Compliance Corner - Global Privacy Data

Which policy is use as a guidance for the collection, use, disclosure, transfer, storage, protection, and retention of Personal Data?

• MIP - 91

• MIP - 01

• MIP - 12

• MIP - 29

Answer explanation

MIP-01 is Ethical Conduct

MIP-12 is Legal and Ethical Compliance Program

MIP-29 is Global Information Security Policy

MP-91 is Global Privacy Policy

What is meant when a statement refers to "any information relating to an identified or identifiable natural person"?

• Global Data

• Identification Data

• Personal Data

• Privacy Data

Answer explanation

Referring to MIP-91 Global Privacy Data:

- Personal Data is any information that relates to an identified natural person or to an identifiable person. This includes identifiers such as name, email address, phone number, or Marriott Bonvoy member number, as well as non-identifiers such as IP address, digital footprint, and location data.

- Sensitive Personal Data is a type of Personal Data that is more specific and unique.

Personal Data also known as ...

• Guest Full Name or Aliases

• Passport Number

• Personally Identifiable Information (PII)

• Credit Card Data

Answer explanation

Personal Identification Information (PII) examples include credit card number, passport number, and name.

What type of data that we need to consider as a Sensitive Personal Data?

• Medical information

• Guest Full Name

• Email Address

• IP Address

Answer explanation

Despite all the examples being considered personal identification information, some information is sensitive and requires greater care, such as medical records, race and ethnicity, tax numbers, and insurance numbers, which are considered Sensitive Personal Data.

Which one is not a Sensitive Personal Data?

• IP address.

• Credit card details.

• Political beliefs.

• Medical history.

Answer explanation

Despite IP address is also a personal data, it wasn't a sensitive personal data until the IP address become a precise geolocation information.

What Privacy Principle that should be provided to the guest about the data collection and how we will use the data called?

• Access & Correction

• Collection and Use

• Choice & Consent

• Notice

Answer explanation

Notice: The Company provides notice about its privacy policies and procedures and identifies the purposes for which Personal Data are collected, used, retained, and disclosed.

Choice & Consent: The Company describes the choices available to the individual and obtains implicit or explicit consent with respect to the collection, use, and disclosure of Personal Data when legally required or appropriate.

Collection & Use: The Company limits the use of Personal Data to the purposes identified in the relevant notices.

'Access & Correction': The Company provides individuals with the ability to exercise their individual rights related to their Personal Data as required by law and as appropriate.

What Privacy Principle that limit our capacity to the purpose identified in the relevant notices called?

• Access & Correction

• Collection & Use

• Choice & Consent

• Notice

Answer explanation

Notice: The Company provides notice about its privacy policies and procedures and identifies the purposes for which Personal Data are collected, used, retained, and disclosed.

Choice & Consent: The Company describes the choices available to the individual and obtains implicit or explicit consent with respect to the collection, use, and disclosure of Personal Data when legally required or appropriate.

Collection & Use: The Company limits the use of Personal Data to the purposes identified in the relevant notices.

'Access & Correction': The Company provides individuals with the ability to exercise their individual rights related to their Personal Data as required by law and as appropriate.

These options are availabe in the Privacy Right page on the Marriott International website, except ...

• Correct and Update My Personal Data

• Obtain a Copy of My Personal Data

• Delete My Personal Data

• Merging Loyalty Member Points

Answer explanation

You may request for data corrections, obtain the copy of your personal data collected by the Marriott International, delete your personal data, and object the further process of your personal data in the 'Privacy Right' page.

Loyalty Merging Points can only be done by contacting the Loyalty Member Support in the respective countries.

These are consequences that we might facing for the privacy violations, except ...

• Removal of diplomatic ties

• Disciplinary action including termination

• Millions of dollars in fines

• Reputational damage and loss of goodwill

Answer explanation

Privacy violations can result in:

- Disciplinary action, including immediate termination of employment.

- Criminal prosecution or civil sanction.

- Millions of dollars in fines.

- Reputational damage or loss of goodwill.

A guest is inquiring further assistance for their privacy right and decided to contact the [e-mail]. Which one do you think is correct?

• Yes, the guest can escalated their concern to [e-mail]

• No, [e-mail] is not the correct email address.