\n\n\n\n
3. Get airtight network security<\/strong><\/h3>\n\n\n\n
Your intentions can be great, but sometimes other people aren\u2019t on the same page. In addition to having safe systems, protect your network the right way to prevent people from taking a peek.<\/p>\n\n\n\n
4. Make sure your data collection and inventory are compliant<\/strong><\/h3>\n\n\n\n
Opt-out, opt-in, request extra info: there\u2019s a lot to look into when it comes to data collection. You will need to determine if the personal information you’re collecting is considered profiling under the CPRA. <\/p>\n\n\n\n
If it does, you will need to change your policies and procedures for the disclosure, use and opt-out of automated decision-making technology. This is all about letting your guests know how their data could<\/em> be used if they consent to it. <\/p>\n\n\n\n
It goes beyond cookies, by the way. If you collect data offline, for instance, in forms, you will also have to consider this. (taylorsmithconsulting.com<\/a>) <\/p>\n\n\n\n
5. Update and communicate privacy disclosures<\/strong><\/h3>\n\n\n\n
Make sure your privacy disclosures are complete, specific and most of all, clear. They help guests understand what is going on in simple language. Also, make sure they are easily found or handed over whenever the CPRA requires that. The same goes for your CCPA notices. If you haven\u2019t communicated those clearly yet, have a read on how a privacy attorney goes on holiday<\/a> to know what it\u2019s all about.<\/p>\n\n\n\n
6. What\u2019s up with your data retention practices?<\/strong><\/h3>\n\n\n\n
Do you have data retention policies in place? If you are collecting and retaining data from your guests, you will need to rationalize and document the reasons for this.<\/p>\n\n\n\n
7. Train your employees<\/strong><\/h3>\n\n\n\n
Data protection is a team effort. The ones who are handling data will need to know the rules. Look into training programs or courses, so they are up to speed on what the CPRA is about.<\/p>\n\n\n\n
8. Check the fine print in your third-party agreements<\/strong><\/h3>\n\n\n\n
It\u2019s not just about what you do. If you want to prepare your hotel for CPRA, you will have to look into what vendors, contractors and other partners are doing with data you might have to share with them. CPRA compliance goes beyond the walls of your own hotel.<\/p>\n\n\n
\nPrepare Your Hotel for CPRA (the sooner, the better<\/strong>)<\/h2>\n
<\/p>\n
<\/p>\n
While there\u2019s still seemingly a lot of time to get the CPRA in place, it\u2019s smart to start early. There\u2019s a lot to tackle, and it is a rather complex topic. <\/p>\n
<\/p>\n
<\/p>\n
If your hotel business decides to get that head start, you will be able to spot mistakes you\u2019re making and fix them before you can get fined. Plus, the earlier your employees will be working under CPRA compliance, the more confident you will be about your data protection practices when 2023 comes.<\/p>\n<\/div>\n
- Upgrade your systems <\/a><\/li>\n