CENTRA Technology, Inc. 

Record of Meeting May 2013 

Fourth Meeting of the 

Advisory Committee on 

Aviation Consumer 

Protection 

Prepared by CENTRA Technology, Inc. 

Arlington, Virginia 22203 
CENTRA Technology, Inc. 1 

RECORD OF MEETING

Fourth Meeting of the Advisory Committee on Aviation Consumer Protection 

Meeting Date: May 21, 2013

Scheduled Meeting Time: 9:00 a.m. to 5:00 p.m., Eastern Time 

Meeting Location: FAA Headquarters, 800 Independence Avenue SW, Washington, DC 20591

Public Notice: The Office of the Secretary (OST), Department of Transportation (DOT) 

informed the public of the Advisory Committee meeting in a Federal Register notice published 

May 3, 2013 (78 FR 26101). 

Attendees: 

Last Name First Name Affiliation 

Abbott Leslie Southwest Airlines 

Abramson Shelton Covington & Burling LLP 

Berlin Benjamin Dow Lohnes PLLC 

Biffle Barry Spirit Airlines 

Blaney James British Airways 

Burgoz Mark US Airways 

Cronin Aileen Alaska Airlines 

Derco Drew Eckert Seamans Cherin & Mellott, LLC 

Dols Jonathan DOT 

Gant Catherine Southwest Airlines 

Gorman Robert DOT 

Graber Kim DOT 

Gros Simon Travelport 

Hasbrouck Edward Independent Consumer Advocate 

Higginbotham Patricia GBTA 

Howard Nigel Covington & Burling LLP 

Kelly Tim DOT 

Lavin Doug IATA 

Leber Holly Business Travel News 

Lehman Dayton Capitol Business Solutions 

Lowry Richard Spirit Airlines 

Lowry Nick DOT 

Lowy Joan Associated Press 

Maddux Jason Garofalo Goerlich Hainbach PC 

Markert Alissa United Airlines 

Matal Maren US Airways 
CENTRA Technology, Inc. 2 

McElroy Debbie ACI-NA - Airports Council International 

Mtambuzi Kavaragu Virgin America 

Nguyen Tony The Travel Technology Association 

Peck Eben ASTA 

Podberesky Samuel DOT 

Prentice Ray Alaska Airlines 

Sahr Evelyn Eckert Seamans 

Semanchick David ACPA 

Strickman Norman DOT 

Thumpston Jim Zuckert, Scoutt & Rasenberger 

Vatis Michael Steptoe & Johnson LLP 

Wilson-Beyah Kali Delta Air Lines 

Workie Blane DOT 

Zimmerman Jonathan FTC 

 
CENTRA Technology, Inc. 3 

TABLE OF CONTENTS

Fourth Meeting of the Advisory Committee on Aviation Consumer Protection 

Meeting Proceedings ....................................................................................................................... 4 

Welcome and Housekeeping Matters .......................................................................................... 4 

Introductory Remarks .................................................................................................................. 4 

Implementation of October 2012 Recommendations.................................................................. 4 

Rulemaking Activities ................................................................................................................. 6 

Recent Enforcement Activities and Initiatives ............................................................................ 8 

Data Privacy and Air Travel: Introduction .................................................................................. 9 

Data Privacy and Air Travel: DOT Authority ............................................................................. 9 

Data Privacy and Air Travel: FTC’s Current Requirements ..................................................... 10 

Data Privacy and Air Travel: State Privacy Laws..................................................................... 10 

Airline and Industry Background: Airline Presenters ............................................................... 12 

Airline and Industry Background: GDS Representative ........................................................... 13 

Airline and Industry Background: Travel Agent Presenters ..................................................... 14 

Consumer Viewpoints ............................................................................................................... 14 

Airline/Consumer Panel Discussion.......................................................................................... 15 

Committee Member Biographies .................................................................................................. 17 

 
CENTRA Technology, Inc. 4 

SUMMARY OF MEETING PROCEEDINGS

Fourth Meeting of the Advisory Committee on Aviation Consumer Protection 

Welcome and Housekeeping Matters 

Samuel Podberesky, Department of Transportation (DOT), Assistant General Counsel for 

Aviation Enforcement and Proceedings 

Mr. Samuel Podberesky called the meeting to order at 9:08 a.m. He welcomed the attendees and 

the speakers and then turned the meeting over to The Honorable Lisa Madigan, Chairperson of 

the Committee. 

Introductory Remarks 

Lisa Madigan, Attorney General (AG), State of Illinois, Chairperson of the Committee 

Chairperson AG Lisa Madigan welcomed the Committee and attendees. AG Madigan outlined 

the agenda for the day and called for a moment of silence to recognize the victims of the recent 

tornado tragedy in Oklahoma. Following the moment of silence, she outlined the proceedings for 

the day separated into two parts: 1) updates on DOT consumer protection compliance, 

enforcement and rulemaking activities made last year, and 2) discussions on the topic of privacy. 

