Strategies for Global Brands in Navigating Data Localization Requirements
By Wendy Hansen
Co-authored by Michael Bahar, Partner, Rhys McWhirter, Partner, Andrew Garbett, Principal Associate, Jamie Leung, Associate, & Lucrezia Berto, Legal Officer, Eversheds Sutherland
It is a well-known fact that hotels collect tremendous amounts of data and the value of that data is only increasing.
Guest data ranges from basic contact information to fulfill a room reservation to sensitive information related to age, gender and food allergies.
Beyond the front desk, data is collected and processed in managing hotel staff and contracting with service providers.
Increasingly, however, governments are implementing data localization requirements that present substantial challenges to a global, "one brand" approach to hotel operations. If guest histories and preferences cannot be transferred cross-border, it may be difficult to deliver on a brand promise of personalized service. It can also be challenging for the human resources department to manage career progressions or implement diversity, equity and inclusion initiatives if employee data cannot be transferred cross-border. Implementing advanced technologies like facial recognition and other uses of Artificial Intelligence and biometrics may also face obstacles with the restriction on the free-flow of data. Service providers may also be unwilling or unable to offer localized solutions due to these requirements.
How can global brands best manage these requirements from a practical perspective? This article will give an overview of data localization, including summaries of key data transfer requirements in the European Union and the United Kingdom, Mainland China and the Middle East, and it will conclude with three strategies for global brands to address such requirements - (1) map it, tag it and track it; (2) aim for a globalized, risk-based approach; and (3) increase the use of clear, affirmative consents. The strategies can also help as other countries move to adopt their own data sovereignty laws.
Data Localization
What is data localization? Data localization refers to the concept that any data collected within a country must be collected, processed and stored locally or "in country," and restrictions may apply to any transfer of such data outside the country. The often-stated purpose of data localization laws is to protect the privacy of individuals within the country, although there are elements of trade protectionism in the practice. For example, requiring a company to store data locally or use local suppliers helps develop the local economy, and the underlying data itself is an increasingly valuable asset, particularly to fuel Artificial Intelligence capabilities and even for national security purposes.
European Union and the United Kingdom
The adoption of the General Data Protection Regulation (GDPR) in the European Union has impacted how companies do business and share data worldwide. The GDPR applies to businesses and other entities established in the EU and, in certain circumstances, to entities in foreign countries that process the data of individuals in the EU. It sets out principles and rules that must be followed in order to avoid sanctions and fines, which can reach €20 million or 4% of worldwide annual turnover.
Transfers of personal data to countries outside the European Economic Area are allowed only if the recipient country is recognized as providing "adequate" protection or if another safeguard set out in the regulation applies. The list of so-called adequate countries is currently limited to fewer than 20 nations, including Argentina, Japan and Switzerland, and it does not include the United States. Relying on the consent of the individual affected is often not an appropriate safeguard, and in practice, many transfers to non-adequate countries are based on a contract between the entities involved, under which the recipient agrees to comply with the GDPR. The existence of that contract - typically the Standard Contractual Clauses (SCCs) - does not alleviate the data protection responsibilities of the exporting entity, as it still must assess the impact of the transfer on the data and periodically review the recipient's compliance with the agreement.
The process for transfers of data from the EU to the US has recently been simplified with the creation of the Data Privacy Framework (DPF), the successor to the overturned Privacy Shield, to which US companies can now certify in order to enable the freer flow of personal data. Not all US companies participate in the framework, and the list should be checked before any personal data is transferred.Â
After Brexit, the UK incorporated the GDPR into UK law, with little change to the original principles, rights and obligations. The rules about cross-border transfers of personal data are substantially similar to those set out in the GDPR, and the DPF with the US has been extended to meet the UK standards for data transfers as well.
The regime applicable to international transfers affects how hotels established in the EU and UK can share their guests' and employees' personal data with their suppliers and group companies. The relationship with foreign suppliers involving transfers of personal data must be carefully analyzed and based on adequate safeguards, and assessments of the impact of the transfer on the personal data affected must be performed prior to engaging the supplier and periodically during the provision of the services.
