New DOT Airline Passenger Privacy Initiative Announced
On March 21, 2024, US DOT Secretary Buttigieg announced a new DOT initiative to review the policy practices of US airlines to ensure the protection of passengers’ personal information. This review will examine airline policies and procedures regarding the collection, handling, maintenance, and use of passengers’ personal data and potential monetization or sharing of that data with third parties.
This privacy review program is being led by the DOT’s Office of Aviation Consumer Protection (OACP). In connection with this program, OACP has already requested that the ten largest US airlines provide information on their policies, procedures, and personnel training relating to the collection, maintenance, handling, and use of passenger data and on any complaints received regarding airline employee or contractor mishandling of personal information or other airline violations of passenger privacy.
Although the privacy review program is new, this is not the first time the DOT has addressed the need to protect passenger privacy.
The DOT considers violation of passenger privacy protections an unfair or deceptive practice. See DOT, Defining Unfair or Deceptive Practices, 85 Fed. Reg. 11,881, 11,884 (Feb. 28, 2020).
In May 2020, Airlines for America (“A4A”) and IATA requested clarification that the DOT is the “sole regulator of privacy-related conduct for air carriers, foreign air carriers, and ticket agents.” Further, they requested that the DOT include a provision in its regulations as to unfair or deceptive practices expressly addressing the collection, maintenance, and mishandling of private information. The DOT declined to adopt the proposal stating that if it were to “adopt detailed privacy regulation affecting air transportation and the sale of air transportation, it should first engage in the full notice-and-comment procedures of the APA, as well as the procedures outlined in [its final rule defining unfair or deceptive practices].”
It is unclear whether the newly announced initiative is the first step towards the DOT issuing a rulemaking specifically addressing protection of passenger data.
