Complaint Case Notes

編號: 0026/2016/IP

標題: Airline company collected boarding passengers’ personal data

立案原因: Complaint


    The current case stemmed from the credit card, identity card and Employee ID Card that were collected from an individual, who purchased a helicopter ticket of Airline Company B with the employee discount offered by Company A, while he was waiting in the airport departure hall. The Complainant believed that his credit card, as well as the mentioned identity documents, had been taken away for photocopying.  He reckoned that it was an excessive collection of personal data by Airline Company B. 


    Airline Company B explained that, for making the boarding passenger list, it normally collects the passengers’ name, gender, date of birth, nationality, type and numbers of ID documents, and physical weight and baggage weight.  If passengers bought tickets with Company A’s staff discounts, Company B’s staff would also make photocopies of the concerned Employee ID Card.  Under Article 4(1)(1) and 3(1) of the PDPA, the mentioned information relate to natural persons and therefore they quality as personal data, the processing of which is subject to the PDPA (Personal Data Protection Act). 
  After the passengers completed the immigration procedures and while waiting in the departure hall, according to Airline Company B, airline staff will check their flight tickets and register their travel document information.  The documents would be returned to them after the registration.  In addition, they would record the weight of the passengers and also their baggage.  Passengers were required to undergo security check before entering the departure hall to wait until boarding.
  For boarding, airline companies would comprise passenger lists−a global common practice−to verify their identities.  More than providing such list for the immigration department of the destination for immigration scrutiny and security check, this list is also sine que non in case of accidents or emergencies, during which it will be in aid of verifying causalities and family contacts.  Henceforth Airline Company B for these purposes collected the passengers’ travel document data was for its legitimate interests and in line with Article 6(5) of the PDPA.
  The types of data included on the said passenger list were ordinary information found in passengers’ travel documents.  Such data, au fond, are used to confirm passengers’ identities, whereas their physical and baggage weight are imperative for flight safety.  Airline Company B collected these data for comprising its passenger lists and on this account the collection conformed with the purposes of identity verification and flight security, which were in line with Article 6 and 5(1)(3) of the PDPA.
  On the other hand Airline Company B will make photocopies, for verification by its finance department afterwards, of the Employee ID Card if staff discounts allowed to Company A were used for the ticket purchase. Company B also required staff to explain to customers this reason before the photocopying and to which their consent must have been obtained.  Should Airline Company B have copied the Employee ID Card with the passengers’ consent, then it fulfilled the criterion of legitimate processing, as based on data subjects’ unambiguous consent, which Article 6 of the PDPA sets out.
  Due to the fact that fee concession and direct fee reductions were allowed, as a custom accounting audits will be conducted to confirm whether ticket discounts and price reduction were applied correctly.  Such practice did not abuse or violate Airline Company B’s policies.  The mentioned Employee ID Card only contained ordinary data and Airline Company B only copied this document, which Company A also accepted.  This proved that photocopying the Employee ID Card, for back-office verification, was not in breach of Article 5(1)(3) of the PDPA.
  With regard to the Complainant suspected that the Airline Company Staff photocopied his credit card and ID card, since he refused to disclose his identity during the investigations, along with the fact under normal procedures no photocopies will be made for these documents, his accusation did not justify.  
  To avoid misunderstandings of the data subjects, the GPDP already reminded Airline Company B to formulate its own Personal Data Collection Statement, in accordance with Article 10(1) of the PDPA.  Passengers should be informed of this Statement when their personal data are collected, and the airline staff should be able to sufficiently answer passengers’ questions, if any.


    Airline Company B, aside from being reminded, and the Complainant had been informed of GPDP’s investigation result and the current case was closed. 

Please refer to Article 3, 4, 5, 6 and 10 of the PDPA.