An advisory body on data protection to the European Commission has issued “a stern warning” to airline association Iata on its New Distribution Capability (NDC).
The Article 29 Data Protection Working Party (WP29), made up of representatives of the data protection authorities of EU member states, has written to Iata noting the potential of NDC “to change business processes used to offer and sell flight tickets”.
Its letter warns that the NDC initiative “could lead to discriminative practices” in the way airlines offer fares to customers.
The letter notes: “The NDC initiative may result in a remarkable change in terms of personal data processing … in the air travel market.”
The Working Party has refrained from taking a formal position “at this point … given the current uncertainty on the way the NDC initiative will be developed”.
However, it says the personal data processing involved in any NDC application “must comply with European and national legal frameworks”.
The letter “notes in particular that Iata has expressed ‘its intent to preserve anonymous shopping’” and states: “The WP29 will closely follow the developments resulting from this initiative.
“The WP29 would also remind the interested parties that, in some member states, national data protection authorities must be consulted before commencing any processing.”
The European Technology and Travel Services Association (Ettsa), which represents leading travel technology companies and online travel agencies, hailed the letter from the working party, saying: “It is a stern warning which we welcome.”
Ettsa secretary-general Christoph Klenner (pictured) said: “The working party has taken the strongest possible position in the circumstances. A formal opinion would be premature given NDC is not implemented yet.
“This leaves space for Iata and stakeholders, including Ettsa, to work through the privacy concerns.”
Klenner said: “We particularly welcome the fact that the working party is holding Iata to its promise to safeguard anonymous shopping. That is a key concern.”
The letter notes: “Data collection and processing practices associated [with] the implementation of the NDC initiative . . . could lead to discriminative practices derived from profiling.”