Specifically, the privacy discussion would address the collection and protection of personal data. 

AG Madigan mentioned that the Federal Trade Commission (FTC) has noted that privacy is the 

number one complaint it receives from consumers. 

Committee Member Charles Leocha emphasized the important task for the Committee of 

discussing privacy issues. Mr. Leocha noted that never before had consumers, the airlines, and 

the airports had a place to sit down together and solve common problems in this regard. He 

recognized that the Committee has made important strides and is moving in the right direction. 

Committee Members Deborah Ale Flint and David Berg added that they looked forward to the 

day’s proceedings as well as the upcoming year of the Committee’s work. 

Mr. Samuel Podberesky updated the attendees on vacancies within DOT. Transportation 

Secretary Ray LaHood is leaving and Anthony Fox, currently the Mayor of Charlotte, NC, has 

been nominated to replace him. The Aviation Enforcement Division has been affected by 

sequestration and two vacancies have yet to be filled while the Department remains judicious in 

spending. 

Implementation of October 2012 Recommendations 

Tim Kelly, Team Leader for Aviation Consumer Protection 

Mr. Tim Kelly outlined the DOT’s responses to the Committee’s 2012 recommendations. The 

Secretary’s report addressed a variety of subjects including: Travelers with Disabilities, 

Discrimination, Consumer Air Travel Complaints, Enhanced Information about Rights, 
CENTRA Technology, Inc. 5 

Understanding Contract Terms, Pricing Transparency, Ticket Agent Disclosures, and On-time 

Performance Reporting for all Carriers. 

To improve travel experiences for travelers with disabilities, the Committee recommended that 

DOT encourage airlines and airports to take voluntary steps towards this goal; the Secretary of 

Transportation will send a letter to associations for airports and for U.S. and foreign air carriers 

to address this recommendation. 

Additionally, the Committee recommended that the Department encourage airline and airport 

personnel to work with the Transportation Security Administration (TSA) to assist travelers who 

are unable to sit during lengthy layovers or to make connections safely without their specially 

made wheelchairs. The Transportation Secretary’s letter to carrier and airport associations will 

ask them to urge members to return passenger wheelchairs at connecting airports if requested. 

The Committee also recommended that the Department work with airlines and airports to make 

their kiosks and web sites accessible to disabled persons; a pertinent rulemaking proceeding is 

underway. 

Lastly, the Committee recommended that the Department require airports and airlines to ensure 

appropriate access to service animal relief areas at airports; a pertinent rulemaking proceeding is 

also underway. 

To prevent discrimination based on race, religion, national origin, and gender, the Committee 

recommended that the Department remind airlines of their obligation to avoid such 

discrimination and encourage them to stress this in initial and recurrent training. The Secretary’s 

letter to carrier associations will refer to federal statutes that prohibit such discrimination and 

stress the benefits of training. 

To address concerns regarding consumer complaints, the Committee recommended that DOT 

provide complainants with contact information for the analyst handling the complaint, and 

indicate that this person can be contacted concerning the status of the complaint. 

Acknowledgment letters/emails have been revised to include a Case number automatically 

inserted as well as a central email address and phone number and a commitment to reply within 

one business day, in most cases, by an analyst working on the case. DOT believes it would not 

be feasible to provide an individual analyst contact in the response itself. Additionally, the 

Committee recommended that DOT outline the complaint handling process to complainants by 

advising if it is a potential violation and that their complaints will be sent to carrier which will 

have 30/60 days to reply to consumer, after which a complainant should contact DOT if he/she 

does not receive a reply. Acknowledgment letters/emails now state if the subject of the complaint 

is covered by a DOT rule, the complaint will be sent to carrier for a response to consumer within 

the 30/60-day legal deadlines. 

To enhance information about air travel consumer rights, the Committee recommended that DOT 

place its guidance on consumer rights and related FAQs in a prominent location on its web site. 
CENTRA Technology, Inc. 6 

New FAQs have been added on the Aviation Consumer office page and new links to that page 

are available from the DOT home page and “Aviation” page. 

To provide better understanding of terms used in contracts of carriage and customer service 

plans, the Committee recommended that DOT survey how airlines define certain terms and place 

this information on DOT’s web site. The Secretary’s letter to airline associations will express his 

interest in an industry working group to define terms. The results will be posted on the DOT web 

site. 

