Data Protection in Airports

trellheim

before anyone starts this is not an immi thing

When you try and buy stuff in the airport "can I see your boarding pass" - its the vat scam and we're all used to it.

However I was just thinking - I've never seen a Privacy Policy at any of the tills, Boots, WH, Ryanair pass scanners, EI pass scanners

There is a gigantic amount of personal info on that barcode ( see BCBP standard - I was bored so went to look it up )

https://www.iata.org/whatwedo/stb/Documents/BCBP-Implementation-Guide-5th-Edition-June-2016.pdf

With GDPR about to hit - should there be a policy outlined when it gets scanned - there are very strict rules.

ohnonotgmail

Do the tills actually store any of the personal data or just the destination airport? As for Ryanair and EI they already have this information so whatever privacy policy they have would apply to the boarding cards as well?

Irish Steve

There is a very good chance that while the airline has the full details of the passenger, there will (already) be restrictions on the data that is passed to "external" inquiries by third party users, it's a standard and long established method of managing data usage and distribution, the electronic version of redacting a response, based on the established need of the user.

Yes, in the light of the new legislation, the airlines will be having to review how they are using, storing and managing the data that they hold, and checking how they manage who has access to specific parts of that data, but it will not be a case that because a retailer can scan a boarding card, they then automatically get to know everything there is on the airline system about the passenger.

If you're worried about who has access to what information, there's not much chance of getting accurate information from people on this site, you're going to be into a world of pain on freedom of information requests (or similar) to the relevant data users, and hope that they don't just ignore the request.

trellheim

but it will not be a case that because a retailer can scan a boarding card, they then automatically get to know everything there is on the airline system about the passenger.

No, but there is a lot of info that the retailer gets - Names and so on. What I am asking if is anyone has seen a privacy policy at a scanning point be it retail or airline. As many know in the IT industry , data collected is rarely disposed of unless forced to do so.

( if a handling agent scans the pass whos Data processing policy is used ( just thought of that ) )

IITYWYBMAD

trellheim wrote: »

No, but there is a lot of info that the retailer gets - Names and so on. What I am asking if is anyone has seen a privacy policy at a scanning point be it retail or airline. As many know in the IT industry , data collected is rarely disposed of unless forced to do so.

( if a handling agent scans the pass whos Data processing policy is used ( just thought of that ) )

How do you know that the retailer gets all of this data? I understand that the boarding card contains all of this information, but on what basis are you saying that the retailer has access to this information?

trellheim

Sorry if not clear.

When a barcode reader scans your mobile phone pass or the paper pass its gets the info on the pass, right

Therefore you get

1) Your name, booking ref and so on - see the above link - thats all encoded in the barcode

The retaiiler thus has access to it and can do what they want with it - is that any clearer

for example they know Johnny B Goode is off to Liverpool on FR000 in 20 mns time

ohnonotgmail

trellheim wrote: »

Sorry if not clear.

When a barcode reader scans your mobile phone pass or the paper pass its gets the info on the pass, right

Therefore you get

1) Your name, booking ref and so on - see the above link - thats all encoded in the barcode

The retaiiler thus has access to it and can do what they want with it - is that any clearer

for example they know Johnny B Goode is off to Liverpool on FR000 in 20 mns time

Is that sufficient to identify an individual?

IITYWYBMAD

trellheim wrote: »

Sorry if not clear.

When a barcode reader scans your mobile phone pass or the paper pass its gets the info on the pass, right

Therefore you get

1) Your name, booking ref and so on - see the above link - thats all encoded in the barcode

The retaiiler thus has access to it and can do what they want with it - is that any clearer

for example they know Johnny B Goode is off to Liverpool on FR000 in 20 mns time

I get what you're saying, and I'll take your word on what the bar code can reveal, but that does not follow that the retailer is getting that information.

I'm assuming that the barcode references some sort of structured data. The physical barcode would not contain any information, more-so the bar code would link to a database, which would validate that information. I would imagine that once scanned (at a till) that the information returned is that the bar code is a valid bar code, that the flight number matches and that the flight details are correct for date. Why the system would return the passengers name etc... at a till is beyond me.

ohnonotgmail

IITYWYBMAD wrote: »

I get what you're saying, and I'll take your word on what the bar code can reveal, but that does not follow that the retailer is getting that information.

