A class action has been filed against American Airlines, Inc., Airline Automation, Inc., and various other companies on behalf of all persons who have had personal and private information about them gathered and transmitted to third parties, in violation of the federal Electronic Communications Privacy Act. The action seeks at least $1,000 in statutory damages per class member for the illegal use of stored electronic communications, as well as other actual, statutory and punitive damages.
The action names as defendants American Airlines, AMR Corporation, Airline Automation, Inc., Fair, Isaac and Company, Inc. (formerly known as HNC Software), Infoglide Software Corporation, Ascent Technology, Inc., and Lockheed Martin Corporation. The complaint alleges, among other things, that American Airlines disregarded its privacy policy regarding the collection and use of personal information concerning its customers when it authorized Airline Automation to disclose private and confidential information to third parties concerning more than one million of its passengers.
Similar actions have been filed against JetBlue Airways and Northwest Airlines. All three have admitted to sharing passenger information with government agencies or companies purportedly associated with agencies. Passenger-name records typically include itinerary, name, address, phone number, and credit information. They also may include email addresses and flight preferences (such as kosher meals). Much of this is sensitive to consumers and subject to strict laws overseas.
JetBlue has admitted that it gave data to Torch Concepts, a self-proclaimed defense contractor. Five million JetBlue passenger-name records, involving 1.5 million passengers, were involved. These records were later matched with data purchased by Torch from Acxiom, JetBlue's data aggregator, which included income, occupation, home ownership, and Social Security numbers. The data was used in a report Torch presented at one of its conferences, and a chart was posted online. The chart contained personal data belonging to a specific, nonconsenting passenger. That information stayed on the site for about six months, until discovered by privacy advocates in September 2003. JetBlue admitted that the disclosure violated its privacy policy in effect at that time.
In January, Northwest said that beginning in December 2001, it had given passenger name records involving more than 10 million passengers for two months to NASA. Again, the data was used for a study of risk assessment. Northwest denies violating its privacy policy.