The Committee recommended that DOT take steps to ensure transparency in air carrier pricing, 

including ancillary fees. Consumer Rule II requires airline web sites to disclose fees for optional 

services and Consumer Rule III will address the issue of displaying ancillary fees through all 

sales channels, including Global Distribution Systems (GDS). 

To encourage ticket agent disclosures, the Committee recommended that DOT require all ticket 

agents, including Online Travel Agencies (OTAs), to disclose if they do not sell tickets for all 

airlines and, if so, that additional airlines may serve the route being searched. Consumer Rule III 

will address the issue of whether ticket agents, including OTAs, should be required to disclose 

whether they do not sell tickets for all airlines. 

To promote on-time performance reporting for all airlines, the Committee recommended that 

DOT require on-time performance data to be reported by all airlines, not simply those that 

account for one percent of domestic scheduled passenger revenue, as is currently the case. 

Consumer Rule III will address the issue of expanding the reporting-carrier pool to include 

smaller carriers. 

At this time the Mr. Kelly introduced the next speaker, Ms. Blane Workie. 

Rulemaking Activities 

Blane Workie, Principal Deputy Assistant General Counsel 

The Office of Aviation Enforcement and Proceedings is currently involved in nine active 

rulemakings, including three notices of proposed rulemakings (NPRMs) and six final rules: 

• Four disability-related rulemakings 

• Two consumer protection rulemakings 

• One unauthorized operations rulemaking 

• Two reporting rulemakings 

A final rule on the “Use of the Seat-Strapping Method for Carrying a Wheelchair on an 

Aircraft,” was submitted to the Office of Management and Budget (OMB) in July 2012. The 90-

day expected period for OMB clearance has already lapsed but the rulemaking may be cleared 

and issued shortly. 
CENTRA Technology, Inc. 7 

Another rulemaking that DOT expects will be issued soon as a final rule on “Accessibility of 

Carrier Websites and Ticket Kiosks” which was submitted to OMB in February 2013. 

A final rule on “Accessibility of Airports” is expected to be submitted to OMB in June 2013. It is 

not clear whether the current schedule will be met. Monthly updates on significant DOT 

rulemakings are available at http://www.dot.gov/regulations/. 

An NPRM on “Carrier-Supplied Medical Oxygen, In-Flight Entertainment Systems, Service 

Animals, and Accessible Lavatories,” which would address a number of measures to improve the 

air travel environment for passengers with disabilities is expected to be submitted to OMB in 

July 2013. This NPRM tackles issues that were not resolved in 2008 ACAA final rule such as inflight entertainment and in-flight medical oxygen. Whether carriers should have to provide onboard oxygen and whether they should be able to charge for it remains to be determined. 

Additionally the NPRM would take up the issue of service animals, accessible lavatories and 

reporting of wheelchair assistance requests. 

A final rule on “Reporting Ancillary Airline Passenger Revenues,” is expected to be submitted to 

OMB in July 2013. The issues addressed in this rulemaking consist of reporting of airline 

imposed fees, methodology for computing mishandled baggage rates, and statistics for 

mishandled wheelchairs/scooters. 

An NPRM on “Enhancing Airline Passenger Protections III,” which would address whether the 

Department should enhance disclosure requirements on code share operations, expand the scope 

of on-time performance reporting to include smaller carriers, adopt minimum customer service 

standards, require ticket agents to disclose whose tickets they do or do not sell, and require that 

ancillary fees be displayed through all sale channels was submitted to OMB in April 2013. 

A final rule on “Smoking of Electronic Cigarettes on Commercial Aircraft” is expected to be 

submitted to OMB in August 2013. 

A final rule on “Reports by Air Carriers on Incidents Involving Animals during Air Transport” is 

expected to be submitted to OMB at a date to be determined. A rulemaking schedule will be 

developed as soon as DOT completes its review of the more than 5,000 comments received on 

the proposal. 

An NPRM for the charter broker/operator industry which would address the NTSB 

recommendation that certain information be disclosed to customers at the time an air charter 

contract is arranged is expected to be completed in May 2013. 

Future consumer protection rulemakings to implement the FAA Modernization and Reform Act 

of 2012 may be wrapped together in one rulemaking. Such a rulemaking may address a variety 

of topics such as tarmac delays, consumer complaints and the carriage in the passenger 

compartment of musical instruments. 

At this time Ms. Workie introduced the next speaker, Mr. Jonathan Dols. 
CENTRA Technology, Inc. 8 

Recent Enforcement Activities and Initiatives 

Jonathan Dols, Deputy Assistant General Counsel 

Mr. Dols began by indicating that the jurisdiction of the DOT over air transportation is based 

primarily on economic issues, in contrast to the safety matters, which are the focus of the FAA. 

The DOT regulates direct and indirect carriers as well as ticket agents. The latter are defined as 

persons other than air carriers that sell transportation, including, for example, GDSs. 

