Senator Probes Airline Privacy PoliciesRockefeller Scrutinizes How Carriers Safeguard Passenger Data
With the clock ticking on the current legislative session, and with his retirement just over four months off, Sen. Jay Rockefeller is mulling whether Congress needs to enact legislation to regulate how airlines use and protect passengers' private information.
See Also: 2021: A Cybersecurity Odyssey
Rockefeller, the West Virginia Democrat who chairs the Senate Commerce, Science and Transportation Committee, has sent a letter to 10 U.S. airlines, asking them about how they handle passengers' private information.
"No comprehensive federal privacy law currently applies to the collection, use and disclosure of consumer travel information," Rockefeller writes in the letter. "Consumer advocates have expressed concern that airline privacy policies can contain substantial caveats and that it is difficult for consumers to learn what information airlines and others in the travel sector are collecting, keeping and sharing about them."
Rockefeller wants to learn what information the airlines collect about passengers, either directly or through other parties, such as travel agents, and how long they retain specific types of data. He also seeks to determine how the airlines get the information and wants them to describe privacy and cybersecurity protections they provide for personal information they maintain.
A Rockefeller Legacy
Though it's unlikely that Rockefeller could get the Senate to adopt legislation to regulate airline privacy if he chooses to do so - there are relatively few days left for Congress to legislate and most lawmakers express hostility to enacting new regulations on business - the information the senator culls from the airlines could be used by other legislators if they pursue this matter in the next Congress.
"Rockefeller is leaving but there will always be another member of Congress to pick up where he left off," says Jacob Olcott, a principal at Good Harbor Consulting and the former top cybersecurity staffer on Rockefeller's committee staff. "It can take years for policy to develop. Sometimes you need to act to establish a record, which can be revisited over the years."
Olcott says privacy is an issue the senator cares about, otherwise Rockefeller wouldn't be spending his remaining time working on it. He says that the senator's aim might not be enacting new regulation but to encourage policy changes that favor passengers' rights. "Regulation may not be necessary; all that may be needed here is government encouragement for airlines to review these policies and update as necessary," Olcott says.
DoT Enforcement Authority
Airlines Use of Personal Info
An examination of privacy policies of several major carriers shows that they collect personal information, including passenger's name, credit card numbers, date of birth, addresses, passport number, travel destinations and travel companions, among other information. The PII is used to personalize travel services. Airlines also share the information with marketers who tailor advertisements and services aimed at passengers. Several airlines specifically state they do not sell PII to third parties.