CENTRA Technology, Inc.



## Record of Meeting May 2013



# Fourth Meeting of the Advisory Committee on

Aviation Consumer

Protection

Prepared by CENTRA Technology, Inc. Arlington, Virginia 22203CENTRA Technology, Inc. 1 R ECORD OF MEETING Fourth Meeting of the Advisory Committee on Aviatio n Consumer Protection

Meeting Date: May 21, 2013

Scheduled Meeting Time: 9:00 a.m. to 5:00 p.m., Eastern Time

Meeting Location: FAA Headquarters, 800 Independence Avenue SW, Washi ngton, DC 20591

Public Notice: The Office of the Secretary (OST), Department of Tr ansportation (DOT) informed the public of the Advisory Committee meeti ng in a Federal Register notice published May 3, 2013 (78 FR 26101).

Attendees:

Last Name First Name Affiliation

Abbott Leslie Southwest Airlines
Abramson Shelton Covington & Burling LLP
Berlin Benjamin Dow Lohnes PLLC
Biffle Barry Spirit Airlines
Blaney James British Airways
Burgoz Mark US Airways

Cronin Aileen Alaska Airlines

Derco Drew Eckert Seamans Cherin & Mellott, LLC

Dols Jonathan DOT

Gant Catherine Southwest Airlines

Gorman Robert DOT

Graber Kim DOT
Gros Simon Travelport
Hasbrouck Edward Independent Consumer Advocate
Higginbotham Patricia GBTA
Howard Nigel Covington & Burling LLP
Kelly Tim DOT
Lavin Doug IATA
Leber Holly Business Travel News
Lehman Dayton Capitol Business Solutions
Lowry Richard Spirit Airlines
Lowry Nick DOT
Lowy Joan Associated Press

Maddux Jason Garofalo Goerlich Hainbach PC

Markert Alissa United Airlines
Matal Maren US AirwaysCENTRA Technology, Inc. 2

McElroy Debbie ACI-NA - Airports Council Internatio nal
Mtambuzi Kavaragu Virgin America
Nguyen Tony The Travel Technology Association

Peck Eben ASTA
Podberesky Samuel DOT
Prentice Ray Alaska Airlines
Sahr Evelyn Eckert Seamans

Semanchick David ACPA

Strickman Norman DOT
Thumpston Jim Zuckert, Scoutt & Rasenberger
Vatis Michael Steptoe & Johnson LLP
Wilson-Beyah Kali Delta Air Lines

Workie Blane DOT

Zimmerman Jonathan FTCCENTRA Technology, Inc. 3 T ABLE OF C ONTENTS Fourth Meeting of the Advisory Committee on Aviatio n Consumer Protection

Meeting Proceedings ...............................

................................................... ..................................... 4

Welcome and Housekeeping Matters ..................

................................................... ..................... 4

Introductory Remarks ..............................

................................................... ................................. 4

Implementation of October 2012 Recommendations.....

................................................... .......... 4

Rulemaking Activities .............................

................................................... ................................. 6

Recent Enforcement Activities and Initiatives .....

................................................... .................... 8

Data Privacy and Air Travel: Introduction .........

................................................... ...................... 9

Data Privacy and Air Travel: DOT Authority ........

................................................... .................. 9

Data Privacy and Air Travel: FTC’s Current Requirem ents .............................................. ....... 10

Data Privacy and Air Travel: State Privacy Laws....

................................................... .............. 10

Airline and Industry Background: Airline Presenters

.................................................. ............. 12

Airline and Industry Background: GDS Representative

.................................................. ......... 13

Airline and Industry Background: Travel Agent Prese nters ............................................. ........ 14

Consumer Viewpoints ...............................

................................................... ............................. 14

Airline/Consumer Panel Discussion..................

................................................... ..................... 15

Committee Member Biographies ......................

................................................... ......................... 17CENTRA Technology, Inc. 4 S UMMARY OF M EETING P ROCEEDINGS Fourth Meeting of the Advisory Committee on Aviatio n Consumer Protection

Welcome and Housekeeping Matters Samuel Podberesky, Department of Transportation (DO T), Assistant General Counsel for Aviation Enforcement and Proceedings

Mr. Samuel Podberesky called the meeting to order a t 9:08 a.m. He welcomed the attendees and the speakers and then turned the meeting over to Th e Honorable Lisa Madigan, Chairperson of

the Committee.