Regulated areas include civil rights, unauthorized operations, and consumer protection. The last 

area includes the regulation of advertising practices as well as tarmac delays and chronically 

delayed flights, refunds, and baggage liability. 

Cases originate through a variety of channels including competitor complaints, consumer 

complaints, and via DOT’s own initiative through its onsite inspection program. 

Once it has received the complaint, whether from the industry or from a consumer, the 

Department’s Office of Aviation Enforcement and Proceedings (the Enforcement Office) 

analyzes it, assesses probable cause, and begins a formal or informal enforcement process. The 

most common approach is the informal process, which can lead to various outcomes of 

increasing severity ranging from a non-punitive warning letter to formal consent orders assessing 

civil penalties. In rare cases, criminal sanctions may be sought. 

Since 2008, there have been 25 onsite inspections, an average of five per year, featuring three- to 

five-person teams. The inspections are comprehensive in scope and are currently being expanded 

to public charter operators and foreign air carriers. 

The 2010-2011 rulemakings established a wide array of additional consumer protections. The 

Consumer I and II rulemakings included many new requirements, notably the enforcement of the 

full fare rule explicitly, and addressed tarmac delays, codeshare disclosure compliance, baggage 

liability limits, and public charter compliance. 

Committee Member Charlie Leocha began the question and answer period. Mr. Leocha asked the 

panel if the more aggressive opposition to new regulations by carriers was resulting in delays of 

NPRMs. Ms. Workie responded that the issue was rather one of not having enough economists 

on staff to conduct the necessary cost-benefit analyses. Mr. Leocha then expressed concern about 

the mishandling of baggage even as increased fees caused a decrease in the number of bags. 

Committee Member David Berg disputed the data on falling baggage numbers. Mr. Podberesky 

noted that DOT had seen some improvement in baggage handling even among carriers not 

charging baggage fees. 

Mr. Leocha also asked about the threshold for airline on-time reporting that excluded small 

carriers such as Allegiant and Spirit. Ms. Workie asserted that the Department is not targeting 

one specific airline with this threshold, noting that Virgin, a relatively small carrier, is also 

required to report. 
CENTRA Technology, Inc. 9 

An audience member asked about civil penalties assessed carriers and whether the Department 

considers mitigating factors in cases such as tarmac delays. Ms. Workie noted that all consent 

orders have been settlements and that the Department does consider mitigating factors such as 

weather. Mr. Leocha then mentioned the FAA reauthorization bill and Consumer Rule III with 

regard to tarmac delay enforcement. Ms. Workie stated that Consumer Rule III does not directly 

address tarmac delays but tarmac delay issues such as comfortable cabin temperatures will likely 

be addressed in future rulemakings. 

Thomas Canfield, the General Counsel for Spirit Airlines, commented with regard to the on-time 

reporting threshold, which applied reporting to those carriers with at least one percent of total 

domestic enplanements, and noted that reporting on-time performance imposes greater costs on 

smaller airlines. 

Chairperson AG Lisa Madigan introduced Committee Member Charlie Leocha and he spoke 

about the importance of privacy in the context of high Internet usage and personal information 

exchange. 

Data Privacy and Air Travel: Introduction 

Charles Leocha, Consumer Travel Alliance

Mr. Leocha began his remarks by praising the work of the Committee and the coming together of 

stakeholder parties including the FTC, DOT, and airlines. He noted the vulnerability of traveler 

data especially given the expectation of seamlessness in travel; however, the competing 

jurisdictions of the FTC, DOT, and state laws often obscure responsibility for privacy 

requirements. Mr. Leocha referenced a recent privacy case in which Delta won a dismissal of 

claims based on federal preemption. In addition to collection of data, Mr. Leocha also expressed 

concern over disclosure of data usage by the airlines. He expressed hope that the discussion 

would lead to an aviation sector blueprint of best practices for all parts of industry. 

Data Privacy and Air Travel: DOT Authority 

Robert Gorman, Senior Attorney, C-70, DOT 

Mr. Robert Gorman of the DOT presented on the legal “lay of the land” with regard to the 

privacy of data on airline travelers. He began with the federal statutory authority on privacy 

issues, then addressed DOT’s jurisdiction over airline travel, and concluded with a look toward 

the future. Current federal statutes over privacy do not address the airline industry and the 

proposed Consumer Bill of Rights with respect to personal information has not passed. DOT’s 

authority covers unfair and deceptive practices in air transportation and extends over air carriers 

and ticket agents. Additionally, Mr. Gorman noted that federal law generally preempts state law 

with regard to regulating the rates, routes and services of air carriers, and this preemption may 

apply to state privacy laws. DOT’s statutory authority also extends to the Children’s Online 

Privacy Protection Act which regulates the collection of data from children online and has a 

“carve out” clause that vests DOT with the authority to handle violations by airlines. 
CENTRA Technology, Inc. 10 

Additionally, the DOT requires that airlines collect and maintain certain personal passenger 

information for various legal purposes. Personal information held by the DOT itself is governed 

by the Privacy Act. The DOT has stated that an airline’s violation of a passenger’s privacy may 

be considered an unfair and deceptive practice. 

