Data Privacy in the travel industry world
With the rapid recovery of international air travel, increasing stress is being imposed on officers, agents, and infrastructure at various levels of the traveller identification, throughput management, and data analysis processes. Automating the identification and clearance processes are key to ensure that the highest level of security is in place when capturing biometric and biographic data of a traveller. Besides the volume of the workload itself, issues surrounding data privacy and the protection of personally identifiable information (PII) are also coming to the forefront and increasing the pressure on travel industry stakeholders to get their digital infrastructures in order, when it comes to matters of information governance and data privacy.
With the increasing relevance of data privacy comes a need for new approaches to data capturing, information sharing and management. Automating the identification and clearance processes are key to ensure that the highest level of security is in place when capturing biometric and biographic data of a traveller. The multi-stakeholder environment of the travel industry requires a centralised management and decision-making platform which connects in real-time all virtual and physical security and data infrastructures. Bridging the information flow between biometric touchpoints and detailed multi-source data streams, this orchestration suite must also allow for a powerful informational structure for decision-making that fully respects data privacy. That structure should be geared towards analysing and deciphering traveller structural flow, capacity, and security issues, as well as developing close stakeholder relationships through collaborative, personalised engagement -- and all with data privacy at the centre.
The Issue of Data Privacy
As a safeguard for the individual, a number of jurisdictions have developed regulatory frameworks setting out guidelines and penalties for the proper management of information and the protection of data privacy. Perhaps the most high-profile and well-known of these data privacy frameworks is the European Union’s General Data Protection Regulation, or GDPR, which serves to illustrate the complex landscape that travel stakeholders must now learn to navigate when it comes to fulfilling legal obligations regarding data privacy.
GDPR addresses the transfer of personal data and gives the data’s owner primary control over their information to safeguard data privacy. Under GDPR, it is a standard requirement that a company transmitting personally identifiable or confidential information assumes certain responsibilities to make certain that data privacy is respected, and that information is well protected. In addition, GDPR mandates that:
- Business processes provide data privacy safeguards to protect data when handling personal information.
- The information system must be designed with data privacy in mind and use the highest-possible privacy settings by default.
- To ensure data privacy in the public domain, data sets cannot be made publicly available and cannot be used to identify a subject.
- Extending legal protection to data privacy, no personal data may be processed unless specified by regulation or law.
- Putting data privacy controls in the hands of the data owner, the individual has the right to revoke consent to the usage of their data at any time.
- Finally, to establish an audit trail for data privacy, the business must clearly disclose any data collection, declare its lawful basis, the purpose for data processing, state how long data is being retained, and if it is being shared with any third parties.
In addition to the complexity of data privacy protection, in a multi-stakeholder environment, different entities may store important information in different computer systems -- and such data may be moved around continuously. Such complicated ownership structures could result in breaches that seriously compromise data privacy, in an ecosystem that encompasses not only airports, airlines, and border forces, but also related players including booking agencies, hospitality providers, and payment processing platforms.
The Conflicting Needs of Travellers
Along with the regulatory environment, travel industry stakeholders must also negotiate the sometimes conflicting demands of consumers, when it comes to issues of data privacy. The International Air Transport Association (IATA) 2021 Global Passenger Survey (GPS) highlights the factors that airline passengers consider most important for stakeholders -- and the findings are in some ways contradictory.
There is general agreement that waiting in lines is their biggest pain point. Approximately 41% of passengers identified queuing at security screening as a top priority for improvement, while 55% say queuing at boarding is a priority area, with 38% of passengers calling out queuing time at border control/immigration.
However, while many of the 13,579 participant responses from 186 countries seem to understand the advantages of using biometrics to reduce waiting times, a little over a third (36%) have actually experienced the use of biometric data when travelling. Of that group, 86% were satisfied with the experience, but more than half (56%) say they have concerns about data breaches and the subsequent negative effects on their data privacy. For greater assurance of data privacy, more than half would like to have clarity on who their data is being shared with (52%), and how it is used or processed (51%).