Introductory Remarks Lisa Madigan, Attorney General (AG), State of Illin ois, Chairperson of the Committee

Chairperson AG Lisa Madigan welcomed the Committee and attendees. AG Madigan outlined the agenda for the day and called for a moment of s ilence to recognize the victims of the recent tornado tragedy in Oklahoma. Following the moment o f silence, she outlined the proceedings for the day separated into two parts: 1) updates on DOT consumer protection compliance, enforcement and rulemaking activities made last yea r, and 2) discussions on the topic of privacy. Specifically, the privacy discussion would address the collection and protection of personal data. AG Madigan mentioned that the Federal Trade Commiss ion (FTC) has noted that privacy is the number one complaint it receives from consumers.

Committee Member Charles Leocha emphasized the impo rtant task for the Committee of discussing privacy issues. Mr. Leocha noted that ne ver before had consumers, the airlines, and the airports had a place to sit down together and s olve common problems in this regard. He recognized that the Committee has made important st rides and is moving in the right direction.

Committee Members Deborah Ale Flint and David Berg added that they looked forward to the day’s proceedings as well as the upcoming year of t he Committee’s work.

Mr. Samuel Podberesky updated the attendees on vaca ncies within DOT. Transportation Secretary Ray LaHood is leaving and Anthony Fox, cu rrently the Mayor of Charlotte, NC, has been nominated to replace him. The Aviation Enforce ment Division has been affected by sequestration and two vacancies have yet to be fill ed while the Department remains judicious in spending.

Implementation of October 2012 Recommendations Tim Kelly, Team Leader for Aviation Consumer Protec tion

Mr. Tim Kelly outlined the DOT’s responses to the C ommittee’s 2012 recommendations. The Secretary’s report addressed a variety of subjects including: Travelers with Disabilities, Discrimination, Consumer Air Travel Complaints, Enh anced Information about Rights,CENTRA Technology, Inc. 5

Understanding Contract Terms, Pricing Transparency, Ticket Agent Disclosures, and On-time Performance Reporting for all Carriers.

To improve travel experiences for travelers with di sabilities, the Committee recommended that DOT encourage airlines and airports to take volunta ry steps towards this goal; the Secretary of Transportation will send a letter to associations f or airports and for U.S. and foreign air carriers

to address this recommendation.

Additionally, the Committee recommended that the De partment encourage airline and airport personnel to work with the Transportation Security Administration (TSA) to assist travelers who are unable to sit during lengthy layovers or to mak e connections safely without their specially made wheelchairs. The Transportation Secretary’s le tter to carrier and airport associations will ask them to urge members to return passenger wheelc hairs at connecting airports if requested.

The Committee also recommended that the Department work with airlines and airports to make their kiosks and web sites accessible to disabled p ersons; a pertinent rulemaking proceeding is underway.

Lastly, the Committee recommended that the Departme nt require airports and airlines to ensure appropriate access to service animal relief areas a t airports; a pertinent rulemaking proceeding is also underway.

To prevent discrimination based on race, religion, national origin, and gender, the Committee recommended that the Department remind airlines of their obligation to avoid such discrimination and encourage them to stress this in initial and recurrent training. The Secretary’s

letter to carrier associations will refer to federa l statutes that prohibit such discrimination and stress the benefits of training.

To address concerns regarding consumer complaints, the Committee recommended that DOT provide complainants with contact information for t he analyst handling the complaint, and indicate that this person can be contacted concerni ng the status of the complaint. Acknowledgment letters/emails have been revised to include a Case number automatically inserted as well as a central email address and pho ne number and a commitment to reply within one business day, in most cases, by an analyst work ing on the case. DOT believes it would not be feasible to provide an individual analyst contac t in the response itself. Additionally, the Committee recommended that DOT outline the complain t handling process to complainants by advising if it is a potential violation and that th eir complaints will be sent to carrier which will have 30/60 days to reply to consumer, after which a complainant should contact DOT if he/she does not receive a reply. Acknowledgment letters/emails now state if the subj ect of the complaint is covered by a DOT rule, the complaint will be sen t to carrier for a response to consumer within the 30/60-day legal deadlines.

To enhance information about air travel consumer ri ghts, the Committee recommended that DOT place its guidance on consumer rights and related F AQs in a prominent location on its web site.CENTRA Technology, Inc. 6

New FAQs have been added on the Aviation Consumer o ffice page and new links to that page are available from the DOT home page and “Aviation” page.

To provide better understanding of terms used in co ntracts of carriage and customer service plans, the Committee recommended that DOT survey ho w airlines define certain terms and place this information on DOT’s web site. The Secretary’s letter to airline associations will express his interest in an industry working group to define ter ms. The results will be posted on the DOT web

site.

