Data protection in aviation: Why it matters and how a DPO can help
The commercial aviation sector is an extremely demanding area in which to work, bearing in mind the increasing regulatory pressures it faces. The rules and regulations this industry must comply with are forever evolving and cover multiple topics, such as sustainability and environmental issues, safety matters, competition and consumer law, the security of electronic systems and the protection of personal data, to name but a few.
In this article, we focus on the challenges involved in keeping passenger data secure and ensuring it is processed in accordance with the applicable law.
The complexities of protecting data in airports
Airlines and airports enable huge numbers of people to fly around the world every day, and, in order to provide this service, it is necessary for them to process vast amounts of records relating to individuals. This personal data relates to a wide variety of people, some of whom may be travelling and some of whom may be working at the airport, as an employee or contractor, and some may simply be visiting the airport to collect friends or family.
All personal data collected, whether it relates to pilots, technical crew, cabin crew, ground crew, employees, visitors, or passengers (and their emergency contacts), must be processed securely and in accordance with the relevant data protection legislation.
This is a complex task since not all countries operate under the same law. For example, in the European Union, the General Data Protection Regulation applies, but in California, United States, the California Consumer Privacy Act applies. Not every country in the world has adopted a data protection law, but to date, over 150 countries have, and this figure is continuing to grow.
Passenger data
Adding to the complexity is the wide variety of personal data collected, some of which is more sensitive than others. For passengers, data collection starts with basic information at the time of booking, such as name, address, email address, and credit card details. Later, when purchasing tickets or checking in, more sensitive information may be required. This can include passport details, dietary requirements, and any accessibility needs.
Upon arrival at the airport, additional data may be gathered, including CCTV footage, vehicle registration numbers, and facial recognition images. These can be used to track an individual’s movements throughout the airport.
If this data is misused, whether for identity theft or other malicious purposes, the consequences for individuals can be serious. The same level of risk applies to data belonging to airport staff. For instance, if information about a pilot or crew member is compromised, it could present a significant threat to the safety of an aircraft and everyone on board.
Breaches in the aviation sector
As significant harm could arise should any personal data held by the aviation industry fall into the wrong hands, it is imperative that appropriate safeguards are implemented to protect it.
However, despite an expectation that the data will always be kept secure, several major breaches have made the headlines in recent years.
For example, in 2018, Cathay Pacific suffered a cyber-attack in which hackers were able to access the personal data of over nine million customers, including passport numbers.
A couple of years later, in 2020, EasyJet was also subjected to a cyber-attack of a similar magnitude, with 9 million people affected and hackers accessing the credit card and debit card data relating to over two million people.
In addition to this, British Airways experienced a major breach over several months in 2018, which led to the loss of personal data relating to over 400,000 staff and customers. This incident was investigated by the Information Commissioner’s Office (“ICO”) and resulted in a Penalty Notice of £20 million.
Consequently, if the appropriate measures are not taken, and a breach does occur, there is a real danger that the incident could lead to a substantial fine from the relevant regulator and individuals may bring legal proceedings, if they are able to provide evidence that they suffered material harm as a result of the incident.
Such action could, at best, make a huge dent in profits, but what could be even more detrimental is the negative press that will ensue, damaging consumer confidence and destroying an airline’s and/or airport’s reputation.
A potentially larger concern is what could happen if malicious actors were able to compromise the identity of a pilot. The resulting security risks could be severe, potentially endangering the safety of passengers and crew.
In view of this, the aviation industry must prioritise the protection of all personal data it processes.
Benefits of expert DPO support in the aviation sector
If you operate in the aviation sector, even if it is not mandatory for you to appoint a data protection officer (“DPO”), ensuring that you have expert support from a DPO brings huge benefits. For example, your DPO will be able to:
- Assess your existing level of compliance
- Identify gaps and provide advice on how to address them
- Assist in the implementation of appropriate technical and organisational measures to safeguard personal data, thereby helping to ensure that all personal data is secure
- Monitor compliance and provide guidance on how to resolve issues as they arise
- Provide ongoing advice and assistance
As a result, your organisation will be less likely to experience a personal data breach, but if it does, your DPO will be able to assist in dealing with it and liaising with the regulators and the individuals affected.