Mr. Gorman referenced a significant case in this area, Epic vs. Northwest Airlines, over the 

transfer of data from a carrier to a research center to address threats post 9/11. The DOT 

considered the case carefully but determined that airlines often need to divulge information to the 

government for policy purposes and further decided that no injury came to the travelers. This 

case is instructive because it set forth the factors that the DOT would consider when determining 

whether an airline’s use or disclosure of private information constituted an unfair or deceptive 

practice. 

Data Privacy and Air Travel: FTC’s Current Requirements 

Jonathan Zimmerman, Senior Attorney, Division of Privacy and Identity Protection, FTC 

Mr. Jonathan Zimmerman presented on the FTC’s role in the protection of consumer privacy. He 

noted that as the landscape of the industry is changing and causing an overlap between DOT and 

FTC jurisdiction, the agencies must work beyond Section 5 of the FTC Act, which gives the 

commission broad authority to regulate unfair and deceptive practices. The FTC’s standard is 

that companies must protect information and consider the reasons for collecting it, what they are 

doing with it, and what they are disclosing to consumers. Mr. Zimmerman further explained that 

a breach in the protection of private data does not necessarily signify poor practices just as 

absence of a breach may not indicate good practices. 

Enforcement actions have been brought for both unfair and deceptive practices against some of 

the biggest names in industry and some smaller companies. Mr. Zimmerman referred to the cases 

against Path and Myspace, two social media sites, as well as HTC America and Twitter to show 

the variety of FTC’s enforcement mechanisms and available remedies. The lessons from these 

cases indicate the importance of adhering to stated privacy policies, retaining only necessary 

information, disposing of information properly, and remaining aware of common threats. 

Mr. Zimmerman expanded on the requirements within the Children’s Online Privacy Protection 

Act (COPPA) and stated that a new version of guidance will be coming in July 2013. 

The FTC has frequent communications with industry and promotes workshops and education 

initiatives for companies on privacy issues. Specifically the FTC advocates three main 

principles: 1) adopting privacy by design: 2) simplifying privacy choices: and 3) improving 

transparency. 

Data Privacy and Air Travel: State Privacy Laws 

Nigel Howard, Partner, Covington and Burling 

Mr. Nigel Howard from Covington and Burling presented on how state laws contribute to and 

inform privacy practices. There is a high variance and volume of state privacy activities with 
CENTRA Technology, Inc. 11 

many states operating their own “mini-FTCs.” For airlines and other businesses, this can be 

troublesome as this can lead to conflicting sets of requirements and asymmetrical application of 

policies. 

Mr. Howard noted that California has been at the forefront of privacy protection among U.S. 

states specifically with regard to the clarity, transparency, and prominence of online privacy 

policies, while Massachusetts and Nevada have narrower, more prescriptive security 

requirements. 

Mr. Howard pointed out that nearly every state has a breach notification law though they vary 

greatly in their individual requirements. The variety in requirements may create undue hardship 

for business and may undermine the goal of getting timely information to consumers. 

Mr. Howard further cited two cases in 2005 in which airlines gave personal information to the 

TSA in which issues of jurisdiction were debated and airlines were ultimately required to uphold 

passenger rights. 

Airlines try to follow state law even when preempted by federal statute in large part because of 

the role of bad publicity inherent in a consumer-facing business. For this reason state laws often 

inform best practices in the privacy area. Mr. Howard concluded by noting that GDSs are not 

subject to the same pressures as they do not deal directly with the consumer. 

Committee Member Ale Flint opened the questioning by asking about whether Payment Card 

Industry (PCI) standards apply to the carriers or OTAs. Mr. Howard responded that security 

standards are most important to airlines and that it is a best practice to insist on PCI standards in 

contracts. 

Committee Member Leocha asked about responsibility on web sites for third party data 

collectors. Mr. Zimmerman responded that it is the responsibility of the operator of the site to 

control what is collected by third parties. Mr. Leocha also asked about personally identifiable 

information (PII) on paper documents related to travel and Mr. Zimmerman acknowledged the 

importance of proper disposal. Mr. Leocha mentioned the challenge surrounding protecting data 

associated with mobile devices which Mr. Zimmerman acknowledged carried higher stakes due 

to the quantity of information held on mobile devices, while noting that the principles associated 

with each are the same. 

