Big Brother in the air: flight data giant sells billions of passenger profiles

An airline industry clearing house, which has been largely unknown to the public until now, collects and processes data on twelve billion passenger flights per year and sells this information to the US government. To this end, the Airlines Reporting Corporation (ARC) offers licenses for a travel information program in the form of the Travel Intelligence Program (TIP) for authorities in order to make the mountains of data centrally searchable. This is according to recently published procurement documents from the US Immigration and Customs Enforcement (ICE), which is taking particularly tough action against migrants under US President Donald Trump and is using ARC's analysis options.

"ARC has a unique position within the aviation industry as a central hub for financial processing and data exchange between airlines and travel agencies, ensuring secure and efficient transactions," said ICE, explaining the license purchase. With its comprehensive industry data, ARC offers "unrivaled insight and analysis" to support airlines' revenue management, fraud prevention and operational efficiency. The main task is to accredit travel agencies and manage financial processing, creating a "comprehensive real-time database of tickets sold".

"Travel agents must submit ticket sales and funds for over 240 airlines worldwide to the ARC on a daily basis," ICE explains. TIP allows authorized law enforcement and security personnel to search ARC's airline ticket database "to track and analyze the travel patterns of persons of interest". Users could perform searches based on key identifiers such as passenger name, itinerary, fare details and payment methods. The extensive registry contains over one billion records and covers 39 months of past and future travel data, providing "an unprecedented source of information".

Copy of issued tickets

The ARC acts as a clearinghouse through which travel agencies in the USA – from small family businesses to large online agencies such as Expedia or Booking.com – pay airlines for the tickets they sell. Its role is similar to that of Visa or MasterCard in credit card transactions, explains US civil rights activist Edward Hasbrouck from the Californian Identity Project. Unlike the two financial service providers, however, ARC has no competitor in the USA.

The US travel agencies report ticket sales to the ARC daily via links to computerized reservation systems. Each week, they also submit a report that includes a copy of all tickets issued, the amount paid, the fare calculation and tax breakdown, and the method of payment. ARC deducts the total amount of weekly sales for all airlines from the partner's bank account and pays each airline a total weekly amount for the tickets issued.

The company is jointly owned by nine major airlines. These include Delta, Southwest, United, American Airlines, Alaska Airlines, JetBlue and Air Canada from North America as well as Lufthansa and Air France from the EU. According to Hasbrouck, the ARC only processes payments from travel agencies in the USA. Refunds and credits from other travel agents are processed via regional clearing houses, such as the umbrella organization International Air Transport Association (IATA).

What about the GDPR?

In addition to ICE and the Department of Homeland Security (DHS), the Department of Defense and the Department of the Treasury are also among the TIP users. This is not the only reason why data and consumer protection advocates are very concerned about the massive register and the access it enables. "This is probably the most significant aggregated database of American air travelers," Hasbrouck told The Lever magazine. The fact that the US government can make use of it is a big deal.

The company has long had "a virtual monopoly on the processing of flight bookings", complains Bill McGee from the consumer protection organization American Economic Liberties Project. The fact that ARC sells the extensive personal information to the US government is "appalling". An ARC spokesperson told The Lever that TIP was set up after the September 11 terrorist attacks to support investigators. Contracts with the Pentagon, for example, are said to date back to at least 2017. At the same time, law enforcement officers have had access to Passenger Name Records (PNR) for many years via controversial agreements and guidelines. However, the ARC information goes beyond this and is easier to search.

The findings on TIP to date still leave many questions unanswered. For example, it is unclear whether governments of other countries will also make use of it. If ticket purchases by EU citizens were to be recorded, it is also doubtful whether this would be compatible with the General Data Protection Regulation (GDPR). Airlines and travel agencies have generally not explicitly informed their customers about these practices to date, meaning that it is unlikely that they would be able to consciously consent to data processing.

(akn)