Danbywell
On Monday, a few weeks ago, I travelled to Mangochi. Upon arrival I went straight to the Reception desk of one of the Lodges, I wanted to check for accommodation space. A lady receptionist welcomed me together with another guest I found waiting (for the receptionist) at the reception area. Fast forward, my room was secured and when I wanted to pay for the night, I was handed a guest register which I signed on the second row. The first row was filled by another guest with personal details uncovered. What this meant was that every other guest that was checking in (registering) after me would be able to see all my details: Name, room number, my contact, personal address, where I travelled from and next destination, and number of night(s). As a way of trying to verify, I asked the receptionist to guarantee the safety of my details, and then flipped through other filled pages to see if I could be denied access. What happened next? You guessed correctly. Although it was deemed a casual (not serious) conversation as it looked, but here below I am expounding on what really the situation/scenario meant and its possible associated implications.
Are tourism enterprises not obliged by regulatory requirements and industry practices to safeguard guests’ personal information?
Under the Malawian law and regulatory frameworks, businesses that collect personal informationare expected to protect such information from unauthorized access, disclosure, or misuse. Firstly the Constitution of the Republic of Malawi guarantees the right to privacy. Section 21 protects individuals from interfering with private communications and personal information. Businesses that collect personal data must therefore handle it in a way that respects this constitutional right. Secondly, The Electronic Transactions and Cyber Security Act provides a legal framework for the protection of personal data in electronic and digital environment. The Act requires entities that process personal data to; 1) Collect data lawfully and for legitimate purposes, 2)ensure confidentiality and security of the data, and 3) Prevent unauthorised access or disclosure. Thirdly, Tourism enterprises operating under the licensing and oversight of the Malawi Tourism Act are expected to comply with professional hospitality standards. These standards typically require enterprises to maintain guest registers, identification details, payment information and travel records. Fourthly, globally accepted standards require tourism service providers to keep guests record confidential, protect identification documents, booking details and payment information, limit access to guest data to authorised staff.
How do or Should Tourism Enterprises Interact with Guest Information?
Tourism enterprises in Malawi routinely collect personal information from guests such as names, identification numbers, contacts, payment information, travel records and others during booking and checking in processes. Since this information constitutes personal data, enterprises must take reasonable measure to secure it. Failure to safeguard such information, such as leaving guest registers publicly accessible, disclosing guest details without consent, (like in my scenario above) or failing to protect electronic booking systems, may likely amount to; 1) violation of your guest’s constitutional right to privacy, 2) Breach of obligation under Electronic Transactions and Cyber Security Act, 3) Noncompliance with the Malawi Tourism Act (Formerly Tourism and Hotel Act) and 4) Non conformity with internationally accepted best industry practices. All these do impose a duty on Tourism enterprises to protect guest(s) information.
What should Tourism Enterprises Do, Then?
All Tourism Enterprises in Malawi are required both by legal frameworks and industry standards to safeguards guests’ personal information. Failure to uphold these obligations could expose your enterprises to legal liability, regulatory sanctions and reputation damage.