In June this year, I reported how the holiday operator TUI was putting children at risk by broadcasting their personal information over social media. Five months on, the company has finally responded.
TUI was compromising child safety in a hotel in Cancun by using WhatsApp to manage communication with parents of children in the hotel’s kids club.
Hotel staff would routinely broadcast the room numbers of children who needed collecting, and parents would often respond with names and room numbers of children. This information was broadcast to the entire group, meaning anyone in the WhatsApp group could easily compile a list of children’s names and their room numbers.
Worse still, staff failed to remove parents from the WhatsApp group after their holiday had finished. Months after my holiday in Cancun ended, I was still an active member of the group, able to read all the messages about the whereabouts of the children in the hotel.
TUI’s slow response
I reported the security failure to the TUI press office on June 5th, the week after I returned from my holiday, but didn’t receive a response.
When I tweeted about TUI’s failure to respond to my complaint in July, the TUI Twitter account replied, saying that I should “rest assured that as soon as this was brought to our attention this was investigated and resolved”.
Hi Barry, Apologies for only now getting a response to you. Please rest assured that as soon as this was brought to our attention this was investigated and resolved. ^Beth— TUI UK Cares (@TUIUKcares) August 2, 2019
Except that it wasn’t. At the time that TUI sent that tweet, I was still a member of the WhatsApp group, still able to see hotel staff and other parents broadcasting children’s names and room numbers. When I pointed this out to the TUI Twitter team, they fell silent.
In August, I wrote to the CEO and head of press at TUI, reiterating my complaint and urging them to do something about it. I received a reply from the Directors’ Office a week later asking for my holiday booking number, but received no further communication until last week.
Finally, on October 31st, someone from TUI’s Directors’ Office called me. They apologised for the time it had taken to respond to my complaint, assured me that it would now be dealt with, but said they would not be able to offer me any compensation. I’ve never asked for nor sought any compensation. I simply wanted them to stop putting children at risk in their resorts.
TUI’s response to this breach of child safety has been abysmal. It’s been slow and its Twitter team were blatantly wrong when describing the problem as being “resolved”. If you know of a TUI hotel that is still using WhatsApp to manage kids clubs, then please get in touch.