How DPO support benefits specific roles
Expert DPO support in the aviation sector directly assists specific roles. For example, with on-hand support from a DPO, the adverse implications of a personal data breach should be heavily mitigated, helping to ensure adequate measures are taken, resulting in business continuity and the protection of your brand’s reputation, keeping the C-Suite happy.
Also, expert DPO support will be able to assist compliance officers and legal teams, ensuring that compliance processes become streamlined, thereby reducing regulatory risks.
In addition to this, an expert DPO will be able to collaborate with your IT and security teams on security frameworks, ensuring that data protection by design and default is applied and data protection is aligned with cybersecurity measures.
Consequences of not having DPO support
On the other hand, if expert DPO support is not provided, the risks are high. For example:
Inefficiencies within processes
Without expert DPO support, your organisation may struggle to adhere to the requirements imposed by the data protection legislation, such as responding to subject access requests appropriately and in an timely manner, conducting data protection impact assessments, when necessary, ensuring that data protection by design and default are embedded within your processes, demonstrating that you comply with the accountability principle and ensuring that there is a culture of data protection compliance within your organisation.
Vulnerability
The inefficiencies mentioned above may lead to vulnerabilities within your organisation, making you more at risk of personal data breaches, whether that is a result of poor processes and employee error or cyberattacks.
Fines
If the vulnerabilities lead to a personal data breach, this could result in a fine from the regulator, depending on the circumstances and the severity of it. As we’ve seen from the Penalty Notice issued by the ICO against British Airways, the financial impact can be significant.
Reputational
Further, if a personal data breach does occur, this will lead to bad publicity, which will damage your reputation, leading to further financial harm when people take their custom elsewhere due to the lack of trust that they will feel as a result of your failure to ensure their personal data is kept securely.
Therefore, the consequences of not having expert DPO support are, potentially, very serious, since even failing to implement appropriate policies and procedures for processing personal data can lead to a significant personal data breach that can affect hundreds of people and adversely affect your business.
Steps to ensure regulatory compliance within aviation
To ensure regulatory compliance, we would recommend the following steps:
- Appoint a suitably qualified and experienced DPO or an external DPO service provider
- Conduct a gap analysis
- Address gaps identified
- Implement appropriate technical and organisational security measures, including regular data protection awareness training for staff, robust policies and procedures and secure processes and electronic systems
- Conduct data protection impact assessments (DPIAs), where necessary
- Carry out due diligence on all vendors you engage with
- Ensure data protection by design and default is embedded into processes
- Implement a monitoring framework to ensure that compliance is continually monitored
Following the above steps will help your organisation to comply with the data protection legislation, avoid personal data breaches and build trust and confidence with staff and clients.
Data protection success for Farnborough Airport
Having acted as data protection officer for Farnborough Airport for over two years, this is what they had to say about our service:
Farnborough Airport has been working with Evalian since November 2023, in which time the service provided has proven to be extremely supportive and professional in the following ways:
- Always clear about the services that they offer, their remit and signpost options where requests are out of their services or remit,
- Clients’ priorities and requirements consistently met through scheduled catchups with account manager,
- Confidence in the expertise of the Evalian team, in particular of the lead Principal Data Protection Consultant (Data Protection Officer ‘DPO’).
We’d like to thank Evalian for their support, expertise, integrity and for making it a pleasant overall working relationship.
We are also the data protection officer for The Aviator Hotel, which is connected to Farnborough Airport.
We have definitely saved time internally, It’s taken the burden away from us, leaving us time to concentrate on our day-to-day business.
We now have total confidence knowing that we are taking the right steps and that our Evalian consultant is always on top of things. We know we’re less likely to suffer a breach, and if we do, we know it will be handled quickly and effectively. We have confidence we’re complying with the GDPR and at no risk of penalties.
– Madhu Murtala, Director of Finance, Aviator
Conclusion
Therefore, depending on the circumstances, if a personal data breach occurs, airlines, airports and linked businesses could suffer serious financial and reputational harm and individuals could also be subjected to financial loss or even physical harm. Consequently, it is clear that implementing appropriate safeguards to protect personal data is of paramount importance within the aviation industry, bearing in mind the potentially disastrous consequences that a personal data breach could give rise to.
DPO support for airlines
We have highly qualified data protection consultants within our data protection practice with a wealth of experience acting as data protection officers within the aviation industry. We would be glad to assist you in your compliance journey. Contact us to discuss a package tailored to your particular needs.
