Data Privacy and Air Travel:State Privacy LawsPresentation to the Advisory Committeefor Aviation Consumer ProtectionNigel HowardMay 21st, 2013Purpose– brief overview•Important requirements of State privacy laws•Pre-emption for airlines─Airline Deregulation Act - 49 USC §41713─Relationship between State law and airline best practices•Volume and variance in State privacy law2Businesses prefer one set of rules over 50VoluminousState Law3As of May 2013, state legislatures have enacted:•46security breach notification laws•37spam laws•24phishing laws•29data disposal laws•18spyware laws•21RFID privacy laws•11data security laws•3online privacy laws•9workplace email and social media privacy lawsConsumer Protection Statutes4•Every State has a “mini-FTC Act”–forbidsunfair and deceptive trade practices–enforced by State regulators and private right ofaction•Similar to FTC authority under §5 of FTC Act–DOT has the same authority under ADA § 417125California Online Privacy Protection Act•Post aconspicuous linkto the privacy policy•Identifyin the privacy policy–categories of PII collected–categories of third parties with whom PII may be shared•Disclosein the privacy policy–privacy policy’s effective date–how consumers can learn about changes to the privacy policy–how consumers can review and make changes to stored PIISince 2004 “CalOPPA” has required online services thatcollect PII from consumers to:Cal. Bus. & Profs. Code§§22575-225796California “Shine the Light” Law•Provide a consumer, upon request, with an annualreport of third-party recipients of the consumer’s PII•Exceptions for businesses–that provide a public privacy policy and an opt-out–have fewer than 20 employees•Applies if a single customer is located in CARequires businesses that collect PII fromconsumers to:Cal. Civil Code §§ 1798.83-1798.84Data Security & Data Destruction•A number of states require“reasonable securityprocedures”•Some states have more prescriptive security requirements–Massachusetts(200 CMR§17.00)•Written information security program•Encryption•Oversee service providers–Nevada(Nev. Rev. Stat. ch. 603A)•Codifies PCI-DSS requirements•Encryption•Many states have minimum standards for theproperdestruction of recordscontaining PII7State Data Breach Laws•46+ stateshave breach notification laws•Vary a great dealin their requirements–“Personal Information” definition–notice obligations–content of notices–timing requirements•Whoshould provide the notice?–Variety of treatment for “owners” vs “non-owners”–Best practice = agree upon process with “nonowner” via contract8Airlines•Airlines are regulated by the DOT•ADA§41713preempts State law in relation to“price, route, or service of an air carrier”–Supreme court has construed this broadly•Morales v. Trans World Airlines, 504 U.S. 374 (1992)•Boundaries re: privacy recently re-affirmed–CalOPPA case dismissed against Delta•California v. Delta Air Lines, Inc., No. CGC-12-526741(Cal. Super. Ct. San Francisco, filed May 9, 2013)9Airlines•Relationship between State laws and airlineprivacy practices–guides development of airline bestpractices–some State laws are not pre-empted10GDSs, OTAs and TAs•All regulated by the FTC and State laws•No State law or FTC enforcements to date•GDS is B2B and not consumer facing–but owners of GDSs are also offering consumerfacing tools•e.g., checkmyflight.com, Tripcase, TravelView11Conclusion•State privacy laws set important requirements•State law guides best practices•But volume and variance is a burden12Businesses prefer one set of rules over 50Questions?13