21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 1 of 19 

# Consumer Privacy and Air Travel: Recommendations to the U.S. Department of Transportation, Advisory Committee for Aviation Consumer Protection



### Washington, DC 21 May 2013 

# EDWARD HASBROUCK21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 2 of 19 

### “ Privacy is the Achilles heal of travel planning.... Travel planning necessarily involves revealing a more comprehensive and intimate personal profile than does anything else you're likely to do on the Internet, short of cybersex. And there are fewer legal protections for travel information than for any other comparably revealing category of business information.” (“The Practical Nomad Guide to the Online Travel Marketplace”, 2001)21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 3 of 19 

# Is there a privacy problem with the airline industry? If so, what is the problem? What should DOT do about it?21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 4 of 19 1. Notice 2. Data Limitation and Retention 3. Choice and Control 4. Security 5. Access 6. Accountability, Enforcement and Redress 

## Privacy problems with the practices of airlines, travel agencies, and CRSs/GDSs:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 5 of 19 

### “ We do not place limitations on our suppliers' use or disclosure of your personal information. Therefore, we encourage you to review the privacy policies of any travel supplier whose products you purchase through [us].”

“ We encourage you to read the privacy statements of all such Third Party Suppliers as their policies may be materially different from this Privacy Policy.”



# “ Opaque” airfares? Unknown suppliers?21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 6 of 1921 May 2013 Edward Hasbrouck (www.hasbrouck.org) 7 of 1921 May 2013 Edward Hasbrouck (www.hasbrouck.org) 8 of 19 

# How common are privacy breaches? Without access logs in PNRs, we have no way to know. Most “look but don't touch” attacks on CRS/GDS data leave no traces, and go undetected unless a perpetrator is caught in the act or confesses.21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 9 of 19 1. Lack of geographic or purpose limitations on access. (Any geographic or purpose limitations are policy-based, not implemented through technical measures to control access.) 2. Insufficiently granular access privileges. Lack of data structures for tracking authorized uses or jurisdiction applicable to PNR elements. 3. Lack of access logs in PNR histories. (Precludes detection or accountability for security breaches or violations of access policies.) 4. Lack of tools to facilitate responses to consumer requests for access to information stored in CRSs/GDSs by airlines, travel agencies, etc. 

## CRS/GDS practices that needlessly enhance privacy vulnerabilities:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 10 of 19 1. Failure to accept full responsibility for actions (including data collection, usage, and storage) by airlines' agents, for which airlines are responsible as the principals to the transactions. 2. Failure to educate travel agencies and agents about their responsibility to fulfill airlines' privacy responsibilities and comply with their privacy policies when they act as airlines' agents (including responsibility to comply with the laws applicable to foreign airlines when they act as agents of those foreign airlines). 3. Failure to insist that CRSs/GDSs implement the functionality necessary for airlines to respect their customers” privacy. 

## Airline practices that undermine consumers'/travellers' privacy:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 11 of 19 1. Failure to educate themselves about their responsibility to fulfill airlines' privacy responsibilities and comply with their privacy policies when they act as airlines' agents (including responsibility to comply with the laws applicable to foreign airlines when they act as agents of those foreign airlines). 2. Failure to insist that CRSs/GDSs implement the functionality necessary for travel agencies to respect their customers” privacy. 

## Travel agency practices that undermine consumers'/travellers' privacy:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 12 of 19 1. “ What data is kept about me? Who has it? Where is it stored?” 2. “ Who has accessed data about me?” (Note that this is different from, “Who is supposed to be authorized to access data about me?”) 3. “ Who is responsible for providing me with access to data about me?” 4. “ How do I request my data? What rules apply to my request?” 5. “ If I ask for all your data about me, will I actually receive all of the information about me which which you or your agents have? How can I tell if the response is complete or correct?” 

## Access by consumers/travellers to information about themselves:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 13 of 19 1. “ To whom can I complain (especially if several companies, subject to different jurisdictions, each say that the other one is responsible)?” 2. “ What is the procedure for making a complaint?” 3. “ Are complaints of privacy violations logged or reported?” 

## Accountability, Enforcement and Redress:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 14 of 1921 May 2013 Edward Hasbrouck (www.hasbrouck.org) 15 of 19 

### “ I am providing you this letter at the request of the U.S. Department of Commerce to explain the role of the Department of Transportation in protecting the privacy of consumers with respect to information provided by them to airlines.... The Department recognizes... that ... it is essential that the airlines that commit to ... privacy principles ... in fact abide by them.... Therefore, using its existing consumer protection statutory authority, the Department will ensure airline compliance with privacy commitments made to the public, and pursue referrals of alleged non-compliance that we receive from self-regulatory

organizations and others.” (DOT letter to the European Commission, 14 July 2000; European Commission “Safe Harbor” decision, Annex VI)21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 16 of 19 1. Travel is a right which the DOT is required to consider and respect (49 USC § 40101, 49 USC §40103). 2. Airlines are common carriers (by treaties and U.S. law). 3. Restrictions or conditions on the exercise of the right to travel, or on travel by common carrier, are subject to strict scrutiny. This includes requirements for disclosure of personal information or consent to use, onward transfer, or retention of information as a condition of travel. 4. Misleading consumers about privacy practices is fraud. 

## Basis and principles for DOT action to protect air travellers' privacy:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 17 of 19 1. Require privacy policies to be included in conditions of carriage. 2. Add a “privacy” tab to the DOT aviation consumer protection Web site including information on the privacy obligations of airlines, travel agencies, and CRSs'/GDSs, and on DOT privacy complaint procedures. Log and report privacy complaints as a distinct category. 3. Establish a working group and publicly-designated point of contact within the DOT specifically charged with responsibility for privacy policy, privacy enforcement, and consultation and coordination with other agencies on privacy policy and enforcement issues. 

## Recommendations for DOT action:21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 18 of 19 Frequently-Asked Questions to be answered in a “Privacy” section of the DOT Aviation Consumer Protection Web site:

● “ What are my rights? How can I tell what rules apply to my travel information, especially when multiple companies are involved?”

● “ Are there any policies or practices that are forbidden or required?”

● “ How can I tell who to ask about my travel information?”

● “ How can I make a privacy complaint to the DOT about an airline, travel agency or agent, or airline reservation company?”

● “ What is the procedure and timeline for handling my complaint?”

● “ What can I do if I'm not satisfied with DOT's response?”21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 19 of 19



# EDWARD HASBROUCK "The Practical Nomad" edward@hasbrouck.org +1-415-824-0214 http://www.hasbrouck.org