1 BEFORE THE DEPARTMENT OF T RANSPORTATION ADVISORY COMMITTEE ON AVIATION CONSUMER PROTECTION
STATEMENT OF MICHAEL VATIS, STEPTOE & JOHNSON LLP ON BEHALF OF GLOBAL DISTRIBUTI ON SYSTEMS AMADEUS, SABRE, AND TRAVELPORT

May 21, 2013

Madam Chair and Members of the Committee, My name is Michael Vatis. I am a partner at the law firm of Steptoe & Johnson, and I am here today to speak on behalf of the Global Distribution System members of the Travel Technology Association, specifically , Amadeus, Sabre, and Travelport. These three GDSs are the largest GDSs globally and in the United States. I am pleased to be here today to share with you information about how the GDS system works, and how GDSs protect the personal information of airline traveler s. Although I am speaking on be half of all three GDSs, my knowledge is greatest with respect to Amadeus, as it is a Steptoe client. So I may make more specific references to the way Amadeus operates to illustrate key points. GDSs serve two sides of the air travel marketplace, travel ag ents and airlines. Airlines provide GDSs with constantly updated information about the flights they offer and the fares and seat availability on each flight. The GDS then provides the tool by which travel agents can access the vast amount of information provided by the airlines through appropriate searches and make bookings on behalf of consumers, and then store, change, and service those bookings. In this trilateral relationship, the travel agent ty pically has an agreement with the airline under which the airline enables the agent to sell the air line’s services, and the travel agent and airline2 must each have agreements with the GDS regard ing utilizing the GDS in creating and issuing travel itineraries. Virtually all network airlines (and a significant number of low- cost carriers) participate in each of the GDSs. Agents often utilize the services of one GDS, but can and do use more than one GDS. Travel agents use a GDS to determine what flights are offered between the points the passenger seeks to travel, the availability of seats on any particular flights, the relevant fares and other pertinent information. The GDS also provi des to the agents the facility to make the booking on the chosen flight and important back -office functions that allow the agency to maintain required records. When a consumer seeks to buy a seat on an air line, the travel agent enters the relevant data about the passenger and her itinerary into the GDS, and thereby creates a Passenger Name Record (PNR). Any modification in the itinerary will also be en tered by a travel agent into the GDS. The GDS then transmits that information to the airline, which accepts the reservation on behalf of the consumer/passenger. The GDS has no direct interaction with the consumer during this process. Generally, the consumer is unaware of the role of the GDS or the identity of the GDS used by the travel agency. A PNR contains the details of a passenger's re servation and other information related to a passenger's trip. To create a PNR into a GDS, a travel agent must include at least the following data:
• Name • Itinerary • Contact information • Ticketing information (i.e., when th e ticket is going to be issued)3 • Received From (i.e., the travel agent w ho has created or modified the ticket) The PNR may also contain other data, su ch as frequent flier information. Only the travel agent, airline or airlines if the travel involves more than one airline, and the GDS have access to the PNR, unless one of them permits access by a third party. The GDSs do not disclose personal information to third parties except where necessary to fulfill any bookings, purchases, or requests, or for credit checks or fraud pr evention; when required by law; or when necessary to comply with a lawful re quest by government authorities or a court. When personal data is transferred to a third party, as is required in order to fulfill a booking, it is typically the policy of each GDS to require through provisions in contractual arrangements that the party to which the data is transferred agree to abide by applicable privacy and data security laws and policies. Amadeus, for example, has exp licit provisions in its contracts with both travel agency subscribers and with air line and other travel pr oviders that impose mutual obligations to adhere to applicable laws gove rning the privacy of data. GDSs generally retain PNR data for 72 hours afte r the flight departure of the last segment on an itinerary. After that, the da ta is taken out of the system a nd stored offline for a period of several years, before it is permanently erased. Th e purpose of this archiving is generally to allow travel agents or airlines to resolve any billing disputes. GDSs operate in dozens of jurisdictions globa lly, many of which ha ve their own privacy laws and regulations. Each of the GDSs undertakes to comply with the privacy laws and regulations of the jurisdictions in which they op erate, including those gov erning data privacy and security. In particular, Amadeus, which is ba sed in Spain and maintains its data center in Germany, is subject mainly to the European Data Protection Directive. Th at Directive creates a comprehensive regime regarding the protection of personal information.4 Each GDS has employees that manage program s designed to protect personal information from unauthorized use, disclosure, destruc tion, or alteration. Th ese programs comprise technical, physical, and administrative measures . The technical measures include encryption technology to ensure the secure transmission of confidential info rmation, including credit card details. They also include authentication tec hnology, including password protections, to prevent unauthorized access to such data. In all cases, passenger data is made available only on a “needto-know” basis; unless th ere is an agreement to the contrary, personal data compiled by one travel agency and entered into the GDS is not sh ared with any other travel agency or with any entity other than the travel prov iders or others who may need to have the data to provide service to the passenger. With regard to privacy, it is important to note the different appro aches taken by Europe and the United States. In the European Un ion, GDSs are regulated by Council Regulation (EC) No. 80/2009, which established a Code of Conduct . The Code of Conduct is generally designed to ensure fair competition in the provision and use of GDS services. It also, however, requires that the privacy of end consumer s be respected. In particular, Article 11 of the Code provides, among other things, that:

