PCPD: Half of online travel sites default direct marketing option as 'agreed'

Half of the online travel platforms have defaulted the direct marketing option for users as "agreed", according to the latest report from Hong Kong's privacy watchdog.

The Office of the Privacy Commissioner for Personal Data (PCPD) previously reviewed 10 online travel platforms commonly used by citizens to understand how these platforms collect and use the personal data of their users, including Agoda, EGL Tours, Expedia, Goldjoy Holidays, Miramar Travel, Sunflower Travel, Travel Expert, Trip.com, Wing On Travel and WWPKG.

It then released a report titled “A Study of the Collection of Personal Data by 10 Online Travel Platforms”. The report found that all the platforms reviewed track user activities on their platforms, collecting data such as user location information and browsing histories.

While all reviewed platforms have gotten users' consents for direct marketing, Sunflower Travel only provides an option for users to provide their bundled consents. Expedia, Goldjoy Holidays, Travel Expert, Trip.com and Wing On Travel provide users with the option to accept or decline the use of their personal data for direct marketing, but the default option is “agreed”.

On the other hand, the report also found that only seven of the online travel platforms reviewed have stated their data retention policies in their privacy policies, including Agoda, EGL Tours, Expedia, Goldjoy Holidays, Trip.com, Wing On Travel and WWPKG.

Expedia ranks the highest in the readability of its privacy policy amongst the 10 platforms for, among others, its succinct and clear presentation as well as effective use of headings and tables, said the report.

Users are not required to register for or log in to an account to make reservations or purchase some travel products on all the platforms reviewed, said the report. If users choose to register for an account, the platforms reviewed will collect one to six types of personal data in the registration process.

Meanwhile, four of the platforms reviewed including Agoda, Expedia, Trip.com and Wing On Travel, provide an option on the checkout page to automatically save the personal data entered by users; and Agoda and Expedia state in their privacy policies that they use artificial intelligence (AI) technologies to provide services which may involve the use of users’ personal data.

Ada Chung, the privacy commissioner for personal data, said “I am pleased to see that some operators of the online travel platforms have taken actions to improve the provision of privacy protection information and the user interface design of their platforms in the course of the review."

"The review aims to assist travel platforms in enhancing the quality of their services and increasing transparency in their collection of personal data. It also seeks to help citizens better understand the privacy protection policies and user interface design of these platforms, thereby strengthening the protection of personal data privacy when they place orders for travel products online," she added.

In view of the review results, the PCPD suggested the operators of online travel platforms to implement a personal data privacy management programme and appoint a data protection officer to monitor compliance with privacy regulations.

They should incorporate privacy-protecting elements into the design of platforms by adopting “Privacy by Design” and “Privacy by Default”. For instance, setting the most privacy-protective option as the default option and providing users with relevant consent options timely. They should only collect personal data that is necessary.

If a platform uses AI to process personal data for automated decision making or other purposes in its operation, the platform should disclose in its privacy policy the purposes of the use of AI and the categories of personal data involved, as well as provide a clear explanation on how users can exercise their options in this regard, said PCPD.

They should also ensure the reliability of the third-party service providers in the areas of privacy protection and data security; and provide sufficient user control, including preferences for receiving various messages, deletion of user records, and more.

Regarding the recent scammers impersonating operators of online travel platforms to perpetrate fraud, the PCPD urges members of the public to verify the authenticity of websites and social media pages before purchasing travel products online. They should stay vigilant about the merchants’ payment names and bank account numbers, and should only purchase travel products through official channels to avoid being cheated.

Related Articles:
PCPD slams SCAA for lack of care as over 72,000 members data leaked
The PCPD raises concerns over LinkedIn's default use of data for Gen AI
HK privacy watchdog opens probe into Oxfam HK's data breach