BEFORE THE DEPARTMENT OF TRANSPORTATION ADVISORY COMMITTEE ON AVIATION CONSUMER PROTECTION STATEMENT OF MICHAEL VATIS, STEPTOE & JOHNSON LLP ON BEHALF OF GLOBAL DISTRIBUTION SYSTEMS AMADEUS, SABRE, AND TRAVELPORT May 21, 2013 Madam Chair and Members of the Committee, My name is Michael Vatis. I am a partner at the law firm of Steptoe & Johnson, and I am here today to speak on behalf of the Global Distribution System members of the Travel Technology Association, specifically, Amadeus, Sabre, and Travelport. These three GDSs are the largest GDSs globally and in the United States. I am pleased to be here today to share with you information about how the GDS system works, and how GDSs protect the personal information of airline travelers. Although I am speaking on behalf of all three GDSs, my knowledge is greatest with respect to Amadeus, as it is a Steptoe client. So I may make more specific references to the way Amadeus operates to illustrate key points. GDSs serve two sides of the air travel marketplace, travel agents and airlines. Airlines provide GDSs with constantly updated information about the flights they offer and the fares and seat availability on each flight. The GDS then provides the tool by which travel agents can access the vast amount of information provided by the airlines through appropriate searches and make bookings on behalf of consumers, and then store, change, and service those bookings. In this trilateral relationship, the travel agent typically has an agreement with the airline under which the airline enables the agent to sell the airline s services, and the travel agent and airline 1
must each have agreements with the GDS regarding utilizing the GDS in creating and issuing travel itineraries. Virtually all network airlines (and a significant number of low-cost carriers) participate in each of the GDSs. Agents often utilize the services of one GDS, but can and do use more than one GDS. Travel agents use a GDS to determine what flights are offered between the points the passenger seeks to travel, the availability of seats on any particular flights, the relevant fares and other pertinent information. The GDS also provides to the agents the facility to make the booking on the chosen flight and important back-office functions that allow the agency to maintain required records. When a consumer seeks to buy a seat on an airline, the travel agent enters the relevant data about the passenger and her itinerary into the GDS, and thereby creates a Passenger Name Record (PNR). Any modification in the itinerary will also be entered by a travel agent into the GDS. The GDS then transmits that information to the airline, which accepts the reservation on behalf of the consumer/passenger. The GDS has no direct interaction with the consumer during this process. Generally, the consumer is unaware of the role of the GDS or the identity of the GDS used by the travel agency. A PNR contains the details of a passenger's reservation and other information related to a passenger's trip. To create a PNR into a GDS, a travel agent must include at least the following data: Name Itinerary Contact information Ticketing information (i.e., when the ticket is going to be issued) 2
Received From (i.e., the travel agent who has created or modified the ticket) The PNR may also contain other data, such as frequent flier information. Only the travel agent, airline or airlines if the travel involves more than one airline, and the GDS have access to the PNR, unless one of them permits access by a third party. The GDSs do not disclose personal information to third parties except where necessary to fulfill any bookings, purchases, or requests, or for credit checks or fraud prevention; when required by law; or when necessary to comply with a lawful request by government authorities or a court. When personal data is transferred to a third party, as is required in order to fulfill a booking, it is typically the policy of each GDS to require through provisions in contractual arrangements that the party to which the data is transferred agree to abide by applicable privacy and data security laws and policies. Amadeus, for example, has explicit provisions in its contracts with both travel agency subscribers and with airline and other travel providers that impose mutual obligations to adhere to applicable laws governing the privacy of data. GDSs generally retain PNR data for 72 hours after the flight departure of the last segment on an itinerary. After that, the data is taken out of the system and stored offline for a period of several years, before it is permanently erased. The purpose of this archiving is generally to allow travel agents or airlines to resolve any billing disputes. GDSs operate in dozens of jurisdictions globally, many of which have their own privacy laws and regulations. Each of the GDSs undertakes to comply with the privacy laws and regulations of the jurisdictions in which they operate, including those governing data privacy and security. In particular, Amadeus, which is based in Spain and maintains its data center in Germany, is subject mainly to the European Data Protection Directive. That Directive creates a comprehensive regime regarding the protection of personal information. 3
Each GDS has employees that manage programs designed to protect personal information from unauthorized use, disclosure, destruction, or alteration. These programs comprise technical, physical, and administrative measures. The technical measures include encryption technology to ensure the secure transmission of confidential information, including credit card details. They also include authentication technology, including password protections, to prevent unauthorized access to such data. In all cases, passenger data is made available only on a needto-know basis; unless there is an agreement to the contrary, personal data compiled by one travel agency and entered into the GDS is not shared with any other travel agency or with any entity other than the travel providers or others who may need to have the data to provide service to the passenger. With regard to privacy, it is important to note the different approaches taken by Europe and the United States. In the European Union, GDSs are regulated by Council Regulation (EC) No. 80/2009, which established a Code of Conduct. The Code of Conduct is generally designed to ensure fair competition in the provision and use of GDS services. It also, however, requires that the privacy of end consumers be respected. In particular, Article 11 of the Code provides, among other things, that: personal data collected for the purpose of making reservations or issuing tickets shall only be processed in a way compatible with these purposes; personal data shall only be processed insofar as processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; 4
