S E C R E T A R Y ’ S A D V I S O R Y C O M M I T T E E O N

A V I A T I O N C O N S U M E R P R O T E C T I O N

T U E S D A Y , M A Y 2 1 , 2 0 1 3 

### Protecting the Privacy of Airline Passengers:
Role of the Office of Aviation Enforcement and

Proceedings

## Outline of Presentation

1. 

### Federal statutory a uthority for privacy protection

2. 

### DOT experience in protecting privacy of airline



### passengers

3. 

### Future issues

## Federal Statutory Authority

 

### Federal statutes regulate the collection and use of personal information by the federal government (Privacy Act) and by certain industries (e.g., HIPAA), but there is no specific statute relating to 

### the privacy of air passengers

 

### February 2012

– President Obama proposed a Consumer Privacy Bill of Rights to protect online privacy, with jurisdiction generally vesting in the

FTC

## DOT Statutory Authority

 

### DOT has authority to regulate unfair or deceptive practices or unfair methods of competition in air transportation or the sale of air transportation

( 49 USC 41712 )

 

### DOT jurisdiction covers air carriers and ticket agents

 

### Jurisdiction is exclusive to DOT with respect to violations by air carriers (15 USC 45(a)(2))

## DOT Statutory Authority

 

### Federal law preempts state law relating to airline rates, routes, and services of an air carrier (49 USC 41713) and may preempt certain state privacy laws

 

### California state court judge recently dismissed state Attorney G eneral’s complaint that Delta mobile app lacked a privacy policy statement, as required by California’s Online Consumer Privacy Act

 

### Court ruled that federal law preempts state law

## DOT Statutory Authority

 Children’s Online Privacy Protection Act (COPPA),

15 USC 6501 et seq.

 Regulates the gathering of data from children online

 Primary regulatory agency is FTC, with exclusive rulemaking authority

 In a “carve

- out,” COPPA vests DOT with the authority to handle violations by airlines (15 USC 6505(b)(4))

 Airline violations of COPPA would be treated as unfair/deceptive practices under 49 USC 41712 (15 USC 6505(c))

## Personal Information Collected by DOT

 DOT is a federal agency covered by the Privacy Act

(5 USC 552a)

 Privacy Act generally prohibits dissemination of personally identifiable information held in an agency’s system of records absent the person’s written consent or a statutory exception

 Act also requires notice to the public regarding the purpose of agency data collections, and how information may be stored and used.

 Additional Aviation Enforcement Office policies

 Personal information regarding complainants is kept out of enforcement orders if possible

 Airlines cautioned to not divulge passengers’ personal information (names, medical records) in public docketed filings

## DOT Requirements

 

### DOT requires air carriers and others to collect and maintain certain records containing private information, including:

 Passenger manifests, including names, and emergency contact telephone numbers, in the event of an aviation disaster (14 CFR 243)

 Records of disability

- related complaints (14 CFR 382.157)

 Records of consumer complaints (air carriers) and customer reservations (charter operators) (14 CFR Part 249)

 

### DOT may also inspect any records kept by carriers or travel agents on demand (49 USC 41709)

## DOT Experience in Privacy P rotection

 DOT position: Violating privacy of airline passengers is an unfair and deceptive practice if:

 Airline violates the terms of the carrier’s stated privacy policy

 Airline gathers or discloses private information in a way that “violates public policy, is immoral, or causes substantial consumer injury not offset by any countervailing benefits”

 Airline violates a rule issued by the DOT describing specific privacy practices it considers to be unfair or deceptive. (No such rule currently exists).

 Airline violates COPPA or FTC implementing rules

## DOT Experience in Privacy Protection

Northwest Airlines case: DOT Order 2004

- 9

- 13 (September 10, 2004), affirmed, DOT Order 2005

- 3

- 9 (March 7, 2005)

Post 9/11, Northwest shared Passenger Name Record (PNR) data with Ames Research Center at NASA

Formal complaint alleged violation of privacy policy and unfair/deceptive trade practice

## DOT Experience in Privacy Protection

Northwest Airlines held:

- Disclosure did not violate express terms of privacy policy

- Privacy policy must be read carefully and with understanding that airlines are at times legally required to share personal information with government (no violation of public policy)

- Under the circumstances, disclosure was not immoral and was not likely to result in substantial injury to

consumers

## DOT Experience in P rivacy Protection

 

### Northwest Airlines:

 Order placed carriers on notice that violations of an airline’s publicly

- stated privacy policy may result in civil penalties if:

 Customer data are transferred for profit

 Customer data are transferred to a nongovernmental entity

 Customer data are transferred to a third party whose data protection protocols are not at least as secure as those of the

airline itself

 Privacy policy incorrectly promises that it will not share data with any third party (including the government)

## DOT Experience in Privacy Protection

 

### Office has not received other formal complaints, or significant informal complaints, relating to alleged privacy violations by airlines

## DOT

– Future Action

 

### DOT is gathering information on whether we need to 

### issue guidance to the airline industry with respect to

COPPA