FAQ 13 - Travel Information Airline Passenger Reservations

Q : When can airline passenger reservation and other travel information, such as frequent flyer or hotel reservation information and special handling needs, such as meals to meet religious requirements or physical assistance, be transferred to organizations located outside the EU?

A: Such information may be transferred in several different circumstances. Under Article 26 of the Directive, personal data may be transferred "to a third country which does not ensure an adequate level of protection within the meaning of Article 25(2)" on the condition that it (1) is necessary to provide the services requested by the consumer or to fulfill the terms of an agreement, such as a "frequent flyer" agreement; or (2) has been unambiguously consented to by the consumer. In addition to those and other circumstances, such information can be transferred to U.S.. US organizations subscribing to the safe harbor, provided that the European transferor has adhered toharbor provide adequate protection for personal data and may therefore receive data transfers from the EU without meeting those conditions or the terms of the relevant Member State laws.  For example, customers may inform airlines (or travel agents) of the need for physical assistance or other special needs. The transfer of such information to organizations within the safe harbor is permissible because adherence to the principles provides adequate protection of personal information, even where this includes sensitive information. other conditions set out in Article 26 of the Directive. Since the safe harbor includes specific rules for sensitive information, such information (which may need to be collected, for example, in connection with customers' needs for physical assistance) may be included in transfers to safe harbor participants. In all cases, however, the organization transferring the information has to respect the law in the EU Member State in which it is operating, which may inter alia impose special conditions for the handling of sensitive data.