In response to a question raised by Chairperson Madigan, Mr. Zimmerman stated that privacy 

complaints accounted for 18 percent of the total number of complaints received by the FTC. 

Mr. Paul Ruden of the American Society of Travel Agents asked how determinations are made 

based on the word “immoral” in privacy requirements. Mr. Podberesky cited examples of airlines 

selling personal information for children or medical information of passengers. 

The committee broke for lunch at approximately 12:30 PM and returned at approximately 1:30 

PM. 
CENTRA Technology, Inc. 12 

Airline and Industry Background: Airline Presenters

Russell Hubbard, American Airlines

Aileen Cronin, Alaska Airlines

Kali Wilson-Beyah, Delta Air Lines

Following the lunch break, Committee Member Berg introduced the next panel of presenters 

which provided an overview of the regulatory and legal landscape relating to privacy issues. The 

panel consisted of Russell Hubbard, American Airlines; Aileen Cronin, Alaska Airlines; and Kali 

Wilson-Beyah, Delta Airlines. 

Ms. Wilson-Beyah began by noting the importance airlines place on protecting customer 

information. She also noted that the airlines are highly regulated. DOT oversees advertising, 

baggage fees, etc. while FAA covers flight operations, safety, and maintenance. Other agencies 

also require that airlines collect additional information: TSA requires companies to collect full 

name, date of birth, and a redress number while Customs and Border Patrol (CBP) requires 

airlines to supply Advance Passenger Information System (APIS) data. 

The legal privacy framework guiding airlines is extensive. In the financial sphere, airlines are 

regulated by the Graham Leach Bliley Act, the Fair Credit Reporting Act, and Sarbanes-Oxley 

Act (SOX). In the medical area, the Health Insurance Portability and Accountability Act 

(HIPPA) prescribes practices regarding personal information. Both telecommunications and 

online activities are increasingly regulated. Internationally, the Personal Information Protection 

and Electronic Documents Act (PIPEDA) and the European Union (EU) Privacy Directive 

regulate what personal info can be collected. 

Next Mr. Russell Hubbard noted the extent of passenger data required to be collected by airlines, 

stating, however that the TSA Secure Flight program had shifted the responsibility of collecting 

some data from the airlines to the TSA. 

A variety of entities collect passenger data throughout the travel process, including air carrier 

web sites and call centers, brick and mortar travel agencies, online travel agencies, metasearch 

engines, and general search engines. 

Customer information is used for a variety of purposes. In some cases, information must be 

shared with business vendors, such as, for example, arranging for wheelchair assistance for those 

who need it. When dealing with third party vendors, air carriers are especially careful with 

information and require strict contracts for the processing of information. GDSs may be more 

problematic as they have leverage over the data and may want to use it for other purposes while 

facing fewer pressures associated with being non-customer facing. Google and other big data 

aggregators also raise privacy concerns with regard to customer data. While innovation in travel 

transactions is welcome, Mr. Hubbard concluded airlines must continue to ensure personal data 

are protected. 
CENTRA Technology, Inc. 13 

Finally Ms. Aileen Cronin listed the generally accepted privacy principles that guide airlines, 

which are motivated to protect consumer data and try to avoid negative public feedback. These 

principles include: management, notice, choice and consent, collection, use, retention, and 

disposal, access, disclosure to third parties, security for privacy, quality, as well as monitoring 

and enforcement. Ms. Cronin then listed technical standards and frameworks for security over 

information including: NIST, COBIT, PCI-DSS, ISO 27001 and 27002, as well as SSAE 16 and 

SOC Type 1 & 2. Security practices often employed include: encryption, vulnerability 

management, patch management, PEN testing, user provisioning, audits, system hoarding, as 

well as monitoring & logging. Onsite physical controls are also important. 

Airline and Industry Background: GDS Representative

Michael Vatis, Partner, Steptoe & Johnson, LLP 

Next, Mr. Michael Vatis from Steptoe and Johnson, LLP spoke on behalf of the GDSs. He began 

by explaining the role of GDSs in the air travel system. First, airlines provide GDSs with 

information about seat availability and prices, information with which GDSs allow consumers to 

make bookings and changes. Most air carriers participate with all GDSs. Travel agents have 

agreements with air carriers under which they are authorized to sell tickets, enter relevant data 

into a GDS, and create a passenger name record (PNR). The PNR contains details about the 

passenger including name, itinerary, contact information, ticket information, and “received from 

field” (i.e., the travel agent who has created or modified the ticket). Only the agent, airline, and 

GDS have access to the PNR unless one of them permits access to third party. The GDS, which 

has no direct dealing with the consumer, does not distribute information unless required by law 

or as necessary. The GDS holds data for 72 hours after a flight before disposing of it but can hold 

onto some data for as much as three years in order to resolve potential billing disputes. 