Since the DPF is likely to face its own challenges in the EU courts, relying on both the SCCs and the DPF may be the safest long-term solution for multinational hotel chains. They can also consider creating "binding corporate rules" as an alternative to intragroup data agreements. Binding corporate rules are a mechanism providing appropriate safeguards for cross-border transfers of data within a group of companies, provided that they meet the requirements of the GDPR and are approved by a competent supervisory authority. For this reason, they must be carefully drafted and submitted for approval.
Mainland China
Under Mainland China data protection laws, certain data including personal data of Mainland China individuals must be stored in Mainland China unless it is exported to other countries in accordance with laws and regulations. Notably, offshore remote access to data stored in Mainland China is also caught under cross-border data transfer.
More specifically, there are three main mechanisms, collectively the Cross-Border Data Transfer Requirements, to lawfully facilitate cross-border personal data transfer under the Personal Information Protection Law:
(1)Â Passing the security assessment (CAC Security Assessment) carried out by the Cyberspace Administration of China (CAC).
(2)Â Obtaining certification from CAC-accredited professional institutions.
(3)Â Entering the China standard contractual clauses with overseas data recipients (PRC SCCs).
Currently, a data controller will be required to undertake the CAC Security Assessment if it meets any of the following thresholds:
(i)Â Â A data controller transfers any "important data" (generally referring to any data that once tampered with, damaged, leaked, or illegally obtained or used may endanger national security or public interest) outside Mainland China.
(ii)Â A critical information infrastructure operator or a data controller processing personal data of more than 1 million Mainland China individuals transfers personal data outside Mainland China.
(iii) Personal data of more than 100,000 individuals has been exported outside Mainland China since January 1 of the previous calendar year.
(iv) Sensitive personal data of more than 10,000 individuals has been exported outside Mainland China since January 1 of the previous calendar year
A data controller may only leverage the PRC SCCs or certification from CAC-accredited agencies to transfer personal data outside Mainland China if it does not meet any of the above thresholds. Given the personal data and sensitive personal data collected from hotel guests and employees, it is very likely that international hotel companies will exceed the thresholds above and be required to pass the CAC Security Assessment.
Separately, the Personal Information Protection Law also requires data controllers to obtain "separate consent" from Mainland China individuals for exporting their personal data outside Mainland China. As market practice, organizations typically do so by implementing an individual consent "checkbox" for transferring personal data overseas. This checkbox is to be separated from other items of consent for data processing. Deemed or "bundled" consent is unlikely to be sufficient.
On September 28, 2023, however, the CAC released the Consultation Draft of the Regulations on Standardization and Promotion of Cross-border Data Flow (the Draft Regulations), which propose new exemptions to the Cross-Border Data Transfer Requirements. It should be noted that the Draft Regulations are not final and may be subject to further change. It is generally expected that the Regulations will be published in final form and become effective before December 2023. (Note that this article was submitted for publication prior to December 2023.)
It is proposed that entities be exempt from all Cross-Border Data Transfer Requirements in any of the following cases:
(1)Â Personal data is collected and generated outside Mainland China and then transferred outside Mainland China.
(2)Â The export of personal data is necessary for the conclusion and performance of a contract to which the data subject is a party, such as cross-border purchases, cross-border remittance, flight and hotel bookings, and visa applications.
(3)Â The export of internal staff's personal data is necessary for an entity's human resource management implemented in accordance with lawfully established labor rules and regulations and collective bargaining contracts.
(4)Â The export of personal data is necessary for protecting the life, health, property, safety, etc. of natural persons in emergency situations.
(5)Â Personal data of fewer than 10,000 individuals is expected to be transferred outside Mainland China by an entity within a year.
(6)Â For entities registered in free-trade zones, the export of the types of personal data that are not listed on the "negative list" formulated by the relevant free-trade zone and approved by the CAC.