sensitive data (concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or health or sex life) shall only be processed where the data subject has given his or her explicit consent on an informed basis; personal information concerning identifiable individual bookings shall be stored offline within seventy-two hours of the completion of the last element in the individual booking and destroyed within three years. Access to such data shall be allowed only for billingdispute reasons; and marketing, booking and sales data shall include no identification, either directly or indirectly, of natural persons or the organizations or companies on whose behalf they are acting. In addition, when personal data has been collected in the EU, the actors involved in the collection and processing of the data must comply with the European Data Protection Directive (95/46/EC), the principal data protection law in the EU. The Directive applies to the data collected in any of the 27 EU Member States plus Iceland, Liechtenstein, and Norway. The Directive and national implementing legislation in each country impose stringent data protection requirements on the processing of personal information from persons subject to the Directive. Among other things, the Directive requires that: personal data be processed fairly and lawfully, and collected for specified explicit and legitimate purposes. The data must also be accurate and, where necessary, kept up-to-date; personal data be processed only if the data subject has unambiguously given his or her consent or where processing is necessary: 5
o for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; o for compliance with a legal obligation to which the data controller is subject; o in order to protect the vital interests of the data subject; o for the performance of a task carried out in the public interest; or o the for purposes of legitimate interests pursued by the data controller or a third party to whom the data is disclosed; the data controller provide the data subject with certain information (the identity of the data controller, the purposes of the processing, recipients of the data, etc.); the data subject be allowed access to his data in order to rectify errors or have the data erased or blocked; the data subject have the right to object to further processing of such data; the data controller implement appropriate measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access; and the data controller notify the relevant national supervisory authority about the processing before carrying out processing operations. Companies within Member States may not transfer personal information to a non-eu state unless that country has been deemed to provide an adequate level of protection; the data subject unambiguously consents to the transfer; the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject s request; the transfer is necessary for the 6
conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party (which is generally the case for GDS bookings); the transfer is necessary or legally required on important public interest grounds or for the exercise or defense of legal claims; or the transfer is necessary to protect the vital interests of the data subject. Such a transfer is also permitted if the company utilizes approved binding corporate rules or standard contractual clauses to ensure the protection of data by the receiving entity. The United States as a whole has not been deemed by the EU to provide adequate protection. However, under the EU-U.S. Safe Harbor Framework, EU data can be transferred to U.S. companies that certify that they will abide by the Safe Harbor principles. These principles generally require U.S. companies to provide data protection commensurate with the requirements of the EU Data Protection Directive. As a company with significant operating facilities in both the EU and the U.S., Travelport has held a Safe Harbor certification since 2010. In the United States, by contrast, there is no general data protection directive. Rather, at the federal level, data protection rules are established on a sector-by-sector basis. Thus, the Gramm-Leach-Bliley Act establishes privacy and security requirements for financial institutions, and the Health Insurance Portability and Accountability Act (HIPAA) does so for certain healthcare companies. In addition, the Federal Trade Commission in recent years has begun to assert its general power to police unfair and deceptive practices in commerce to bring enforcement proceedings against companies that it believes have provided inadequate protection to personal information. The Department of Transportation also administers a similarly broad prohibition, found at 49 U.S.C. 41712, against unfair and deceptive practices in the sale of air transportation. Airlines and ticket agents, which include GDSs, are subject to this statute. 7
At the state level, 46 states plus the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands have passed laws requiring companies to notify affected individuals and, in some cases, regulators if certain personal information about a state resident has been breached. In addition, states such as Massachusetts have begun to establish laws and regulations requiring companies to institute data security programs and procedures to protect personal information of state residents. The GDSs are highly respectful of the legitimate interests of passengers in maintaining the confidentiality of travel data and of the policies underlying the laws noted above. They also conduct regular data privacy training and certification for their employees. The industry is justifiably proud of its long and successful record of maintaining high data security standards and taking all reasonable steps to avoid improper disclosures. They will be pleased to provide any further information that the Committee may require in this area. I hope this brief statement has been useful in describing the operation of GDSs and the ways they protect consumer data, and general privacy frameworks in the EU and U.S. I would be happy to take any questions you might have. Thank you. 8