The Committee recommended that DOT take steps to en sure transparency in air carrier pricing, including ancillary fees. Consumer Rule II requires airline web sites to disclose fees for optional

services and Consumer Rule III will address the iss ue of displaying ancillary fees through all sales channels, including Global Distribution Syste ms (GDS).

To encourage ticket agent disclosures, the Committe e recommended that DOT require all ticket agents, including Online Travel Agencies (OTAs), to disclose if they do not sell tickets for all airlines and, if so, that additional airlines may s erve the route being searched. Consumer Rule III will address the issue of whether ticket agents, in cluding OTAs, should be required to disclose whether they do not sell tickets for all airlines.

To promote on-time performance reporting for all ai rlines, the Committee recommended that DOT require on-time performance data to be reported by all airlines, not simply those that account for one percent of domestic scheduled passe nger revenue, as is currently the case. Consumer Rule III will address the issue of expandi ng the reporting-carrier pool to include

smaller carriers.

At this time the Mr. Kelly introduced the next spea ker, Ms. Blane Workie.

Rulemaking Activities Blane Workie, Principal Deputy Assistant General Co unsel

The Office of Aviation Enforcement and Proceedings is currently involved in nine active rulemakings, including three notices of proposed ru lemakings (NPRMs) and six final rules:

• Four disability-related rulemakings

• Two consumer protection rulemakings

• One unauthorized operations rulemaking

• Two reporting rulemakings

A final rule on the “Use of the Seat-Strapping Meth od for Carrying a Wheelchair on an Aircraft,” was submitted to the Office of Managemen t and Budget (OMB) in July 2012. The 90- day expected period for OMB clearance has already l apsed but the rulemaking may be cleared and issued shortly.CENTRA Technology, Inc. 7

Another rulemaking that DOT expects will be issued soon as a final rule on “Accessibility of

Carrier Websites and Ticket Kiosks” which was submi tted to OMB in February 2013.

A final rule on “Accessibility of Airports” is expe cted to be submitted to OMB in June 2013. It is

not clear whether the current schedule will be met. Monthly updates on significant DOT rulemakings are available at http://www.dot.gov/reg ulations/.

An NPRM on “Carrier-Supplied Medical Oxygen, In-Fli ght Entertainment Systems, Service Animals, and Accessible Lavatories,” which would ad dress a number of measures to improve the air travel environment for passengers with disabili ties is expected to be submitted to OMB in July 2013. This NPRM tackles issues that were not r esolved in 2008 ACAA final rule such as inflight entertainment and in-flight medical oxygen. Whether carriers should have to provide onboard oxygen and whether they should be able to cha rge for it remains to be determined. Additionally the NPRM would take up the issue of se rvice animals, accessible lavatories and reporting of wheelchair assistance requests.

A final rule on “Reporting Ancillary Airline Passen ger Revenues,” is expected to be submitted to OMB in July 2013. The issues addressed in this rule making consist of reporting of airline imposed fees, methodology for computing mishandled baggage rates, and statistics for

mishandled wheelchairs/scooters.

An NPRM on “Enhancing Airline Passenger Protections III,” which would address whether the Department should enhance disclosure requirements o n code share operations, expand the scope of on-time performance reporting to include smaller carriers, adopt minimum customer service standards, require ticket agents to disclose whose tickets they do or do not sell, and require that ancillary fees be displayed through all sale channe ls was submitted to OMB in April 2013.

A final rule on “Smoking of Electronic Cigarettes o n Commercial Aircraft” is expected to be submitted to OMB in August 2013.

A final rule on “Reports by Air Carriers on Inciden ts Involving Animals during Air Transport” is expected to be submitted to OMB at a date to be det ermined. A rulemaking schedule will be developed as soon as DOT completes its review of th e more than 5,000 comments received on the proposal.

An NPRM for the charter broker/operator industry wh ich would address the NTSB

recommendation that certain information be disclose d to customers at the time an air charter contract is arranged is expected to be completed in May 2013.

Future consumer protection rulemakings to implement the FAA Modernization and Reform Act of 2012 may be wrapped together in one rulemaking. Such a rulemaking may address a variety of topics such as tarmac delays, consumer complaint s and the carriage in the passenger compartment of musical instruments.

At this time Ms. Workie introduced the next speaker , Mr. Jonathan Dols.CENTRA Technology, Inc. 8

Recent Enforcement Activities and Initiatives Jonathan Dols, Deputy Assistant General Counsel

Mr. Dols began by indicating that the jurisdiction of the DOT over air transportation is based primarily on economic issues, in contrast to the sa fety matters, which are the focus of the FAA. The DOT regulates direct and indirect carriers as w ell as ticket agents. The latter are defined as persons other than air carriers that sell transport ation, including, for example, GDSs.

