1 

BEFORE THE DEPARTMENT OF TRANSPORTATION ADVISORY COMMITTEE 

ON AVIATION CONSUMER PROTECTION 

STATEMENT OF MICHAEL VATIS, STEPTOE & JOHNSON LLP 

ON BEHALF OF GLOBAL DISTRIBUTION SYSTEMS AMADEUS, SABRE, AND 

TRAVELPORT 

May 21, 2013 

Madam Chair and Members of the Committee, 

My name is Michael Vatis. I am a partner at the law firm of Steptoe & Johnson, and I am 

here today to speak on behalf of the Global Distribution System members of the Travel 

Technology Association, specifically, Amadeus, Sabre, and Travelport. These three GDSs are 

the largest GDSs globally and in the United States. I am pleased to be here today to share with 

you information about how the GDS system works, and how GDSs protect the personal 

information of airline travelers. Although I am speaking on behalf of all three GDSs, my 

knowledge is greatest with respect to Amadeus, as it is a Steptoe client. So I may make more 

specific references to the way Amadeus operates to illustrate key points. 

GDSs serve two sides of the air travel marketplace, travel agents and airlines. Airlines 

provide GDSs with constantly updated information about the flights they offer and the fares and 

seat availability on each flight. The GDS then provides the tool by which travel agents can 

access the vast amount of information provided by the airlines through appropriate searches and 

make bookings on behalf of consumers, and then store, change, and service those bookings. In 

this trilateral relationship, the travel agent typically has an agreement with the airline under 

which the airline enables the agent to sell the airline’s services, and the travel agent and airline 
2 

must each have agreements with the GDS regarding utilizing the GDS in creating and issuing 

travel itineraries. 

Virtually all network airlines (and a significant number of low-cost carriers) participate in 

each of the GDSs. Agents often utilize the services of one GDS, but can and do use more than 

one GDS. Travel agents use a GDS to determine what flights are offered between the points the 

passenger seeks to travel, the availability of seats on any particular flights, the relevant fares and 

other pertinent information. The GDS also provides to the agents the facility to make the 

booking on the chosen flight and important back-office functions that allow the agency to 

maintain required records. 

When a consumer seeks to buy a seat on an airline, the travel agent enters the relevant 

data about the passenger and her itinerary into the GDS, and thereby creates a Passenger Name 

Record (PNR). Any modification in the itinerary will also be entered by a travel agent into the 

GDS. The GDS then transmits that information to the airline, which accepts the reservation on 

behalf of the consumer/passenger. The GDS has no direct interaction with the consumer during 

this process. Generally, the consumer is unaware of the role of the GDS or the identity of the 

GDS used by the travel agency. 

A PNR contains the details of a passenger's reservation and other information related to a 

passenger's trip. To create a PNR into a GDS, a travel agent must include at least the following 

data: 

• Name 

• Itinerary 

• Contact information 

• Ticketing information (i.e., when the ticket is going to be issued) 
3 

• Received From (i.e., the travel agent who has created or modified the ticket) 

The PNR may also contain other data, such as frequent flier information. 

Only the travel agent, airline or airlines if the travel involves more than one airline, and 

the GDS have access to the PNR, unless one of them permits access by a third party. The GDSs 

do not disclose personal information to third parties except where necessary to fulfill any 

bookings, purchases, or requests, or for credit checks or fraud prevention; when required by law; 

or when necessary to comply with a lawful request by government authorities or a court. When 

personal data is transferred to a third party, as is required in order to fulfill a booking, it is 

typically the policy of each GDS to require through provisions in contractual arrangements that 

the party to which the data is transferred agree to abide by applicable privacy and data security 

laws and policies. Amadeus, for example, has explicit provisions in its contracts with both travel 

agency subscribers and with airline and other travel providers that impose mutual obligations to 

adhere to applicable laws governing the privacy of data. 

GDSs generally retain PNR data for 72 hours after the flight departure of the last segment 

on an itinerary. After that, the data is taken out of the system and stored offline for a period of 

several years, before it is permanently erased. The purpose of this archiving is generally to allow 

travel agents or airlines to resolve any billing disputes. 

 GDSs operate in dozens of jurisdictions globally, many of which have their own privacy 

laws and regulations. Each of the GDSs undertakes to comply with the privacy laws and 

regulations of the jurisdictions in which they operate, including those governing data privacy and 

security. In particular, Amadeus, which is based in Spain and maintains its data center in 

Germany, is subject mainly to the European Data Protection Directive. That Directive creates a 

comprehensive regime regarding the protection of personal information. 
4 

Each GDS has employees that manage programs designed to protect personal information 

from unauthorized use, disclosure, destruction, or alteration. These programs comprise 

technical, physical, and administrative measures. The technical measures include encryption 

technology to ensure the secure transmission of confidential information, including credit card 

details. They also include authentication technology, including password protections, to prevent 

unauthorized access to such data. In all cases, passenger data is made available only on a “needto-know” basis; unless there is an agreement to the contrary, personal data compiled by one 

travel agency and entered into the GDS is not shared with any other travel agency or with any 

entity other than the travel providers or others who may need to have the data to provide service 

to the passenger. 

