In the era of digital transformation, companies in all industries tend to face some kind of data breaches and privacy violations. The Travel and Tourism industry is no exception in this regard. As travel companies tend to collect and store verified personnel data (including legal names, passport numbers and credit card information), ensuring the privacy and security of such data can be challenging. As companies in this industry continue to broaden the ways they collect and handle data from their clients, it is important to look out for more secure ways to handle sensitive data. The need for speedy and safe processing of sensitive client data has led companies to rely on dedicated data processing services.
Importance of Data Privacy in the Travel Industry
The travel and tourism industry suffers one of the highest numbers of data breaches. Whether it is through ways of hotel reservations, travel ticket bookings, submitting personnel/financial/government generated national identity numbers for verification, or trip bookings, the travel industry stores vast amounts of sensitive customer data, which need to be processed on a day-to-day basis. This in turn makes the industry a perfect platform for cybercriminals looking to commit financial fraud and identity theft crimes. Therefore, it is very important for travel and tourism companies to take appropriate measures to ensure the safety of valuable personnel and financial data of travellers.
The Travel and Tourism sector is increasingly driven by technologies that can result in privacy problems, if not handled in a proper manner. No doubt, data security breach can result in huge penalties, but such events can also damage a company’s reputation. This in turn may lead to travelers not booking the company’s services again due to the loss of their data through a security breach.
Why Travel Companies Are Falling Short on Data Privacy
Regarded as a complex and multi-disciplinary area, cyber security requires ongoing attention. It is easy to condemn a travel and tourism company for lax cyber security and privacy controls, but it is important to consider the context they operate within –
- PII data is difficult to control, particularly when it is essential to share it with many suppliers (e.g. hotels, airlines and tour companies).
- Travel and tourism companies are often dependent on the use and security of third-party booking systems.
- Most travel companies are SMEs without a dedicated cyber security team or Chief Information Security Officer (CISO).
How Travel Companies Can Reduce Data Privacy Risk
As every travel and tourism company is unique, it faces its own set of cyber security risks. A distinct set of controls is vital to minimize the chances of personal data breach. However, as a starting point, you can consider the following principles to reduce the risk of a data breach –
- Prioritize the protection of CRM / Booking Systems – Such systems will typically contain millions of PII of records and should therefore be top of the list for risk assessment and implementation of effective security controls.
- Minimize the Data Collected and Shared – Although it might seem convenient to collect and share the same customer data with all suppliers, it is not necessary. For instance, does a safari operator need to be sent full scans of customer passports before the trip?
- Maintain PII Data for the Required Period – Always consider the period for which the PII data is required to operate the business and meet regulatory requirements. Creating a clear retention policy would help remove data that is no longer needed.
- Focus on Access Control – With most PII data now stored in cloud solutions, access management has become the new network limit. Begin by enabling 2FA for all accounts and simplify administration by using Single-Sign-On (SSO) where available.
- Monitor and Control the Use of Shadow IT – Typically, travel companies have extensive sales and marketing teams in place that are inclined to upload data into a range of non-approved online tools like data analytics platforms.
Top Challenges in the Travel and Tourism Industry
As per reports, data breaches are considered one of the worst offenders for damaging a brand’s reputation. It is estimated that about 87 percent of customers will walk away and take their business elsewhere following a breach of data. Therefore, maintaining a strong cyber security posture is important for companies.
Here are some challenges in the travel and tourism industry –
- Complicated Ownership Structure – Often, businesses in the tourism industry (such as hotels, restaurants and travel companies) may have a complicated ownership structure comprising a management company that operates the business, a separate owner or group of owners, and a franchisor. These separate entities jointly work as a team to take up different responsibilities to ensure smooth business operation. These entities may store important data in different systems and such data may be moved around continually. In short, these complicated ownership structures could result in severe data breaches.
- Ensuring Compliance – Companies need to either implement or revamp their company’s travel policies as soon as possible. This will ensure that the employees duly follow the rules and it will help them make the right travel decisions.
- Use of Electronic Payment Methods – The tourism industry largely depends on online payment methods. These require credit card information to make a reservation, with final payments often being made with the same card that’s already stored as it’s a matter of convenience for both customers and employees. Once a single file within a system gets hacked, there is huge potential for the entire collection of interconnected devices to be jeopardized. Online payment modes can be an easy target for taking key personal and financial information. Tourism and hospitality companies need to ensure that all the devices used for storing the financial data of the customers are secure with the help of multiple measures like two factor authentication system. In such cases, even if cybercriminals manage to collect passwords and other sensitive financial information, they may not have the second component for authentication.
- Employee Awareness – Travel companies need to ensure that their employees take strong and adequate steps to safeguard the data they handle by using a privacy filter on laptops/tablets; PIN/password usage/lock alarms to protect against cybercrimes. This will help in safeguarding the data and ensuring personal compliance as well.
- Seasonal Jobs and Employee Turnover – Having well-trained employees is important for ensuring the safe collection and storage of customer and company data. However, the tourism industry suffers relatively high threats as it largely involves seasonal employment wherein employees often leave or get transferred to different locations. This makes it a challenge to strengthen teams of appropriately trained employees. In fact, a single untrained employee can provide cybercriminals easy loopholes to steal sensitive customer data.
- Regular Maintenance and Back-up of Systems – Use of older and outdated software systems makes it quite easy for cyber criminals to steal data or hack the system. Therefore, it is important to regularly maintain the devices and update the software. Backing up the data is generally an easy and cost-effective way to ensure data security. Such data includes financial records, business plans, customer data, personal information etc.
- Data Sovereignty and Data Disposal – Data sovereignty deals with the rights to the storage of company and customer data based on geography. Various laws related to this aspect are in place to secure data and guarantee privacy for populations from foreign threats. The data sovereignty aspect gives any company the right to release or hold back any information held secure within their cyber security systems. Most travel companies don’t have data storage and disposal policies of confidential customer data and electronic information and this increases the risk of data breaches.
- Using New Technologies to Fight Data Breaches – The use of new and innovative technologies presents various opportunities to strengthen data privacy and security policies and strategies. For instance, block chain presents numerous opportunities to improve travel and expense management. Right from identity verification, eliminating awkward exchanges with passport control to loyalty and bonus programs, this can help ensure information security. Similarly, automation via AI/ML can also prove beneficial.
With the pace of digital transformation rapidly increasing, companies in all industries or sectors may face some sort of security breach. This holds true for the travel and tourism industry also and ensuring the privacy and security of sensitive data becomes more challenging. As companies in this sector tend to change the way they collect data from customers, it is more important than ever that they commit to securely managing such collected information. Having a correct understanding about the importance of data security issues, can help travel companies implement effective strategies to ensure the safety of customer data. Utilizing outsourced services from reputable data entry companies can ensure data security and confidentiality, thereby reducing cyber security risks.