How Privacy by Design Helps Travel Industry Stakeholders
Privacy by Design (PbD) is an approach to systems engineering designed by Dr Ann Cavoukian of the Privacy by Design Centre of Excellence in Toronto, Canada. The PbD framework addresses the burgeoning use of digital privately identifying information in high-speed network data systems that include machines, services, and business processes. Its objective is to ensure information security and data privacy by putting the individual in control of their personally identifiable information.
Privacy by Design ensures data privacy through the protection of personally identifiable information (PII) when travellers interact with government, airport, and airline stakeholders, where regulations require digital identity assurance of varying levels. The implementation of the PbD framework rests on seven foundational principles:
- Proactive, not reactive; Prevent, not Remediate – Anticipates privacy breach risks and events before they occur and predicts which factors and threats may affect passengers’ data privacy.
- Privacy as the default setting – Ensures data privacy and maximum security of passenger information, even if the traveller does nothing to increase the security of the system by default.
- Privacy embedded into design – Traveller data privacy mechanisms are built into the system as a security prerequisite from the beginning.
- Full functionality: Positive sum, not zero-sum - Balances security and data privacy for a win-win scenario without unnecessary trade-offs in the digital identification process.
- End-to-end security – Ensures data protection and information control throughout the data lifecycle.
- Visibility and Transparency: Keep it open – To establish a chain of custody for data privacy, the individual is made fully aware from the beginning of the identification and clearance process that data collection is occurring, and what is the purpose and necessity for it.
- Respect for user privacy: Keeps the interests of the traveller at the centre of the processes by guaranteeing and reserving to individual the consent for their information and data to be used.
In the practical application of Privacy by Design in system engineering, businesses must consider the assurance of individual data privacy at every stage of the design process (machines, services, and business processes). This includes securing individual data by assigning as default the minimal collection and retention of data necessary for the identity process. Privacy by Design also allows for greater transparency on the collection process of personal data and how it is used, establishing clear guidelines for data privacy so that individuals can decide what information is shared and with whom.
Digital Identity Management Using Privacy by Design
The evolving efficiency of biometric identity, digital documentation and encrypted data analysis over high-speed networks, creates opportunities for increased effectiveness of data privacy security, making information protection a core component strategy. And that’s how Vision-Box’s Orchestra, our digital identity management platform, is built - having all those data privacy principles in consideration.
Orchestra fundamentally works with a data management layer that conceptually addresses the Privacy by Design foundational principles, and holistically manages traveller-related data by combining the informational requirements of all the stakeholders involved for an efficient leveraging of multi-source data streams.
Orchestra offers multiple identity management, security and cost-saving advantages by connecting travellers, aviation and government stakeholders through a user-centric service. The platform secures the integrated airport checkpoint network by monitoring real-time traveller flow throughout the system.
When implemented, Orchestra combines biometric technology with data-based analytical assessments for trustworthy identification assurance of legitimate travellers. By automating the considerable challenges involved in airport traveller identification and security management, Orchestra mitigates vulnerabilities inherent in the manual clearance of travellers at identification control points, thereby increasing the security factor of the entire airport. At the same time, the automated identification process eases the strain on airport resources to maximise service levels and assure correct traveller identification.
Orchestra with Privacy by Design assists in safeguarding data privacy and reducing the threat of stolen information by eliminating data duplication, unnecessary storage, and exposure. It gives passengers more control over their information by shifting data protection to the owner. By having more control over what information is shared, the individual is more aware of which information is being collected, who is collecting it, and where it will be used and stored. Where applicable, Privacy by Design allows the individual to deny access to certain information, thereby keeping data securely stored and compartmentalised. If data collection is necessary to complete the transaction, Orchestra manages what data is shared and which stakeholder has access to the data at individual transaction points.
What’s more, Orchestra combines comprehensive biometric analysis, automated identity security management and self-service technology for a cross-organisational network that embeds data privacy into every linkage, as well as channels trusted communication protocols into every information stream.
Data privacy, consequently, is a critical issue that air travel stakeholders must consider at every stage of the travel journey -- both for their own legal protection and for the benefit of the passengers. Biometric identification coupled with digital identity management using Privacy by Design, allows stakeholders to deliver a seamless traveller journey while safeguarding passenger information and data privacy.
Publish date: April 2022