With regard to privacy, it is important to note the different approaches taken by Europe 

and the United States. In the European Union, GDSs are regulated by Council Regulation (EC) 

No. 80/2009, which established a Code of Conduct. The Code of Conduct is generally designed 

to ensure fair competition in the provision and use of GDS services. It also, however, requires 

that the privacy of end consumers be respected. In particular, Article 11 of the Code provides, 

among other things, that: 

• personal data collected for the purpose of making reservations or issuing tickets 

shall only be processed in a way compatible with these purposes; 

• personal data shall only be processed insofar as processing is necessary for the 

performance of a contract to which the data subject is party or in order to take steps at the request 

of the data subject prior to entering into a contract; 
5 

• sensitive data (concerning racial or ethnic origin, political opinions, religious or 

philosophical beliefs, trade-union membership, or health or sex life) shall only be processed 

where the data subject has given his or her explicit consent on an informed basis; 

• personal information concerning identifiable individual bookings shall be stored offline 

within seventy-two hours of the completion of the last element in the individual booking 

and destroyed within three years. Access to such data shall be allowed only for billingdispute reasons; and 

• marketing, booking and sales data shall include no identification, either directly or 

indirectly, of natural persons or the organizations or companies on whose behalf they are 

acting. 

In addition, when personal data has been collected in the EU, the actors involved in the 

collection and processing of the data must comply with the European Data Protection Directive 

(95/46/EC), the principal data protection law in the EU. The Directive applies to the data 

collected in any of the 27 EU Member States plus Iceland, Liechtenstein, and Norway. The 

Directive and national implementing legislation in each country impose stringent data protection 

requirements on the processing of personal information from persons subject to the Directive. 

Among other things, the Directive requires that: 

• personal data be processed fairly and lawfully, and collected for specified explicit 

and legitimate purposes. The data must also be accurate and, where necessary, 

kept up-to-date; 

• personal data be processed only if the data subject has unambiguously given his 

or her consent or where processing is necessary: 
6 

o for the performance of a contract to which the data subject is a party or in 

order to take steps at the request of the data subject prior to entering into a 

contract; 

o for compliance with a legal obligation to which the data controller is subject; 

o in order to protect the vital interests of the data subject; 

o for the performance of a task carried out in the public interest; or 

o the for purposes of legitimate interests pursued by the data controller or a third 

party to whom the data is disclosed; 

• the data controller provide the data subject with certain information (the identity of 

the data controller, the purposes of the processing, recipients of the data, etc.); 

• the data subject be allowed access to his data in order to rectify errors or have the data 

erased or blocked; 

• the data subject have the right to object to further processing of such data; 

• the data controller implement appropriate measures to protect personal data against 

accidental or unlawful destruction or accidental loss, alteration, unauthorized 

disclosure or access; and 

• the data controller notify the relevant national supervisory authority about the 

processing before carrying out processing operations. 

Companies within Member States may not transfer personal information to a non-EU 

state unless that country has been deemed to provide an adequate level of protection; the data 

subject unambiguously consents to the transfer; the transfer is necessary for the performance of a 

contract between the data subject and the controller or the implementation of pre-contractual 

measures taken in response to the data subject’s request; the transfer is necessary for the 
7 

conclusion or performance of a contract concluded in the interest of the data subject between the 

controller and a third party (which is generally the case for GDS bookings); the transfer is 

necessary or legally required on important public interest grounds or for the exercise or defense 

of legal claims; or the transfer is necessary to protect the vital interests of the data subject. Such 

a transfer is also permitted if the company utilizes approved binding corporate rules or standard 

contractual clauses to ensure the protection of data by the receiving entity. 

The United States as a whole has not been deemed by the EU to provide adequate 

protection. However, under the EU-U.S. Safe Harbor Framework, EU data can be transferred to 

U.S. companies that certify that they will abide by the Safe Harbor principles. These principles 

generally require U.S. companies to provide data protection commensurate with the requirements 

of the EU Data Protection Directive. As a company with significant operating facilities in both 

the EU and the U.S., Travelport has held a Safe Harbor certification since 2010. 

In the United States, by contrast, there is no general data protection directive. Rather, at 

the federal level, data protection rules are established on a sector-by-sector basis. Thus, the 

Gramm-Leach-Bliley Act establishes privacy and security requirements for financial institutions, 

and the Health Insurance Portability and Accountability Act (HIPAA) does so for certain 

healthcare companies. In addition, the Federal Trade Commission in recent years has begun to 

assert its general power to police “unfair and deceptive practices” in commerce to bring 

enforcement proceedings against companies that it believes have provided inadequate protection 

to personal information. The Department of Transportation also administers a similarly broad 

prohibition, found at 49 U.S.C. 41712, against unfair and deceptive practices in the sale of air 

transportation. Airlines and ticket agents, which include GDSs, are subject to this statute. 
8 

At the state level, 46 states plus the District of Columbia, Puerto Rico, Guam, and the 

U.S. Virgin Islands have passed laws requiring companies to notify affected individuals and, in 

some cases, regulators if certain personal information about a state resident has been breached. 

In addition, states such as Massachusetts have begun to establish laws and regulations requiring 

companies to institute data security programs and procedures to protect personal information of 

state residents. 

The GDSs are highly respectful of the legitimate interests of passengers in maintaining 

the confidentiality of travel data and of the policies underlying the laws noted above. They also 

conduct regular data privacy training and certification for their employees. The industry is 

justifiably proud of its long and successful record of maintaining high data security standards and 

taking all reasonable steps to avoid improper disclosures. They will be pleased to provide any 

further information that the Committee may require in this area. I hope this brief statement has 

been useful in describing the operation of GDSs and the ways they protect consumer data, and 

general privacy frameworks in the EU and U.S. I would be happy to take any questions you 

might have. Thank you.