So far as we know, that never happened. But Air Canada has just as much of a duty to ensure that cor

Airlines should have been defending their customers against government demands for information. Instead, they have chosen to collaborate with governments not just in surveillance and violation of the rights of their customers , but in the cover-up of those practices and the attempt to keep travelers from realizing their extent.
As it happens, we had gotten another letter earlier this week from the Canadian science center los angeles Border Services Administration (CBSA), containing portions of its records of Passenger Name Record (PNR) and Advance Passenger Information (API) data about our flights on Air Canada, which CBSA had obtained from computerized reservation systems and Air Canada science center los angeles s Departure Control System (DCS):
The information in the CBSA Air Targeting files includes both PNR and API data for Air Canada flights, despite science center los angeles the claim : that, Air Canada is not in a position to provide you with API s records science center los angeles and logs for the flights listed in your Request since no such API s records were created.
And earlier this year, in the last batch of information disclosed by US Customs and Border Protection in response to our Privacy Act and FOIA lawsuit for records from the CBP Automated Targeting System , we received copies of two PNR s that CBP had obtained from different reservation systems for those same Air Canada flights:
The airline tickets for this trip to Europe last fall by identity Project consultant Edward Hasbrouck were fairly typical of the confusion and complexity fostered by airline alliances and codesharing.
Air Canada science center los angeles issued a single electronic ticket science center los angeles for the entire journey, including outbound flights from Boston to Montréal to Brussels with Air Canada flight numbers (one of which was actually operated by the Air Canada Jazz division), and return flights from Ljubljana to Zürich to San Francisco with Swiss International flight numbers (one of which was actually operated by the Slovenian science center los angeles national airline, Adria).
We bought these tickets from Air Canada through the Vayama.com Web site (a/k/a Airtrade International ), which is operated by a large Netherlands-based travel science center los angeles agency, Travix International , itself a subsidiary of the still larger Dutch travel conglomerate BCD Holdings . To the extent that our dealings science center los angeles with Air Canada were carried out through Vayama.com, our personal science center los angeles information is protected by Dutch as well as Canadian law.
In making my reservations and issuing tickets, Vayama.com/Airtrade/Travix acted solely as an agent of the airlines by which it had been appointed science center los angeles in this case, Air Canada. science center los angeles The ticket correctly shows that it was issued by Air Canada. Air Canada was the principal in my contract of carriage, with the travel agency acting as the airline s agent.
Air Canada s claims in its letter that it has no control over its agents, and that its agents are independent , are entirely untrue. Each airline has complete control over whether to appoint agents (some airlines such as Ryanair don t appoint any agents), what authority to give those agents to act on behalf of the airline, and what conditions to place on agents exercise of their delegated science center los angeles authority to act on behalf of the airline. Airlines can and routinely do revoke the appointments of agencies that violate the conditions of their appointments.
Air Canada s disclaimer of responsibility for the actions of its agents, its claim that travel agencies are independent from Air Canada , and its repeated references to your travel agency (i.e my travel agency), when the agency acted as Air Canada s agent and not as my agent, stand the law of agency on its head.
Legally, what is done by a duly appointed agent is considered to have been done by the principal. The principal science center los angeles is responsible for the acts of its agents, whether those agents are employees at a ticket counter or corporations appointed by the airline to act as its agents in making reservations, accepting payments, and issuing tickets in the name of the airline.
If it were true that Air Canada had no control over its agents, that would be a flagrant violation of both PIPEDA (the Personal science center los angeles Information Protection and Electronic Documents Act , the basic Canadian privacy law for commercial data) and Air Canada s published privacy policy , which claims that Air Canada has contracts science center los angeles with its contractors requiring them to comply with its privacy policy including its provisions for access by individuals science center los angeles to information about ourselves.
When PIPEDA first came into effect for airlines, and thus for their agents, it should have notified travel agencies of their new obligations, whenever they acted as an agent for Air Canada, to comply with PIPEDA.
science center los angeles So far as we know, that never happened. But Air Canada science center los angeles has just as much of a duty to ensure science center los angeles that corporations that act as its agents accept and are conversant with their obligations under PIPEDA, before Air Canada appoints them to act as its agents, science center los angeles as Air Canada has to ensure that its employees accept science center los angeles and are conversant with their obligations under PIPEDA before those employees are authorized to start handling personal science center los angeles information subject to PIPEDA on Air Canada s behalf.
Air Canada science center los angeles also claims that it isn t responsible for, and is unable to obtain data from, its contractors including CRS s and the other airlines for which it issued tickets. Once again, this is probably untrue, but if true would indicate a failure to comply science center los angeles with PIPEDA and Air Canada s own privacy policy.
Another major problem revealed by Air Canada s letter is the admission that no record is kept of incoming or outgoing interline messages and that the system used by Air Canada does not track consultations science center los angeles of a PNR record. Only accesses resulting in a transaction are recorded.
This is true, and makes it impossible for Air Canada or any other airline which uses these systems science center los angeles to comply with the law. Both Canadian and Dutch privacy and data protection law requires a business to disclose, on request, the third parties and third countries to which personal information has been transmitted. It is thus a clear violation of both Canadian and Dutch law for Air Canada and its Dutch agent Vayama.com to use systems that lack access logs.
In practice, governments have been given root access to the computerized reservation systems used by airlines and their agents. These government departments including CBP can pull any PNR. Without access science center los angeles logs it s impossible to know which PNR s have been retrieved by which governments.
You can see this in the two PNR s for this trip which CBP had in their ATS database. The first, #10 in their list, shows only the Air Canada flights, and presumably was obtained from Air Canada s host system or host partition in a CRS. The second PNR, #11 in the CBP list, is labeled as an LX (Swiss International Airlines) PNR, but includes both the flights with Swiss flight numbers and the Air Canada flights.
In the absence of some bilateral or multilateral (Star Alliance?) codesharing or data sharing agreement, Swiss wouldn t have been able to see the Air Canada flights in this PNR. What this suggests is that, when CBP retrieved what it considered the Swiss PNR, it had root user privileges to pull the entire multi-airline PNR created in the CRS by the travel agency.
To date, none of the airlines from which we have requested records of what they have done with our reservations, and to whom they have disclosed them KLM , Air France , Lufthansa , and now Air Canada has complied with their legal obligations. Air Canada has proved to be even worse than the others, not just failing to keep records of disclosures and withholding information it was required to provide, but denying that known disclosures to both the Canadian and US governments had occurred.
We will be pursuing these issues the lies, the misinterpretations of the law, and the admissions of failures to comply with the law with Air Canada, its agent Travix International, Amadeus (the source of the references in the PNR s to 1A for Amadeus, and MUC and MUCRM1A for the Amadeus data center or Reservations Mainframe near Munich in Erding, Germany) and other reservation systems, the Privacy Commissioner of Canada, and data protection authorities in the Netherlands (Travix International) and Spain (Amadeus).