Regulated areas include civil rights, unauthorized operations, and consumer protection. The last area includes the regulation of advertising practic es as well as tarmac delays and chronically delayed flights, refunds, and baggage liability.

Cases originate through a variety of channels inclu ding competitor complaints, consumer complaints, and via DOT’s own initiative through it s onsite inspection program.

Once it has received the complaint, whether from th e industry or from a consumer, the Department’s Office of Aviation Enforcement and Pro ceedings (the Enforcement Office) analyzes it, assesses probable cause, and begins a formal or informal enforcement process. The most common approach is the informal process, which can lead to various outcomes of increasing severity ranging from a non-punitive war ning letter to formal consent orders assessing civil penalties. In rare cases, criminal sanctions may be sought.

Since 2008, there have been 25 onsite inspections, an average of five per year, featuring three- to five-person teams. The inspections are comprehensiv e in scope and are currently being expanded to public charter operators and foreign air carrier s.

The 2010-2011 rulemakings established a wide array of additional consumer protections. The Consumer I and II rulemakings included many new req uirements, notably the enforcement of the full fare rule explicitly, and addressed tarmac del ays, codeshare disclosure compliance, baggage liability limits, and public charter compliance.

Committee Member Charlie Leocha began the question and answer period. Mr. Leocha asked the panel if the more aggressive opposition to new regu lations by carriers was resulting in delays of NPRMs. Ms. Workie responded that the issue was rath er one of not having enough economists on staff to conduct the necessary cost-benefit anal yses. Mr. Leocha then expressed concern about the mishandling of baggage even as increased fees c aused a decrease in the number of bags. Committee Member David Berg disputed the data on fa lling baggage numbers. Mr. Podberesky noted that DOT had seen some improvement in baggage handling even among carriers not charging baggage fees.

Mr. Leocha also asked about the threshold for airli ne on-time reporting that excluded small carriers such as Allegiant and Spirit. Ms. Workie a sserted that the Department is not targeting one specific airline with this threshold, noting th at Virgin, a relatively small carrier, is also required to report.CENTRA Technology, Inc. 9

An audience member asked about civil penalties asse ssed carriers and whether the Department considers mitigating factors in cases such as tarma c delays. Ms. Workie noted that all consent orders have been settlements and that the Departmen t does consider mitigating factors such as

weather. Mr. Leocha then mentioned the FAA reauthor ization bill and Consumer Rule III with regard to tarmac delay enforcement. Ms. Workie stat ed that Consumer Rule III does not directly address tarmac delays but tarmac delay issues such as comfortable cabin temperatures will likely be addressed in future rulemakings.

Thomas Canfield, the General Counsel for Spirit Air lines, commented with regard to the on-time reporting threshold, which applied reporting to tho se carriers with at least one percent of total domestic enplanements, and noted that reporting on- time performance imposes greater costs on

smaller airlines.

Chairperson AG Lisa Madigan introduced Committee Me mber Charlie Leocha and he spoke about the importance of privacy in the context of h igh Internet usage and personal information exchange.

Data Privacy and Air Travel: Introduction Charles Leocha, Consumer Travel Alliance

Mr. Leocha began his remarks by praising the work o f the Committee and the coming together of stakeholder parties including the FTC, DOT, and air lines. He noted the vulnerability of traveler data especially given the expectation of seamlessne ss in travel; however, the competing jurisdictions of the FTC, DOT, and state laws often obscure responsibility for privacy requirements. Mr. Leocha referenced a recent privac y case in which Delta won a dismissal of claims based on federal preemption. In addition to collection of data, Mr. Leocha also expressed concern over disclosure of data usage by the airlin es. He expressed hope that the discussion would lead to an aviation sector blueprint of best practices for all parts of industry.

Data Privacy and Air Travel: DOT Authority Robert Gorman, Senior Attorney, C-70, DOT

Mr. Robert Gorman of the DOT presented on the legal “lay of the land” with regard to the privacy of data on airline travelers. He began with the federal statutory authority on privacy issues, then addressed DOT’s jurisdiction over airl ine travel, and concluded with a look toward the future. Current federal statutes over privacy d o not address the airline industry and the proposed Consumer Bill of Rights with respect to pe rsonal information has not passed. DOT’s authority covers unfair and deceptive practices in air transportation and extends over air carriers and ticket agents. Additionally, Mr. Gorman noted t hat federal law generally preempts state law with regard to regulating the rates, routes and ser vices of air carriers, and this preemption may apply to state privacy laws. DOT’s statutory author ity also extends to the Children’s Online Privacy Protection Act which regulates the collecti on of data from children online and has a

“carve out” clause that vests DOT with the authorit y to handle violations by airlines.CENTRA Technology, Inc. 10

Additionally, the DOT requires that airlines collec t and maintain certain personal passenger information for various legal purposes. Personal in formation held by the DOT itself is governed by the Privacy Act. The DOT has stated that an airl ine’s violation of a passenger’s privacy may be considered an unfair and deceptive practice.

