Using Personal Data In Commercial Aviation Industry

Data privacy is a critical discourse to life and business at its utmost sanctity.

Personal data generate a huge value for businesses as an indicator of financial turnover and market insight. A sector like the commercial aviation industry is generating large quantities of data, primarily sourced from passenger data, flight data, consumer data, security data, weather data, personal data, engineering, and scientific data. 

The data collected are processed/ and used for two major purposes: security and/or crime prevention and commercial purposes. 

The idea of crime prevention before occurrence may sound like something out of science fiction, but we are now in the age where far more crimes can be prevented before perpetration. That is why crime preventive measures are taken at commercial airports using biometrics, which could either be by automated facial recognition (AFR) camera or fingerprint scanner. These tools are used to detect wanted individuals found on a watchlist with their captured face images or fingerprints against the database. For the data collected for security purposes, there is strict control to this end and which varies with jurisdiction. 

Furthermore, the collected personal data can be commercially used for analysis by aggregating the data into large “Business Intelligence” (BI) systems that focus on finding ways to improve the customer experience at airports and provide services that have not been available in the past.

In all jurisdictions, personal data can be collected with/without the consent of the passenger, provided there is strict adherence to the data protection regulations. 

The personal data are stored for a retention period of five years, but data termination routinely takes place after the statutory limitation periods have expired (usually three years and above) if this process is necessary for the establishment, exercise, or defense of legal claims. 

But data breach of the relevant data privacy and data regulations leads to dissuasive fines and penalties in the concerned jurisdiction. Under GDPR-none compliance by a company can incur a fine of about €20 million or 4% of annual turnover (depending on which is higher). In Nigeria, the NDPR sets its fine to between N1 million and N10 million or 1-2% of the annual revenue of the preceding year (depending on which is higher).

In case of a suspected or actual data breach, you can contact us. Our adroit team can develop or review your incident procedures, run simulations and provide rapid support.

Conclusion

The effects of ePrivacy Regulations are likely to be felt throughout the aviation industry, as it typically works with a large amount of digital marketing and digital services. While the importance of collecting and keeping personal is growing, data privacy regulations guiding operators become stricter and which requires not only attention to how personal data are collected, but also to how personal data are stored, processed, managed, and protected.