Data Privacy and Air Travel: 

State Privacy Laws

Presentation to the Advisory Committee for Aviation Consumer ProtectionNigel HowardMay 21st, 2013
Purpose – brief overview

• Important requirements of State privacy • Pre-emption for airlines 

─ Airline Deregulation Act - 49 USC §41713 ─ Relationship between State law and airline best pra

• Volume and variance in State privacy law

Businesses prefer one set of rules over 
Voluminous State Law

As of May 2013, state legislatures have enacted:• 46 security breach notification laws 

• 37 spam laws

• 24 phishing laws

• 29 data disposal laws

• 18 spyware laws

• 21 RFID privacy laws

• 11 data security laws• 3 online privacy laws• 9 workplace email and social media privacy laws
Consumer Protection Statutes

• Every State has a “mini-FTC Act”

– forbids unfair and deceptive trade practic

– enforced by State regulators and private rig

action

• Similar to FTC authority under §5 of FT

– DOT has the same authority under ADA § 4
California Online Privacy Protection A

• Post a conspicuous link to the privacy policy

• Identify in the privacy policy

– categories of PII collected– categories of third parties with whom PII may be sha

• Disclose in the privacy policy

– privacy policy’s effective date– how consumers can learn about changes to the priva– how consumers can review and make changes to sto

Since 2004 “CalOPPA” has required online serviccollect PII from consumers to:

Cal. Bus. & Profs. Code §§ 22575-22579
California “Shine the Light” Law

• Provide a consumer, upon request, with an an

report of third-party recipients of the consumer

• Exceptions for businesses 

– that provide a public privacy policy and an opt-out– have fewer than 20 employees

• Applies if a single customer is located in CA

Requires businesses that collect PII fromconsumers to:

Cal. Civil Code §§ 1798.83-1798.84
Data Security & Data Destruction

• A number of states require “reasonable securit

procedures”

• Some states have more prescriptive security req

– Massachusetts (200 CMR 

§ 17.00)

• Written information security program• Encryption• Oversee service providers

– Nevada (Nev. Rev. Stat. ch. 603A)

• Codifies PCI-DSS requirements• Encryption

• Many states have minimum standards for the pro

destruction of records containing PII
State Data Breach Laws

• 46+ states have breach notification laws• Vary a great deal in their requirements

– “Personal Information” definition– notice obligations– content of notices– timing requirements

• Who should provide the notice?

– Variety of treatment for “owners” vs “non-ow– Best practice = agree upon process with “no

owner” via contract
Airlines

• Airlines are regulated by the DOT• ADA §41713 preempts State law in relatio

“price, route, or service of an air carrier” 

– Supreme court has construed this broadly

• Morales v. Trans World Airlines, 504 U.S. 374 (19

• Boundaries re: privacy recently re-affirm

– CalOPPA case dismissed against Delta

• California v. Delta Air Lines, Inc., No. CGC-12-52

(Cal. Super. Ct. San Francisco, filed May 9, 2013
Airlines

• Relationship between State laws and air

privacy practices

– guides development of airline best 

practices

– some State laws are not pre-empted
GDSs, OTAs and TAs

• All regulated by the FTC and State laws • No State law or FTC enforcements to da• GDS is B2B and not consumer facing

– but owners of GDSs are also offering consu

facing tools

• e.g., checkmyflight.com, Tripcase, TravelView
Conclusion

• State privacy laws set important requirem• State law guides best practices• But volume and variance is a burden 

Businesses prefer one set of rules over 
Questions?