Mr. Gorman referenced a significant case in this ar ea, Epic vs. Northwest Airlines , over the

transfer of data from a carrier to a research cente r to address threats post 9/11. The DOT considered the case carefully but determined that a irlines often need to divulge information to the government for policy purposes and further decided that no injury came to the travelers. This

case is instructive because it set forth the factor s that the DOT would consider when determining whether an airline’s use or disclosure of private i nformation constituted an unfair or deceptive practice.

Data Privacy and Air Travel: FTC’s Current Requirem ents Jonathan Zimmerman, Senior Attorney, Division of Pr ivacy and Identity Protection, FTC

Mr. Jonathan Zimmerman presented on the FTC’s role in the protection of consumer privacy. He noted that as the landscape of the industry is chan ging and causing an overlap between DOT and FTC jurisdiction, the agencies must work beyond Sec tion 5 of the FTC Act, which gives the commission broad authority to regulate unfair and d eceptive practices. The FTC’s standard is that companies must protect information and conside r the reasons for collecting it, what they are doing with it, and what they are disclosing to cons umers. Mr. Zimmerman further explained that a breach in the protection of private data does not necessarily signify poor practices just as absence of a breach may not indicate good practices

.

Enforcement actions have been brought for both unfa ir and deceptive practices against some of the biggest names in industry and some smaller comp anies. Mr. Zimmerman referred to the cases against Path and Myspace, two social media sites, a s well as HTC America and Twitter to show the variety of FTC’s enforcement mechanisms and ava ilable remedies. The lessons from these cases indicate the importance of adhering to stated privacy policies, retaining only necessary information, disposing of information properly, and remaining aware of common threats.

Mr. Zimmerman expanded on the requirements within t he Children’s Online Privacy Protection Act (COPPA) and stated that a new version of guidan ce will be coming in July 2013.

The FTC has frequent communications with industry a nd promotes workshops and education initiatives for companies on privacy issues. Specif ically the FTC advocates three main principles: 1) adopting privacy by design: 2) simpl ifying privacy choices: and 3) improving

transparency.

Data Privacy and Air Travel: State Privacy Laws Nigel Howard, Partner, Covington and Burling

Mr. Nigel Howard from Covington and Burling present ed on how state laws contribute to and inform privacy practices. There is a high variance and volume of state privacy activities withCENTRA Technology, Inc. 11

many states operating their own “mini-FTCs.” For ai rlines and other businesses, this can be troublesome as this can lead to conflicting sets of requirements and asymmetrical application of policies.

Mr. Howard noted that California has been at the fo refront of privacy protection among U.S. states specifically with regard to the clarity, tra nsparency, and prominence of online privacy policies, while Massachusetts and Nevada have narro wer, more prescriptive security requirements.

Mr. Howard pointed out that nearly every state has a breach notification law though they vary greatly in their individual requirements. The varie ty in requirements may create undue hardship for business and may undermine the goal of getting timely information to consumers.

Mr. Howard further cited two cases in 2005 in which airlines gave personal information to the TSA in which issues of jurisdiction were debated an d airlines were ultimately required to uphold passenger rights.

Airlines try to follow state law even when preempte d by federal statute in large part because of the role of bad publicity inherent in a consumer-fa cing business. For this reason state laws often inform best practices in the privacy area. Mr. Howa rd concluded by noting that GDSs are not subject to the same pressures as they do not deal d irectly with the consumer.

Committee Member Ale Flint opened the questioning b y asking about whether Payment Card Industry (PCI) standards apply to the carriers or O TAs. Mr. Howard responded that security standards are most important to airlines and that i t is a best practice to insist on PCI standards in

contracts.

Committee Member Leocha asked about responsibility on web sites for third party data collectors. Mr. Zimmerman responded that it is the responsibility of the operator of the site to control what is collected by third parties. Mr. Leo cha also asked about personally identifiable information (PII) on paper documents related to tra vel and Mr. Zimmerman acknowledged the importance of proper disposal. Mr. Leocha mentioned the challenge surrounding protecting data

associated with mobile devices which Mr. Zimmerman acknowledged carried higher stakes due to the quantity of information held on mobile devic es, while noting that the principles associated

with each are the same.

