A senior industry lawyer has challenged the Civil Aviation Authority (CAA) over a proposed amendment to an Atol standard term requiring a significant expansion of the data the CAA requires to be available on demand.
The CAA launched a consultation on the amendment to Atol Standard Term 5, “to clarify the requirements for booking data to be held” by Atol holders with licensed business of £20 million or more a year, on December 3. This was extended to the end of February to encourage more responses.
Speaking at an Abta Travel Finance conference last week, CAA head of Atol Michael Budge explained the aim as “to better equip the CAA to deal with failures, to ensure there is sufficient data to deal with repatriation and ticketed flights, and deal with people yet to travel who want their money back”.
This requires “a significant amount of booking data and detail”, he said, noting: “When businesses fail we generally find the information is terrible.”
Budge suggested the proposal “should improve overall standards and bring benefits in oversight”.
Industry lawyer Farina Azam, partner at Fox Williams, said: “A breach of Standard Term 5 is a criminal offence so we need to take this seriously.”
She suggested an Atol holder “could potentially be subject to burdensome requests for data”, pointing out: “There is no sense of when the CAA can request this information [and] no restrictions on how often the CAA can request it.”
Azam added: “It’s a huge amount of data requested – booking data, commission to agents, passengers’ medical data. What will the CAA do with that data? Are they sharing it? How long will they retain it?”
She argued: “You’re talking about commercially sensitive data and personal data. I would want to know where the CAA intends to store the data, how it will secure it and who will pay the cost of a data breach.”
Some Atol holders may require systems upgrades to provide this data, she said, and pointed out: “If the CAA makes a request, you would only have three days to comply. That is not enough time.”
Budge responded by insisting: “It’s a consultation. It’s looking at what can be delivered. That is the point of a consultation. No one is going to set this up in a way that breaks the law.”
He argued: “When we’ve spoken to businesses, they haven’t raised a problem so long as there is adequate lead-in time and a transition. [But] if businesses don’t have the information, that is a problem. How are they running their business?”
Budge explained: “We had problems with [the failure of] Thomas Cook when we had to bring customers back who required oxygen to travel and airlines said, ‘We can’t handle that’.
“We need to know when an individual has a medical condition. We need assurance you can provide the data.”
The consultation document included 25 pages of data requirements.