Eight years of negotiations over airlines’ use of passenger contact information have reached a deadlock, with ASATA warning that the misuse of this data could damage agents’ relationships with clients and potentially contravene the Protection of Personal Information Act (POPIA).
At the centre of the dispute is IATA Resolution 830d, which requires travel agents to give passengers the option of providing their contact details to airlines for operational notifications, including flight cancellations, schedule changes and delays.
However, agents have repeatedly raised concerns about airlines using this information for unsolicited marketing.
“ASATA's position is that passenger contact information provided by travel advisors and entered into a PNR is provided for one purpose only: so that airlines can contact passengers about operational disruptions such as cancellations, schedule changes and delays,” Otto de Vries, CEO of ASATA, told Travel News.
“Using that data for direct marketing goes beyond the purpose for which it was collected and shared. This makes it a legal issue. POPIA has been fully in force since July 2021 and it limits the use of personal information to the purpose for which it was collected. It also places strict conditions on direct marketing by electronic communication. Using PNR contact details for marketing without the consent POPIA requires could amount to a breach of the law and expose airlines to fines.”
Agents bear reputational risk
De Vries warned that the practice could undermine trust between travel agents and their clients, as well as between agents and airlines.
“Many travellers see themselves as the advisor's client, not the airline's. They expect their advisor to protect their personal information from third parties. When a traveller starts getting marketing emails from an airline after booking through a travel advisor, it's the advisor who takes the reputational hit.”
To protect themselves and their clients, De Vries urged agents to ensure their POPIA compliance is in order, including privacy policies that clearly explain what client information is shared, with whom, and for what purpose.
In this case, policies should state that client contact details are passed to airlines only for operational updates.
Under Resolution 830d, agents must give passengers the opportunity to provide their contact details to airlines or decline to do so. De Vries said agents should explain the choice and retain a record of the passenger's decision.
“Clients should also know that they can lodge a complaint with the Information Regulator, as, under POPIA, the right to complain rests with the passenger,” said De Vries.
“If clients receive unsolicited airline marketing after a booking, we encourage advisors to document it and report it to ASATA, so that we can raise specific cases with the airlines concerned,” said De Vries.
Negotiations reach stalemate
ASATA has been challenging aspects of Resolution 830d since 2018, when IATA proposed making the provision of passenger contact details mandatory, subject to passengers' right to refuse.
Just before the amended Resolution 830d took effect on June 1, 2019, ASATA formally wrote to IATA to raise its concerns about maintaining data protection compliance under both POPIA and the EU’s General Data Protection Regulation.
“We also pointed out that the principle of data minimisation offered a less invasive option: the airline could contact the travel advisor and the advisor could contact his or her client,” explained De Vries.
IATA replied in June 2019. It maintained that providing contact details would remain mandatory, subject to the passenger's right to refuse, and argued that airlines could rely on legal grounds other than consent, such as legitimate interests, to process the data.
ASATA wrote again in July 2019 and urged IATA to suspend the Resolution while a full compliance and operational impact assessment was done. ASATA says it did not receive a reply to that letter.
In late 2019, ASATA worked with other travel industry bodies, including the European Travel Agents’ and Tour Operators Association, the Travel Technology Association and the GDSs to respond to airline proposals on new wording for 830d.
ASATA and the travel industry bodies pushed for three things:
- a clear, narrow definition of 'operational disruption', so that the data can't be used more broadly;
- recognition of the privacy agreements between travel advisors and their clients;
- sanctions for airlines that abuse 830d.
Through the World Travel Agents Associations Alliance (WTAAA), travel agent representatives continued to push for these amendments to the resolution at IATA's Passenger Agency Programme Global Joint Council.
According to De Vries, before the pandemic, a joint working group of travel advisor and airline representatives couldn't reach agreement because airlines wanted to use contact data as broadly as possible, while travel advisors wanted usage limited to genuine operational disruptions.
After the pandemic, a second working group eventually agreed on revised wording. However, it needed endorsement from airline headquarters and not all airlines supported it, he explained.
“Frankly, the matter, as it currently stands, is deadlocked,” he said.
IATA has since suggested that its digital identity initiative may resolve the question of obtaining passenger contact information.
“Through WTAAA, we have formally asked IATA to explain how that would work and how it would comply with data protection law,” said De Vries.
“We'll keep pushing, but the lack of progress after eight years is very frustrating for the travel advisor community."