Each GDS has programs designed to protect the consumer, such as the technical, physical, and 

administrative measures taken to protect data. Passenger data is only collected on a need to know 

basis and is not shared with other agents. There are different protection approaches taken by the 

European Union and United States. In the European Union, law number 80/2009 regulates GDSs 

through an established code of conduct. Additionally, EU laws state that personal data should 

only be processed such that a contract can be fulfilled and sensitive data may only be processed 

where the subject has given explicit consent. Entities involved with processing data must comply 

with the 95/46/EC data privacy directive. Data must be accurate and up-to-date and can only be 

processed for the performance of a contract, in compliance with the legal obligation to protect 

the vital interests of the data subject, or for a task carried out in the public interest. Additionally, 

companies may not transfer data to another country that does not have the same privacy policies. 

The United States as a whole has not been deemed by the European Union to provide adequate 

protection. However, under the EU-United States Safe Harbor Framework, EU data can be 

transferred to U.S. companies that certify that they will abide by the Safe Harbor principles. 
CENTRA Technology, Inc. 14 

Airline and Industry Background: Travel Agent Presenters 

Stan Brown, Omega World Travel 

Paul Ruden, American Society of Travel Agents 

Next Mr. Paul Ruden of the American Society of Travel Agents (ASTA) introduced Mr. Stan 

Brown of Omega World Travel to present on the role of travel agents in protecting customer 

information. Mr. Brown began by emphasizing the importance that Omega World Travel places 

on protecting customer information, particularly given their government clients. Information 

collected by Omega includes: frequent flyer number, mobile phone number, email addresses, 

special requests, and corporate discount numbers. 

Omega World Travel places a high importance on securing this information. Mr. Brown noted 

Omega's operation of a secure data network and periodic updates to its security and privacy 

policies. Mr. Brown also explained that customer information is never given to third parties 

without permission and client lists are never sold. In addition, Omega has in place a number of 

security measures that prevent access through hacking or viruses. Reservations made through 

online booking services as well as accounting information are also well protected. 

Following Mr. Brown’s presentation, Mr. Ruden read a statement prepared by a group of online 

travel agencies. The statement is transcribed below: 

“The major online travel companies are deeply committed to the protection of their 

respective customers' personal information. The information consumers provide enables 

them to understand and improve customer travel needs, develop world-class products and 

services, tailor customer communications, provide enhanced customer service, comply 

with laws and regulations, and protect against fraud. As such, the Travel Technology 

Association is deeply committed to ensuring policies and practices relating to consumer 

data are aligned with industry standards and are strictly adhered to. Reputable online 

travel companies take the steps necessary to safeguard that information through 

enforcement of privacy policies, certifications with third party privacy groups, Safe 

Harbor compliance, and strict contractual provisions with suppliers and vendors around 

the treatment of any consumer information they have access to.” 

Consumer Viewpoints 

Edward Hasbrouck, Independent Consumer Advocate

Following these presentations on the air travel industry, Committee Member Leocha introduced 

Mr. Edward Hasbrouck, an independent Consumer Advocate, to present on the consumer side of 

privacy concerns. In his presentation, Mr. Hasbrouck sought to address travel privacy through a 

consumer lens. He stressed that the core of the problem emerged in the commercial sector. 

Mr. Hasbrouck emphasized that problems lie in the practices of industry participants rather than 

their statements of policy. Airlines, travel agencies, as well as Computer Reservation Systems 

(CRS) and GDSs do not inform consumers to which entities they provide their data. 

Additionally, no companies have established limits on data collected. In addition to opaque 

practices surrounding airfares, personal information retained by the industry is vulnerable, Mr. 
CENTRA Technology, Inc. 15 

Hasbrouck maintained, to criminals such as stalkers and abusers. The GDS system is especially 

vulnerable and current threat modeling is misguided. While most companies assess threats from 

outside intruders, Mr. Hasbrouck believes that insider threats from authorized users are more 

acute. 

Mr. Hasbrouck expressed concern over the number of privacy breaches, citing technical failure 

in access logs that prevent a full accounting of incidents, particularly with regard to “look but 

don’t touch” attacks that leave no traces. The system is structured to make sure we do not know 

about attacks. 

Additionally, a problem exists with the lack of accountability for privacy intrusions industrywide. Given the interrelated businesses in air travel, no one company will acknowledge personal 

data is its own domain. This is made more confusing when travel packages involve multiple 

suppliers of both air travel service and ground services. 