I'm assuming that the barcode references some sort of structured data. The physical barcode would not contain any information, more-so the bar code would link to a database, which would validate that information. I would imagine that once scanned (at a till) that the information returned is that the bar code is a valid bar code, that the flight number matches and that the flight details are correct for date. Why the system would return the passengers name etc... at a till is beyond me.

surprisingly all the data is actually in the barcode itself. They can be a lot more data dense than you might think.

trellheim

I just tested the barcode on my iphone from Wednesdays Gatwick-Dublin - downloaded a BCBP scanner from the store , sent the pass to a mail, put it up on a screen

On my barcode
1. Surname Lastname
2. Booking Ref
3. Date
4. Origin Airport
5. Dest Airport
6. Flight code and carrier
7. Seat
8. Sequence Number

No link to any airline booking system required to get that, any scanner will get that info ... which is kind of my point.

ohnonotgmail

trellheim wrote: »

I just tested the barcode on my iphone from Wednesdays Gatwick-Dublin - downloaded a BCBP scanner from the store , sent the pass to a mail, put it up on a screen

On my barcode
1. Surname Lastname
2. Booking Ref
3. Date
4. Origin Airport
5. Dest Airport
6. Flight code and carrier
7. Seat
8. Sequence Number

No link to any airline booking system required to get that, any scanner will get that info ... which is kind of my point.

but is that sufficient to identify you as an individual?

trellheim

Well it'll let me airside by definition when the man scans it so it would seem so

ohnonotgmail

trellheim wrote: »

Well it'll let me airside by definition when the man scans it so it would seem so

it lets you by because the information on the card confirms you are booked on a flight. Also, when you scan it before security that system has access to other information that may personally identify you. the scanner at the till only has access to what is on the card itself. What is on the card itself is not enough to personally identify you.

trellheim

It may well have access to other databases - no denying that - but it can only go off what is on the boarding pass to act as a unique identifier ( and so, personally identifying me by means of the Boarding pass ) .

In any event - this is somewhat off the point - it is personal information - are you suggesting it is not ?

dudara

One of the principles of GDPR is data minimisation, so in other words the retailer should only be collecting what they need.

While the barcode contains all this information, it’s possible that the retailer is only storing portion of the information that they need to meet their VAT obligations and are not retaining any personal information. Technically though, they are processing your information, even if they never store it.

trellheim

Which is kind of where I was going with it - the lack of a privacy policy for , to me, what is very clearly personal information

IITYWYBMAD

trellheim wrote: »

I just tested the barcode on my iphone from Wednesdays Gatwick-Dublin - downloaded a BCBP scanner from the store , sent the pass to a mail, put it up on a screen

On my barcode
1. Surname Lastname
2. Booking Ref
3. Date
4. Origin Airport
5. Dest Airport
6. Flight code and carrier
7. Seat
8. Sequence Number

No link to any airline booking system required to get that, any scanner will get that info ... which is kind of my point.

Which is kind of my point. I would imagine that the till only processes a portion of the above and not the complete dataset.

testicles

This post has been deleted.

LiamaDelta

testicles wrote:

This post has been deleted.

Generally to qualify as being able to 'identify' someone it needs more than one piece of information. Name is not sufficient to be able to trace that person individually, there can be many people with the same name.

LiamaDelta

trellheim wrote:

In any event - this is somewhat off the point - it is personal information - are you suggesting it is not ?

There's insufficient information (presumably purposely) to allow you to be personally identified so the requirements regarding data protection wouldn't be as stringent as in some other situations.

trellheim

I was talking to a GDPR specialist about this ( we have them in work , they are paid for this kind of thing ) - he thinks it is strongly likely to be classed as personal information and needs a very strong privacy policy.

In relation to the shop processing it ( or not ) its actually irrelevant - they have taken in the data and thus need a policy as to what they do with it. ( i.e. get rid of it immediately etc )

Turbulent Bill

trellheim wrote: »

In relation to the shop processing it ( or not ) its actually irrelevant - they have taken in the data and thus need a policy as to what they do with it. ( i.e. get rid of it immediately etc )

There should be a 2nd barcode on the boarding card that just gives the retail-relevant information. No personal info at all.

By their nature, barcodes have to be completely read to check their validity, even the data that a shop doesn't need or want. I'm really surprised that there aren't privacy policies around this.

Popeleo

I thought that the data would be encrypted in some way, but I recently found out that it is all plaintext. Just download a phone app that reads 'PDF417' and you can learn a lot of personal info from a boarding pass.

It is also easy to generate/alter a code, so hopefully all the security and boarding gates check back to a central database to check their validity. Hopefully.