In response to a question raised by Chairperson Mad igan, Mr. Zimmerman stated that privacy complaints accounted for 18 percent of the total nu mber of complaints received by the FTC.

Mr. Paul Ruden of the American Society of Travel Ag ents asked how determinations are made based on the word “immoral” in privacy requirements . Mr. Podberesky cited examples of airlines selling personal information for children or medica l information of passengers.

The committee broke for lunch at approximately 12:3 0 PM and returned at approximately 1:30

PM.CENTRA Technology, Inc. 12

Airline and Industry Background: Airline Presenters Russell Hubbard, American Airlines Aileen Cronin, Alaska Airlines Kali Wilson-Beyah, Delta Air Lines

Following the lunch break, Committee Member Berg in troduced the next panel of presenters which provided an overview of the regulatory and le gal landscape relating to privacy issues. The panel consisted of Russell Hubbard, American Airlines; Aileen Cronin, Alaska Airlines; and Kali Wilson-Beyah, Delta Airlines.

Ms. Wilson-Beyah began by noting the importance air lines place on protecting customer

information. She also noted that the airlines are h ighly regulated. DOT oversees advertising, baggage fees, etc. while FAA covers flight operatio ns, safety, and maintenance. Other agencies also require that airlines collect additional infor mation: TSA requires companies to collect full name, date of birth, and a redress number while Cus toms and Border Patrol (CBP) requires airlines to supply Advance Passenger Information Sy stem (APIS) data.

The legal privacy framework guiding airlines is ext ensive. In the financial sphere, airlines are regulated by the Graham Leach Bliley Act, the Fair Credit Reporting Act, and Sarbanes-Oxley Act (SOX). In the medical area, the Health Insuranc e Portability and Accountability Act (HIPPA) prescribes practices regarding personal inf ormation. Both telecommunications and online activities are increasingly regulated. Inter nationally, the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Europ ean Union (EU) Privacy Directive regulate what personal info can be collected.

Next Mr. Russell Hubbard noted the extent of passen ger data required to be collected by airlines, stating, however that the TSA Secure Flight program had shifted the responsibility of collecting

some data from the airlines to the TSA.

A variety of entities collect passenger data throug hout the travel process, including air carrier web sites and call centers, brick and mortar travel agencies, online travel agencies, metasearch engines, and general search engines.

Customer information is used for a variety of purpo ses. In some cases, information must be shared with business vendors, such as, for example, arranging for wheelchair assistance for those who need it. When dealing with third party vendors, air carriers are especially careful with information and require strict contracts for the pr ocessing of information. GDSs may be more problematic as they have leverage over the data and may want to use it for other purposes while facing fewer pressures associated with being non-cu stomer facing. Google and other big data aggregators also raise privacy concerns with regard to customer data. While innovation in travel transactions is welcome, Mr. Hubbard concluded airl ines must continue to ensure personal data are protected.CENTRA Technology, Inc. 13

Finally Ms. Aileen Cronin listed the generally acce pted privacy principles that guide airlines, which are motivated to protect consumer data and tr y to avoid negative public feedback. These principles include: management, notice, choice and consent, collection, use, retention, and disposal, access, disclosure to third parties, secu rity for privacy, quality, as well as monitoring

and enforcement. Ms. Cronin then listed technical s tandards and frameworks for security over information including: NIST, COBIT, PCI-DSS, ISO 27 001 and 27002, as well as SSAE 16 and SOC Type 1 & 2. Security practices often employed i nclude: encryption, vulnerability management, patch management, PEN testing, user pro visioning, audits, system hoarding, as well as monitoring & logging. Onsite physical contr ols are also important.

Airline and Industry Background: GDS Representative Michael Vatis, Partner, Steptoe & Johnson, LLP

Next, Mr. Michael Vatis from Steptoe and Johnson, L LP spoke on behalf of the GDSs. He began by explaining the role of GDSs in the air travel sy stem. First, airlines provide GDSs with information about seat availability and prices, inf ormation with which GDSs allow consumers to make bookings and changes. Most air carriers partic ipate with all GDSs. Travel agents have agreements with air carriers under which they are a uthorized to sell tickets, enter relevant data into a GDS, and create a passenger name record (PNR ). The PNR contains details about the passenger including name, itinerary, contact inform ation, ticket information, and “received from field” (i.e., the travel agent who has created or m odified the ticket). Only the agent, airline, and GDS have access to the PNR unless one of them permi ts access to third party. The GDS, which has no direct dealing with the consumer, does not d istribute information unless required by law or as necessary. The GDS holds data for 72 hours af ter a flight before disposing of it but can hold onto some data for as much as three years in order to resolve potential billing disputes.

