The Airlines Reporting Corporation (ARC), a data broker owned by the country’s major airlines which sells travellers’ detailed flight records in bulk to the government, only just registered as a data broker with the state of California, which is a legal requirement, despite selling such data for years, according to records maintained by the California Privacy Protection Agency (CPPA).
The news comes after 404 Media recently reported that ARC included a clause in its contract barring Customs and Border Protection (CBP), one of its many government customers, from revealing where the data came from. ARC is owned by airlines including Delta, American Airlines, and United.
“It sure looks like ARC has been in violation of California’s data broker law—it’s been selling airline customers’ data for years without registering,” Senator Ron Wyden told 404 Media in a statement. “I don’t have much faith the Trump administration is going to step up and protect Americans’ privacy from the airlines’ greedy decision to sell flight information to anyone with a credit card, so states like California and Oregon are our last line of defense.”
A Wyden aide said office staff alerted ARC’s general counsel on June 4 that the company wasn’t enrolled as a data broker in California. By at least Wednesday, ARC had registered with the agency, according to the CPPA website. Searching for Airlines Reporting Corporation on that site now shows the company.
The more than one billion records that ARC sells includes passengers names, full flight itineraries, and financial details. Documents 404 Media previously obtained show the data can be searched by name or credit card. ARC is able to source this information because it acts as the conduit between airlines and travel agencies; whenever someone books a flight through an agency, such as Expedia, ARC gets that information.
ARC’s board of directors includes representatives from Delta, Southwest, United, American Airlines, Alaska Airlines, JetBlue, and European airlines Lufthansa and Air France, and Canada’s Air Canada.
The website of the CPPA, which is California’s data protection authority, explains that a data broker “is a business that consumers don’t directly interact with, but that buys and sells information about consumers from other businesses.” It appears ARC would fit this definition.
The Wyden aide said office staff have already spoken to the CPPA and Oregon’s Attorney General about ARC’s failure to register.
Failure to register as a broker can incur fines of $200 per day. 404 Media previously found contracts between ARC and agencies such as the IRS, State Department, SEC, DEA, and more stretching back years, although they may not all necessarily be for the sale of data.
On May 1, Immigration and Customs Enforcement (ICE) published details about its own purchase of ARC data, totalling $250,000 according to public procurement records. On May 2, 404 Media filed FOIA requests with a range of other agencies that had contracts with ARC. Shortly after, The Lever covered the ICE contract.
In the CBP documents 404 Media obtained, ARC told CBP to “not publicly identify vendor, or its employees, individually or collectively, as the source of the Reports unless the Customer is compelled to do so by a valid court order or subpoena and gives ARC immediate notice of same.”
ARC did not respond to multiple requests for comment.