Lastly, Mr. Hasbrouck stressed the DOT’s need to take on a leading role with regard to privacy. 

He noted that no words about privacy appear on DOT’s web site and stressed the need for 

privacy to be a category on the forms and reports presented on the web site. He also noted that 

the DOT did make a public commitment in Safe Harbor and that specific principles enhance the 

authority of DOT. Mr. Hasbrouck offered three recommendations for DOT: 1) if privacy 

commitments are made, they become enforceable; 2) privacy needs to be on all forms; and 3) 

there needs to be a working group within DOT. Mr. Hasbrouck concluded by stating the airline 

industry has been a leader in use of IT and embraced e-commerce before others; however, DOT 

has not taken on the commensurate leading role on privacy and must make strides to that effect. 

Airline/Consumer Panel Discussion 

Committee Member Leocha opened up the question and answer period by asking Ms. Aileen 

Cronin about the “notice” privacy principle and who consumers should contact when they have 

concerns about privacy policies. Ms. Cronin responded that the policy statement and point of 

contact that appears when the consumer is entering their data is the best source of information. 

Mr. Leocha also expressed concern about the event of a codeshare flight when a consumer 

travels with multiple airlines with differing privacy policies on the same trip. Mr. Podberesky 

responded that each portion of the trip would be covered by the marketing carrier’s privacy 

policy. Mr. Leocha noted the complexities in air travels and the confusion this causes among 

many consumers. 

Mr. Hasbrouck then noted the problems with granular data structure and the lack of information 

associated with the PNR, specifically with regard to where the data were collected. Mr. Vatis 

countered that a record is kept of who entered the data and who modified it. 

Chairperson Madigan asked how long data are held by airlines and Ms. Cronin responded that 

the data are classified by record type and the length of holding varies greatly from 30 days to 

eight years. 
CENTRA Technology, Inc. 16 

Committee Member Leocha then asked about package deals that include car rentals and how the 

different points are handled with regard to privacy. Ms. Workie responded that DOT handles 

complaints within its jurisdiction and sends along the other pieces to the relevant agencies. 

Chairperson Madigan asked the airline presenters if their companies were required to report if a 

breach had taken place. Each airline presenter was able to point to an example of a breach, 

though most were perpetrated against employees rather than consumers. 

Committee Member Leocha noted that given the FTC’s high reporting of privacy incidents, the 

lack of air travel incidents with privacy was unusual. Mr. Ruden countered that this could 

indicate that the air travel industry has been doing a good job on privacy issues and the low 

reporting number is evidence of success. Mr. Podberesky concluded the question and answer 

period by pointing out the commercial sensitivity within the airline industry itself with regard to 

personal information of customers as another reason for its enhanced security. 

Chairperson Madigan thanked everyone for attending and adjourned the meeting at 

approximately 3:30 PM. 

Copies of the PowerPoint presentations by the speakers have been placed in the Advisory 

Committee’s docket (DOT OST 2012-0087). 
CENTRA Technology, Inc. 17 

COMMITTEE MEMBER BIOGRAPHIES 

The Honorable Lisa Madigan 

Ms. Madigan is Attorney General (AG) of Illinois and officially chairs the Advisory Committee 

on Aviation Consumer Protection. AG Madigan serves as a representative of state and local 

governments with the Committee. She was elected the first woman Attorney General of Illinois 

in 2002 and won a third term in 2010. As Attorney General, her priorities have included 

protecting consumers from financial fraud and unsafe products, as well as protecting seniors in 

nursing homes. 

Deborah Ale Flint 

Ms. Ale Flint serves as a representative of airport operators with the Advisory Committee on 

Aviation Consumer Protection. She was appointed Oakland International Airport’s Director of 

Aviation in 2010. Ms. Ale Flint is the primary executive responsible for the operation, 

management, and development of the airport. She previously served as manager of the airport’s 

airside operations where her responsibilities included noise abatement and environmental 

compliance. 

David A. Berg 

Mr. Berg serves as a representative of air carriers with the Advisory Committee on Aviation 

Consumer Protection. He was named Senior Vice President, General Counsel and Corporate 

Secretary for Airlines for America (A4A) in 2011. At A4A, Mr. Berg is responsible for the 

association’s legal affairs and has been involved in a variety of aviation issues, including 

passengers with disabilities and airport landing fees. 

Charles Leocha 

Mr. Leocha serves as a representative of aviation consumers with the Advisory Committee on 

Aviation Consumer Protection. He is Director of the Consumer Travel Alliance (CTA) which he 

formed in 2009, following a career in journalism where he specialized in reporting on travelers’ 

rights. Since beginning CTA, his advocacy for travelers has included meeting government 

officials, testifying before Congress and developing travel information and resources.