Each GDS has programs designed to protect the consu mer, such as the technical, physical, and administrative measures taken to protect data. Pass enger data is only collected on a need to know basis and is not shared with other agents. There ar e different protection approaches taken by the European Union and United States. In the European U nion, law number 80/2009 regulates GDSs through an established code of conduct. Additionall y, EU laws state that personal data should only be processed such that a contract can be fulfi lled and sensitive data may only be processed where the subject has given explicit consent. Entit ies involved with processing data must comply with the 95/46/EC data privacy directive. Data must be accurate and up-to-date and can only be processed for the performance of a contract, in com pliance with the legal obligation to protect the vital interests of the data subject, or for a t ask carried out in the public interest. Additionall y, companies may not transfer data to another country that does not have the same privacy policies. The United States as a whole has not been deemed by the European Union to provide adequate protection. However, under the EU-United States Saf e Harbor Framework, EU data can be transferred to U.S. companies that certify that the y will abide by the Safe Harbor principles.CENTRA Technology, Inc. 14

Airline and Industry Background: Travel Agent Prese nters Stan Brown, Omega World Travel Paul Ruden, American Society of Travel Agents

Next Mr. Paul Ruden of the American Society of Trav el Agents (ASTA) introduced Mr. Stan Brown of Omega World Travel to present on the role of travel agents in protecting customer information. Mr. Brown began by emphasizing the imp ortance that Omega World Travel places on protecting customer information, particularly gi ven their government clients. Information collected by Omega includes: frequent flyer number, mobile phone number, email addresses, special requests, and corporate discount numbers.

Omega World Travel places a high importance on secu ring this information. Mr. Brown noted Omega's operation of a secure data network and peri odic updates to its security and privacy policies. Mr. Brown also explained that customer in formation is never given to third parties without permission and client lists are never sold. In addition, Omega has in place a number of security measures that prevent access through hacki ng or viruses. Reservations made through online booking services as well as accounting infor mation are also well protected.

Following Mr. Brown’s presentation, Mr. Ruden read a statement prepared by a group of online travel agencies. The statement is transcribed below :

“The major online travel companies are deeply commi tted to the protection of their respective customers' personal information. The inf ormation consumers provide enables them to understand and improve customer travel need s, develop world-class products and services, tailor customer communications, provide e nhanced customer service, comply with laws and regulations, and protect against frau d. As such, the Travel Technology Association is deeply committed to ensuring policie s and practices relating to consumer data are aligned with industry standards and are st rictly adhered to. Reputable online travel companies take the steps necessary to safegu ard that information through enforcement of privacy policies, certifications wit h third party privacy groups, Safe Harbor compliance, and strict contractual provision s with suppliers and vendors around the treatment of any consumer information they have access to.”

Consumer Viewpoints Edward Hasbrouck, Independent Consumer Advocate

Following these presentations on the air travel ind ustry, Committee Member Leocha introduced Mr. Edward Hasbrouck, an independent Consumer Advoc ate, to present on the consumer side of privacy concerns. In his presentation, Mr. Hasbrouc k sought to address travel privacy through a consumer lens. He stressed that the core of the pro blem emerged in the commercial sector.

Mr. Hasbrouck emphasized that problems lie in the p ractices of industry participants rather than their statements of policy. Airlines, travel agenci es, as well as Computer Reservation Systems (CRS) and GDSs do not inform consumers to which ent ities they provide their data. Additionally, no companies have established limits on data collected. In addition to opaque practices surrounding airfares, personal informatio n retained by the industry is vulnerable, Mr.CENTRA Technology, Inc. 15

Hasbrouck maintained, to criminals such as stalkers and abusers. The GDS system is especially vulnerable and current threat modeling is misguided . While most companies assess threats from outside intruders, Mr. Hasbrouck believes that insi der threats from authorized users are more

acute.

Mr. Hasbrouck expressed concern over the number of privacy breaches, citing technical failure in access logs that prevent a full accounting of in cidents, particularly with regard to “look but don’t touch” attacks that leave no traces. The syst em is structured to make sure we do not know

about attacks.

Additionally, a problem exists with the lack of acc ountability for privacy intrusions industrywide. Given the interrelated businesses in air trav el, no one company will acknowledge personal data is its own domain. This is made more confusing when travel packages involve multiple suppliers of both air travel service and ground ser vices.