Separately, it is proposed that an entity is exempt from the CAC Security Assessment if personal data of more than 10,000 but fewer than 1 million individuals is expected to be transferred outside Mainland China by the entity within a year and the entity has filed the executed SCC with the CAC or obtained certification from CAC-accredited agencies.
While the Draft Regulations would help facilitate the types of data hotel companies need to transfer cross-border, it is important to note there remain areas of uncertainty in the proposed law. For example, it is unclear what the regulators will consider "necessary" with respect to exemptions (2) – (4) above.
As a reminder, the proposed exemptions in the Draft Regulations are also subject to carve-outs; e.g. they may not apply to the export of personal data or important data by government bodies or critical information infrastructure operators, or the export of sensitive data or sensitive personal data relating to Mainland China's political party, the government, the military or a classified agency.
Middle East
Several countries in the Middle East have recently enacted data protection laws. Given the lack of previous specific data protection regimes in those countries, this has significantly changed the position when it comes to the treatment of information about individual guests, employees, etc. In addition to the restrictions on international transfers of personal data set out in those laws, there has also been a trend in the region toward "data sovereignty" more generally.
The United Arab Emirates (UAE), which includes Dubai, is a major center for the hotel industry in the Middle East. In 2021, it enacted its first national law for the protection of personal data. In many ways, this law reflects the concepts underlying the EU's GDPR, although inevitably with differences that reflect local culture. It applies to businesses and other entities established in the UAE and to entities outside the UAE that process data about individuals in the UAE. The law is not yet being actively enforced, pending the issue of its executive regulations, but strictly speaking, compliance is already required and, in any event, individuals are likely to expect the businesses they deal with to comply with high standards in handling their personal data.
The UAE law prohibits the transfer of personal data out of the UAE to another country unless the data controller either has the consent of the data subject or can show that one of several other conditions applies. These include the recipient country having an adequate data protection regime, that the transfer is "necessary" to enter into or perform a contract with the data subject and that the recipient enters into a contract agreeing to comply with the UAE data protection law.
Clearly, there are potential problems with relying on these other grounds, so in practice, obtaining clear and freely given consent from the data subject is usually the best course. That is all the more important, as there are other laws, such as the Penal Code and the Cybercrimes Law, which prohibit the disclosure of "confidential" information without consent unless there is some other lawful authority, which is undefined and therefore difficult to rely on.
Saudi Arabia also restricts the transfer of personal data out of the country. Under its new data protection law, transfers of personal data will be permitted only to countries on the "Approved List," which is to be - but has not yet been - issued by the Saudi data protection regulator. In addition, the transfer must be for one of a limited number of purposes, including that it is "necessary" for fulfilling an obligation to which the data subject is a party. Any transfer of personal data out of Saudi Arabia therefore faces significant hurdles.
As a result, it is not straightforward for hotels in the Middle East to share data about their guests or employees with companies in other countries, even if those companies are in the same business group. It can therefore be difficult to operate hotels in the Middle East as part of a seamless global business and to serve guests as they move around that business's hotels in other parts of the world.
Strategies for Global Brands
As noted above, data localization requirements present real challenges to hotel operations. Three strategies for global hotel companies to navigate these varying and rapidly developing requirements are set out below:
1. Map it, tag it and track it. It is increasingly essential to know your data and to be nimble and agile in handling it. Hotel companies would do well to understand the origin, type, volume and purposes of personal data collected and processed by each group entity. They may want to "map it, tag it and track it" from cradle to grave, and they should consider separating that which needs to flow across borders and that which can remain local. Having this deep, pragmatic understanding and agility is key to assessing whether and how data transfer requirements apply, whether exemptions are available, and whether it makes business sense to transfer the data across borders.
2. Take a globalized approach. Aim for a globalized, risk-based approach to implementing requirements. It can be overwhelming to focus on the differences in regulations among jurisdictions. Instead, seek commonalities in privacy and data rules, and focus on where they are the same, while taking into consideration the risk of regulatory enforcement. As volatile as the global privacy field is, there is a strong degree of regulatory convergence, which multinational hotels can leverage to create more globalized, streamlined and future-proofed data-sharing arrangements.
