On November 18, 2024, the Office of the Privacy Commissioner for Personal Data (PCPD) announced that it inspected 10 online travel platforms' websites and mobile applications to understand how they collect and use the personal data of their users, and it released a report on it titled 'A Study of the Collection of Personal Data by 10 Online Travel Platforms.' The platforms inspected included Agoda, EGL Tours, Expedia, Goldjoy Holidays, Miramar Travel, Sunflower Travel, Travel Expert, Trip.com, Wing On Travel, and WWPKG.

What did the PCPD discover during the inspection?

The UODO enumerated certain practices regarding the collection of users' personal data by the platforms, such as:

• all platforms reviewed have displayed their privacy policies on their websites and mobile applications (if any);
• all platforms reviewed have stated in their privacy policies the purposes of the collection of personal data and the categories of third parties to whom the collected personal data may be transferred;
• only seven of the platforms reviewed have stated their data retention policies in their privacy policies;
• Expedia ranked the highest in the readability of its privacy policy for, among others, its succinct and clear presentation as well as effective use of headings and tables;
• all platforms reviewed track user activities on their platforms, collecting data such as user location information and/or browsing histories;
• all platforms reviewed have obtained users' consent for direct marketing;
• all platforms reviewed do not require users to register for or log in to an account to make reservations or purchase some travel products on;
• if users choose to register for an account, the platforms reviewed will collect one to six types of personal data in the registration process;
• four of the platforms reviewed provide an option on the checkout page to automatically save the personal data entered by users; and
• Agoda and Expedia state in their privacy policies that they use artificial intelligence (AI) technologies to provide services which may involve the use of users' personal data.

What recommendations did the PCPD make?

Considering the noted practices, the PCPD made the following recommendations to the operators of online travel platforms on the best practices and enhancement of privacy protection:

• implement a personal data privacy management program and appoint a data protection officer (DPO) to monitor compliance with privacy regulations;
• incorporate privacy-protecting elements into the design of platforms by adopting 'privacy by design' and 'privacy by default;'
• only collect personal data that is necessary;
• provide a clear and easy-to-understand privacy policy;
• enhance transparency in the processing of personal data by AI;
• provide a convenient option to delete accounts;
• ensure the reliability of the third-party service providers in the areas of privacy protection and data security;
• provide sufficient user control, including preferences for receiving various messages, deletion of user records, etc; and
• obtain users' consent for using personal data in direct marketing.

You can read the press release here and the report, only available in Chinese, here.