Lastly, Mr. Hasbrouck stressed the DOT’s need to ta ke on a leading role with regard to privacy. He noted that no words about privacy appear on DOT’ s web site and stressed the need for privacy to be a category on the forms and reports p resented on the web site. He also noted that the DOT did make a public commitment in Safe Harbor and that specific principles enhance the authority of DOT. Mr. Hasbrouck offered three recom mendations for DOT: 1) if privacy commitments are made, they become enforceable; 2) p rivacy needs to be on all forms; and 3) there needs to be a working group within DOT. Mr. H asbrouck concluded by stating the airline industry has been a leader in use of IT and embrace d e-commerce before others; however, DOT has not taken on the commensurate leading role on p rivacy and must make strides to that effect.

Airline/Consumer Panel Discussion

Committee Member Leocha opened up the question and answer period by asking Ms. Aileen Cronin about the “notice” privacy principle and who consumers should contact when they have concerns about privacy policies. Ms. Cronin respond ed that the policy statement and point of contact that appears when the consumer is entering their data is the best source of information. Mr. Leocha also expressed concern about the event o f a codeshare flight when a consumer travels with multiple airlines with differing priva cy policies on the same trip. Mr. Podberesky responded that each portion of the trip would be co vered by the marketing carrier’s privacy policy. Mr. Leocha noted the complexities in air tr avels and the confusion this causes among

many consumers.

Mr. Hasbrouck then noted the problems with granular data structure and the lack of information associated with the PNR, specifically with regard t o where the data were collected. Mr. Vatis countered that a record is kept of who entered the data and who modified it.

Chairperson Madigan asked how long data are held by airlines and Ms. Cronin responded that the data are classified by record type and the leng th of holding varies greatly from 30 days to eight years.CENTRA Technology, Inc. 16

Committee Member Leocha then asked about package de als that include car rentals and how the different points are handled with regard to privacy . Ms. Workie responded that DOT handles complaints within its jurisdiction and sends along the other pieces to the relevant agencies.

Chairperson Madigan asked the airline presenters if their companies were required to report if a breach had taken place. Each airline presenter was able to point to an example of a breach, though most were perpetrated against employees rath er than consumers.

Committee Member Leocha noted that given the FTC’s high reporting of privacy incidents, the lack of air travel incidents with privacy was unusu al. Mr. Ruden countered that this could indicate that the air travel industry has been doin g a good job on privacy issues and the low reporting number is evidence of success. Mr. Podber esky concluded the question and answer period by pointing out the commercial sensitivity w ithin the airline industry itself with regard to personal information of customers as another reason for its enhanced security.

Chairperson Madigan thanked everyone for attending and adjourned the meeting at approximately 3:30 PM.

Copies of the PowerPoint presentations by the speak ers have been placed in the Advisory Committee’s docket (DOT OST 2012-0087).CENTRA Technology, Inc. 17

C OMMITTEE M EMBER B IOGRAPHIES

The Honorable Lisa Madigan Ms. Madigan is Attorney General (AG) of Illinois an d officially chairs the Advisory Committee on Aviation Consumer Protection. AG Madigan serves as a representative of state and local governments with the Committee. She was elected the first woman Attorney General of Illinois in 2002 and won a third term in 2010. As Attorney G eneral, her priorities have included protecting consumers from financial fraud and unsaf e products, as well as protecting seniors in nursing homes.

Deborah Ale Flint Ms. Ale Flint serves as a representative of airport operators with the Advisory Committee on Aviation Consumer Protection. She was appointed Oak land International Airport’s Director of Aviation in 2010. Ms. Ale Flint is the primary exec utive responsible for the operation, management, and development of the airport. She pre viously served as manager of the airport’s airside operations where her responsibilities inclu ded noise abatement and environmental compliance.

David A. Berg Mr. Berg serves as a representative of air carriers with the Advisory Committee on Aviation

Consumer Protection. He was named Senior Vice Presi dent, General Counsel and Corporate Secretary for Airlines for America (A4A) in 2011. A t A4A, Mr. Berg is responsible for the association’s legal affairs and has been involved i n a variety of aviation issues, including passengers with disabilities and airport landing fe es.

Charles Leocha Mr. Leocha serves as a representative of aviation c onsumers with the Advisory Committee on

Aviation Consumer Protection. He is Director of the Consumer Travel Alliance (CTA) which he formed in 2009, following a career in journalism wh ere he specialized in reporting on travelers’ rights. Since beginning CTA, his advocacy for trave lers has included meeting government officials, testifying before Congress and developin g travel information and resources.