3. Increase the use of consent. Obtaining the data subject's clear, unambiguous and affirmative consent to transfer their data cross-border, where appropriate, can go a long way to meeting requirements. In considering global consent strategies, hotel companies should evaluate whether separate consents are required. In particular, "separate consent" is required not only for transferring personal data outside Mainland China but also for processing sensitive personal data and sharing personal data with third-party data controllers, etc.
Data localization requirements are part of an ever-evolving data privacy landscape. We encourage our clients to closely monitor the development of the law and be prepared to respond to any new change in the cross-border data transfer requirements.
This article was co-authored by the following:
Michael Bahar Partner, Co-Lead of Global Cybersecurity and Data Privacy, Eversheds Sutherland
Mr. Bahar is a Partner and Co-Lead of Global Cybersecurity and Data Privacy at Eversheds Sutherland. He sits in the Washington, DC office. He provides highly-responsive, pragmatic and comprehensive cybersecurity and privacy law advice to some of the world's largest companies. He has particular experience in helping businesses across industries efficiently navigate the rapidly evolving threat, regulatory and litigation environments. His business-focused legal advice is designed to mitigate risk and maximize opportunities, especially when looking to enter new markets, develop or adopt revolutionary technologies and products, monetize data and transfer data across borders. Leading a team of over 160 cybersecurity and data privacy lawyers across 35 countries, Mr. Bahar provides holistic and proactive advice to protect against, prepare for and effectively respond to cyber incidents. He provides calm and clear support during breaches, providing global teams with coordinated and consistent legal advice around the clock.
Rhys McWhirter, Partner, Head of Technology (Asia), Eversheds Sutherland
Mr. McWhirter is a Partner in the Eversheds Sutherland Hong Kong office and leads the Technology and Commercial Practice in Hong Kong. He has extensive experience in drafting and negotiating high-value and strategic commercial contracts and has acted for both government and private sector clients, particularly financial institutions throughout APAC on complex commercial and digital transformation projects. He has significant experience in advising leading financial services, mining and aviation multi-national companies in APAC on various strategic commercial and TMT related transactions, including infrastructure (private and public cloud), contact centre services, core-banking, telecommunications, enterprise software, data centre, facilities management and application outsourcing arrangements.
Andrew Garbett, Principal Associate, Eversheds Sutherland
Mr. Garbett is a principal associate in the Eversheds Sutherland commercial practice and is based in the Abu Dhabi office. He focuses on TMT matters across the MENA region, in particular on contractual and regulatory matters. Andrew has over 15 years' experience of commercial work, including contractual and transactional work on major projects for regional and global clients. Typical areas of work include advising on and drafting procurement and supply contracts, data protection issues, agency and distribution arrangements, commercialization agreements, and IP and IT matters.
Jamie Leung, Associate, Eversheds Sutherland
Ms. Leung is an Associate in the Technology and Commercial Practice in the Eversheds Sutherland Hong Kong office. She has a wide range of experience in data privacy, cybersecurity, payments, technology outsourcing and other regulatory matters. In respect of data privacy matters, she is particularly experienced in handling data protection requirements as part of commercial transactions, and advising MNCs on compliance with multi-jurisdiction data protection and transfer requirements. Most recently, Ms. Leung has advised regional and global clients in the hospitality sector on the complete revamp of their global data management and protection policies and the launch of a global loyalty programme.
Lucrezia Berto, Legal Officer, Eversheds Sutherland
Ms. Berto is a Legal Officer based in the Eversheds Sutherland Abu Dhabi office. She specialises in intellectual property, IT and data privacy non-contentious matters, advising regional and international companies across various sectors. Typical areas of work include IT contracts, commercialisation agreements, trademark and software licenses, personal data protection compliance, regulatory advice and IP/IT due diligences on software and OSS.
