21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 1 of 19

Consumer Privacy and Air Travel:

Recommendations to the U.S. Department of Transportation,

Advisory Committee for Aviation Consumer Protection

Washington, DC

21 May 2013

EDWARD HASBROUCK
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 2 of 19

“Privacy is the Achilles heal of travel planning.... Travel 

planning necessarily involves revealing a more comprehensive 

and intimate personal profile than does anything else you're 

likely to do on the Internet, short of cybersex. And there are 

fewer legal protections for travel information than for any other 

comparably revealing category of business information.”

(“The Practical Nomad Guide to the Online Travel Marketplace”, 2001)
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 3 of 19

Is there a privacy problem

with the airline industry?

If so, what is the problem?

What should DOT do about it?
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 4 of 19

1. Notice

2. Data Limitation and Retention

3. Choice and Control

4. Security

5. Access

6. Accountability, Enforcement and Redress

Privacy problems with the practices of 

airlines, travel agencies, and CRSs/GDSs:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 5 of 19

“We do not place limitations on our suppliers' use or 

disclosure of your personal information. Therefore, we 

encourage you to review the privacy policies of any travel 

supplier whose products you purchase through [us].”

“We encourage you to read the privacy statements of all 

such Third Party Suppliers as their policies may be 

materially different from this Privacy Policy.”

“Opaque” airfares?

Unknown suppliers?
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 6 of 19
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 7 of 19
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 8 of 19

How common are privacy breaches?

Without access logs in PNRs, we have no way to know.

Most “look but don't touch” attacks on CRS/GDS data

leave no traces, and go undetected unless 

a perpetrator is caught in the act or confesses.
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 9 of 19

1. Lack of geographic or purpose limitations on access. (Any geographic 

or purpose limitations are policy-based, not implemented through 

technical measures to control access.)

2. Insufficiently granular access privileges. Lack of data structures for 

tracking authorized uses or jurisdiction applicable to PNR elements. 

3. Lack of access logs in PNR histories. (Precludes detection or 

accountability for security breaches or violations of access policies.)

4. Lack of tools to facilitate responses to consumer requests for access to 

information stored in CRSs/GDSs by airlines, travel agencies, etc.

CRS/GDS practices that needlessly 

enhance privacy vulnerabilities:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 10 of 19

1. Failure to accept full responsibility for actions (including data 

collection, usage, and storage) by airlines' agents, for which airlines 

are responsible as the principals to the transactions.

2. Failure to educate travel agencies and agents about their responsibility 

to fulfill airlines' privacy responsibilities and comply with their 

privacy policies when they act as airlines' agents (including 

responsibility to comply with the laws applicable to foreign airlines 

when they act as agents of those foreign airlines).

3. Failure to insist that CRSs/GDSs implement the functionality 

necessary for airlines to respect their customers” privacy. 

Airline practices that undermine 

consumers'/travellers' privacy:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 11 of 19

1. Failure to educate themselves about their responsibility to fulfill 

airlines' privacy responsibilities and comply with their privacy 

policies when they act as airlines' agents (including responsibility to 

comply with the laws applicable to foreign airlines when they act as 

agents of those foreign airlines).

2. Failure to insist that CRSs/GDSs implement the functionality 

necessary for travel agencies to respect their customers” privacy. 

Travel agency practices that undermine 

consumers'/travellers' privacy:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 12 of 19

1. “What data is kept about me? Who has it? Where is it stored?”

2. “Who has accessed data about me?” (Note that this is different from, 

“Who is supposed to be authorized to access data about me?”)

3. “Who is responsible for providing me with access to data about me?”

4. “How do I request my data? What rules apply to my request?”

5. “If I ask for all your data about me, will I actually receive all of the 

information about me which which you or your agents have? How can 

I tell if the response is complete or correct?”

Access by consumers/travellers to 

information about themselves:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 13 of 19

1. “To whom can I complain (especially if several companies, subject 

to different jurisdictions, each say that the other one is responsible)?”

2. “What is the procedure for making a complaint?”

3. “Are complaints of privacy violations logged or reported?”

Accountability, Enforcement and Redress:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 14 of 19
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 15 of 19

“I am providing you this letter at the request of the U.S. 

Department of Commerce to explain the role of the Department 

of Transportation in protecting the privacy of consumers with 

respect to information provided by them to airlines.... The 

Department recognizes... that ... it is essential that the airlines 

that commit to ... privacy principles ... in fact abide by them.... 

Therefore, using its existing consumer protection statutory 

authority, the Department will ensure airline compliance with 

privacy commitments made to the public, and pursue referrals 

of alleged non-compliance that we receive from self-regulatory 

organizations and others.”

(DOT letter to the European Commission, 14 July 2000; 

European Commission “Safe Harbor” decision, Annex VI)
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 16 of 19

1. Travel is a right which the DOT is required to consider and respect 

(49 USC § 40101, 49 USC §40103).

2. Airlines are common carriers (by treaties and U.S. law).

3. Restrictions or conditions on the exercise of the right to travel, or on 

travel by common carrier, are subject to strict scrutiny. This includes 

requirements for disclosure of personal information or consent to use, 

onward transfer, or retention of information as a condition of travel.

4. Misleading consumers about privacy practices is fraud.

Basis and principles for DOT action to 

protect air travellers' privacy:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 17 of 19

1. Require privacy policies to be included in conditions of carriage.

2. Add a “privacy” tab to the DOT aviation consumer protection Web 

site including information on the privacy obligations of airlines, travel 

agencies, and CRSs'/GDSs, and on DOT privacy complaint 

procedures. Log and report privacy complaints as a distinct category.

3. Establish a working group and publicly-designated point of contact 

within the DOT specifically charged with responsibility for privacy 

policy, privacy enforcement, and consultation and coordination with 

other agencies on privacy policy and enforcement issues.

Recommendations for DOT action:
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 18 of 19

Frequently-Asked Questions to be answered in a “Privacy” section 

of the DOT Aviation Consumer Protection Web site:

● “What are my rights? How can I tell what rules apply to my travel 

information, especially when multiple companies are involved?”

● “Are there any policies or practices that are forbidden or required?”

● “How can I tell who to ask about my travel information?”

● “How can I make a privacy complaint to the DOT about an airline, 

travel agency or agent, or airline reservation company?”

● “What is the procedure and timeline for handling my complaint?”

● “What can I do if I'm not satisfied with DOT's response?”
21 May 2013 Edward Hasbrouck (www.hasbrouck.org) 19 of 19

EDWARD HASBROUCK

"The Practical Nomad"

edward@hasbrouck.org

+1-415-824-0214

http://www.hasbrouck.org