As agents continue to report that airlines are misusing passenger contact details entered in PNRs for unsolicited marketing, Travel News investigated what legal recourse may be able available under South Africa’s Protection of Personal Information Act (POPIA).
Under IATA Resolution 830d, agents must ask passengers whether their contact details may be shared with airlines for operational notifications. Some airlines may issue ADMs where their contact-detail requirements are not followed.
POPIA and unsolicited marketing
Section 69 of POPIA regulates direct marketing through unsolicited electronic communications. “Direct marketing by electronic communications is quite specifically regulated. Either a person has consented to direct marketing or they are an existing customer with the business, or airline, in this case,” explained Wendy Tembedza, Legal Partner at Webber Wentzel.
“If the company has not received consent, then they are actually breaking the law because they are not allowed to market outside of those two scenarios.”
Tembedza explained that, if agents' allegations were correct and airlines were using CTCM/CTCE for marketing in circumstances not permitted under POPIA, this could constitute a breach.
“It would be a breach of the law and it could expose them to fines under POPIA if they are caught,” she said.
Up to pax
While agencies may have concerns about how information supplied through bookings is used, Tembedza said legal recourse under data privacy laws rested solely with the affected passengers.
“Firstly, the consumer could go to the Consumer Commission and report that they have received direct marketing from an entity without consent and they do not wish to receive it any more. It's incumbent on any entity that does direct marketing to register on that directory so that a consumer can pick the company from the directory and block marketing from it,” said Tembedza.
Additionally, a consumer can report an instance of unsolicited marketing to the Information Regulator. She explained that, should the regulator receive multiple complaints about the same company, it may conduct an assessment.
Thereafter, if it finds the company to be non-compliant with POPIA, it would issue a directive with recommended corrective measures and then an enforcement notice. If the enforcement notice is not adhered to, the regulator may take stricter action and potentially fine the company.
How agents can protect themselves
For agencies, Tembedza said it was important to ensure they had complied with their own obligations when collecting and sharing passengers’ personal information.
“From the travel agent's perspective, because they are collecting that personal information from the data subjects, their privacy policy must detail what personal information will be shared, with which entities and for what purposes,” said Tembedza.
Section 18 of POPIA sets out requirements for notifying data subjects about the collection of their personal information, including the purposes for which it is collected.
“The agency must make sure that it is clear in their privacy policy, that their clients’ data will be shared with GDSs or airlines for the purpose of facilitating travel, or providing operations updates only,” she said.
“As a travel agent, you want to limit the scope of your own potential liability in this potential scenario.”
Tembedza said agencies should also ensure their agreements with GDSs and airlines clearly set out how passenger data may be shared and used.
For example, she said, an agreement with a GDS could specify that users of the platform, including travel agents and airlines, may use the data only for the purpose of facilitating bookings.
“Unless the parties agree to allow for the data to also be used for marketing purposes, they are not allowed to, because the agreement does not offer that protection and there would be indemnities around any breaches,” she explained.
