S E C R E T A R Y ’ S A D V I S O R Y C O M M I T T E E O N 

A V I A T I O N C O N S U M E R P R O T E C T I O N

T U E S D A Y , M A Y 2 1 , 2 0 1 3

Protecting the Privacy of Airline Passengers:

Role of the Office of Aviation Enforcement and 

Proceedings
Outline of Presentation

1. Federal statutory authority for privacy protection

2. DOT experience in protecting privacy of airline 

passengers

3. Future issues 
Federal Statutory Authority 

 Federal statutes regulate the collection and use of 

personal information by the federal government 

(Privacy Act) and by certain industries (e.g., 

HIPAA), but there is no specific statute relating to 

the privacy of air passengers

 February 2012 – President Obama proposed a 

Consumer Privacy Bill of Rights to protect online 

privacy, with jurisdiction generally vesting in the 

FTC
DOT Statutory Authority 

 DOT has authority to regulate unfair or deceptive 

practices or unfair methods of competition in air 

transportation or the sale of air transportation 

(49 USC 41712)

 DOT jurisdiction covers air carriers and ticket agents 

 Jurisdiction is exclusive to DOT with respect to 

violations by air carriers (15 USC 45(a)(2))
DOT Statutory Authority

 Federal law preempts state law relating to airline 

rates, routes, and services of an air carrier (49 USC 

41713) and may preempt certain state privacy laws

 California state court judge recently dismissed state 

Attorney General’s complaint that Delta mobile app 

lacked a privacy policy statement, as required by 

California’s Online Consumer Privacy Act

 Court ruled that federal law preempts state law
DOT Statutory Authority 

 Children’s Online Privacy Protection Act (COPPA), 

15 USC 6501 et seq.

 Regulates the gathering of data from children online

 Primary regulatory agency is FTC, with exclusive rulemaking 

authority

 In a “carve-out,” COPPA vests DOT with the authority to handle 

violations by airlines (15 USC 6505(b)(4))

 Airline violations of COPPA would be treated as unfair/deceptive 

practices under 49 USC 41712 (15 USC 6505(c))
Personal Information Collected by DOT

 DOT is a federal agency covered by the Privacy Act 

 (5 USC 552a)

 Privacy Act generally prohibits dissemination of personally 

identifiable information held in an agency’s system of records absent 

the person’s written consent or a statutory exception 

 Act also requires notice to the public regarding the purpose of agency 

data collections, and how information may be stored and used. 

 Additional Aviation Enforcement Office policies

 Personal information regarding complainants is kept out of 

enforcement orders if possible

 Airlines cautioned to not divulge passengers’ personal information 

(names, medical records) in public docketed filings 
DOT Requirements 

 DOT requires air carriers and others to collect and 

maintain certain records containing private 

information, including:

 Passenger manifests, including names, and emergency contact 

telephone numbers, in the event of an aviation disaster (14 

CFR 243)

 Records of disability-related complaints (14 CFR 382.157) 

 Records of consumer complaints (air carriers) and customer 

reservations (charter operators) (14 CFR Part 249)

 DOT may also inspect any records kept by carriers or 

travel agents on demand (49 USC 41709)
DOT Experience in Privacy Protection

 DOT position: Violating privacy of airline passengers is 

an unfair and deceptive practice if:

 Airline violates the terms of the carrier’s stated privacy policy

 Airline gathers or discloses private information in a way that 

“violates public policy, is immoral, or causes substantial consumer 

injury not offset by any countervailing benefits”

 Airline violates a rule issued by the DOT describing specific privacy 

practices it considers to be unfair or deceptive. (No such rule 

currently exists).

 Airline violates COPPA or FTC implementing rules
DOT Experience in Privacy Protection

Northwest Airlines case:

DOT Order 2004-9-13 (September 10, 2004), 

affirmed, DOT Order 2005-3-9 (March 7, 2005)

Post 9/11, Northwest shared Passenger Name Record 

(PNR) data with Ames Research Center at NASA 

Formal complaint alleged violation of privacy policy 

and unfair/deceptive trade practice
DOT Experience in Privacy Protection

Northwest Airlines held: 

- Disclosure did not violate express terms of privacy policy

- Privacy policy must be read carefully and with 

understanding that airlines are at times legally required to 

share personal information with government (no violation 

of public policy)

- Under the circumstances, disclosure was not immoral 

and was not likely to result in substantial injury to 

consumers
DOT Experience in Privacy Protection

 Northwest Airlines:

 Order placed carriers on notice that violations of an airline’s 

publicly-stated privacy policy may result in civil penalties if:

 Customer data are transferred for profit

 Customer data are transferred to a nongovernmental entity

 Customer data are transferred to a third party whose data 

protection protocols are not at least as secure as those of the 

airline itself

 Privacy policy incorrectly promises that it will not share data with 

any third party (including the government) 
DOT Experience in Privacy Protection 

 Office has not received other formal complaints, or 

significant informal complaints, relating to alleged 

privacy violations by airlines
DOT – Future Action

 DOT is gathering information on whether we need to 

issue guidance to the airline industry with respect to 

COPPA