• personal data collected for the purpose of making reservations or issuing tickets shall only be processed in a way compatible with these purposes;

• personal data shall only be processed inso far as processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;5 • sensitive data (concerning racial or ethni c origin, political opi nions, religious or philosophical beliefs, trade-union membership, or health or sex life) shall only be processed where the data subject has given his or he r explicit consent on an informed basis;

• personal information concerning identifiable in dividual bookings shall be stored offline within seventy-two hours of the completion of the last element in the individual booking and destroyed within three year s. Access to such data sha ll be allowed only for billingdispute reasons; and

• marketing, booking and sales data shall include no identification, either directly or indirectly, of natural persons or the organiza tions or companies on whose behalf they are acting. In addition, when personal data has been coll ected in the EU, the ac tors involved in the collection and processing of the data must comply with the Eur opean Data Protection Directive (95/46/EC), the principal data protection law in the EU. The Directive applies to the data collected in any of the 27 EU Member Stat es plus Iceland, Liechtenstein, and Norway. The Directive and national implementing legislation in each country impose stringent data protection requirements on the processing of personal information from persons subject to the Directive. Among other things, the Directive requires that:

• personal data be processed fairly and lawf ully, and collected for specified explicit and legitimate purposes. The data must also be accurate and, where necessary, kept up-to-date;

• personal data be processed only if the data subject has unambiguously given his or her consent or where processing is necessary:6 o for the performance of a contract to wh ich the data subject is a party or in order to take steps at the request of th e data subject prior to entering into a
contract;

o for compliance with a legal obligation to which the data controller is subject;

o in order to protect the vital interests of the data subject;

o for the performance of a task carrie d out in the public interest; or

o the for purposes of legitimate interests pur sued by the data controller or a third party to whom the data is disclosed;

• the data controller provide th e data subject with certain in formation (the identity of the data controller, the purposes of the pr ocessing, recipients of the data, etc.);

• the data subject be allowed access to his data in order to rectify errors or have the data erased or blocked;

• the data subject have the right to object to further processing of such data;

• the data controller implement appropriate measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access; and

• the data controller notify the relevant national supervisory authority about the processing before carrying out processing operations. Companies within Member States may not tr ansfer personal information to a non-EU state unless that country has been deemed to provi de an adequate level of protection; the data subject unambiguously consents to the transfer; the transfer is n ecessary for the performance of a contract between the data subjec t and the controller or the im plementation of pre-contractual measures taken in response to the data subject ’s request; the transfer is necessary for the7 conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party (whi ch is generally the case for GDS bookings); the transfer is necessary or legally required on important public interest grounds or for the exercise or defense of legal claims; or the transfer is necessary to pr otect the vital interests of the data subject. Such a transfer is also permitted if the company u tilizes approved binding corporate rules or standard contractual clauses to ensure the protection of data by the receiving entity. The United States as a whole has not been deemed by the EU to provide adequate protection. However, under the EU-U.S. Safe Harbor Framework, EU data can be transferred to U.S. companies that certify that they will abide by the Safe Harbor principles. These principles generally require U.S. companies to provide data protection commensurate with the requirements of the EU Data Protection Directive. As a co mpany with significant ope rating facilities in both the EU and the U.S., Travelport has held a Safe Harbor certification since 2010. In the United States, by contrast, there is no ge neral data protection directive. Rather, at the federal level, data protecti on rules are establishe d on a sector-by-sector basis. Thus, the Gramm-Leach-Bliley Act establishes privacy and s ecurity requirements for financial institutions, and the Health Insurance Portability and A ccountability Act (HIPAA) does so for certain healthcare companies. In addition, the Federal Trade Commission in recent years has begun to assert its general power to police “unfair and deceptive practices” in commerce to bring enforcement proceedings against companies that it believes have provide d inadequate protection to personal information. The Department of Tr ansportation also administers a similarly broad prohibition, found at 49 U.S.C. 41712, against unfair and deceptive pr actices in the sale of air transportation. Airlines and ticket agents, which in clude GDSs, are subject to this statute.8 At the state level, 46 states plus the District of Columbia , Puerto Rico, Guam, and the U.S. Virgin Islands have passed laws requiring co mpanies to notify affected individuals and, in some cases, regulators if certain personal informa tion about a state resident has been breached. In addition, states such as Massachusetts have begun to establish laws and regulations requiring companies to institute data security programs a nd procedures to protect personal information of state residents. The GDSs are highly respectful of the legitimate interests of passengers in maintaining the confidentiality of travel data and of the policies underlying the laws noted above. They also conduct regular data privacy training and certifi cation for their employees. The industry is justifiably proud of its long and successful record of maintaining high data security standards and taking all reasonable steps to avoid improper disclo sures. They will be pleased to provide any further information that the Committee may require in this area. I hope this brief statement has been useful in describing the operation of GDSs and the ways they prot ect consumer data, and general privacy frameworks in the EU and U.S. I would be happy to take any questions you might have. Thank you.