A41-WP/731

International Civil Aviation Organization LE/4

ASSEMBLY — 41ST SESSION

Agenda Item 43: Other issues to be considered by the Legal Commission

INTERNATIONAL CARRIAGE BY AIR AND DATA PROTECTION LAWS

(Presented by the International Air Transport Association (IATA))

EXECUTIVE SUMMARY
Data powers the global air transport industry, enabling innovations that enhance safety and security,
facilitate a more seamless travel experience, as well as helping to tackle environmental and health
challenges. This latter aspect was highlighted during the COVID-19 pandemic, when governments
introduced numerous new requirements at short notice for individual health data and related personal
information as part of their public health measures. At the same time, many jurisdictions have data
protection legislation with rules on the collection, use, transmission, and retention of personal information.
While the protection of data and privacy is of critical importance, the current reality is a patchwork of
national data protection laws that are inconsistent, sometimes contradictory and not well-adapted to the
special characteristics of international civil aviation; and as such present many difficulties of application
and implementation for governments and air carriers.

The recent experience of the COVID-19 pandemic has highlighted these difficulties. These are likely to
worsen as governments seek to use technology and new personal information elements to enhance border
management, passenger facilitation and security tasks. If unaddressed, this issue of inconsistency in data
protection laws has the potential to impede the harmonious and orderly development of international civil
aviation and the recovery of international connectivity in the post-pandemic period.
Action: The Assembly is invited to:
a) note this Working Paper and the issue of the interaction of international carriage by air with data
protection laws from a consistency perspective; and
b) consider the further study and examination of this issue, possibly within the context of an expert
group of the ICAO Legal Committee, as appropriate.
Strategic This working paper relates to Strategic Objective Economic Development of Air
Objectives: Transport
Financial N/A
implications:
References: Doc 10140, Assembly Resolutions in Force (as of 4 October 2019) (A40-9, Appendix A)

1 English, Arabic, Chinese, French, Russian and Spanish versions were provided by IATA
 A41-WP/73 -2-
LE/4

1. INTRODUCTION

1.1 The COVID-19 pandemic has demonstrated the prominent role of data and personal
information in international civil aviation operations. In addition to the passenger data already required by
governments from air carriers, many governments introduced new requirements, at short notice, for health
information and other personal information to administer their border management, public health and
COVID-19 response programmes. These requirements often directed air carriers to collect and manage the
personal information in question.

1.2 At the same time, many jurisdictions have data protection, data security and privacy laws
on the collection, use, transmission, and retention of personal information (collectively referred to as data
protection laws).2 These are general in scope and apply to airline companies, passengers, and scenarios of
international carriage by air, as well as other areas of commercial activity.

1.3 Because these laws differ substantially, may apply outside the territory of the regulating
government and are often not devised with the special characteristics of international civil aviation in mind,
they present difficulties of application for both governments and air carriers. These difficulties may affect
the practical ability of a government to request personal information and the ability of an air carrier to serve
jurisdictions with competing or conflicting data protection requirements.

1.4 Given the increasing emphasis on data and personal information in the context of ICAO’s
work and the pace of innovations to government practice (border management, passenger facilitation,
security clearance, etc.) and in commercial services for customers, more generally, these difficulties are
likely to worsen in the future.

1.5 In IATA’s view, the interaction of international carriage by air and national data protection
laws is a consistency issue that merits cooperation and, if unaddressed, may adversely affect the orderly
and harmonious development of international civil aviation in a time of challenge and recovery for
governments, economies and communities.

2. DATA PROTECTION LAWS AND INTERNATIONAL CARRIAGE BY AIR

2.1 There are 137 countries with data protection laws and many countries will be looking to
introduce new laws or amend their existing laws in the future.3

2.2 These laws represent a growing ‘patchwork’ of requirements for which, while there may
be some similarities, there is no overriding treaty framework or uniform regulatory approach. Air carriers
are subject to these laws, where within their scope, and must fit their operations within the generic legal
grounds and provisions that already exist.

2.3 On the other hand, it should be recalled that air carriers operate under a specific
international regulatory framework as defined by the Chicago Convention.

2 These laws, including data protection, privacy, data security and data sovereignty laws, will be described as data protection laws
for the purpose of this Working Paper.
3 This figure is based on UNCTAD’s survey, which looked at 194 countries. See further https://unctad.org/page/data-protection-

and-privacy-legislation-worldwide (accessed 15 June 2022).

2.4 Air carriers require personal information to provide international carriage by air,4 both for
their own operational and service delivery purposes, and to comply with government requirements for such
information.5 For example an air carrier must:

a) collect, use and transmit personal information internationally, to its own HQ or place of
management, to the destination and to other service providers (it cannot store the data
locally in a subsidiary, for example, as a retail chain might for a local customer);
b) transmit Advance Passenger Information (API) and/or Passenger Name Record (PNR)
data to the government of the place of destination, and in some instances the origin
government or the government of territories overflown, as required by legislation;
c) transmit other personal information as required by the law of the place of destination
that is additional to API or PNR data referred to above (e.g. health information in the
context of the COVID-19 pandemic, and in some cases, to retransmit information that
has already been sent to the government or another part of the government, or to send it
multiple times); and
d) collect, use and transmit information relevant to other systems essential for the operation
of a modern airline, such as transmissions to partner airlines, reservation system
providers and other airline support systems.

2.5 Unlike most other businesses, when a passenger provides personal information to an air
carrier, they do so to travel internationally across borders and their data ‘moves with them’ as an inherent
and expected aspect of the activity. As part of this, there are airline-to-airline, airline-to-provider and airline-
to-government transmissions that make the international travel possible. Nonetheless, air carriers are
regulated by data protection laws as any other business in a domestic economy, including other types of
business where an international transmission of data is not essential and may simply be a business
convenience.

2.6 ICAO Assembly Resolution A40-9, Appendix A, recalls the special characteristics of
international civil aviation and resolves that States “are urged to avoid adopting unilateral measures that
may affect the orderly and harmonious development of international air transport and to ensure that
domestic policies and legislation are not applied to international air transport without taking account of
its special characteristics.”

2.7 By contrast, data protections laws: (a) are often inconsistent with each other; (b) are general
in their provisions, such that these are not adapted to the special regulatory or operational characteristics of
international civil aviation nor its international aspects; (c) apply outside the territory of the regulating
jurisdiction in many cases (in other words, two or more laws can apply to the same scenario of international
carriage by air); and (d) do not recognise foreign law or international obligations as a justification for the
use of personal information.

4 Article 29 of the Chicago Convention itself is one reference to the exchange of information for international air services.
5 IATA nonetheless encourages governments to work with passengers in the collection of such information and ‘put the passenger
first’ in choices about personal information. Data protection or privacy considerations can be partly addressed through the
collection of information by authorities directly from passengers, using web portals or mobile applications. Through these
platforms, authorities can collect relevant information (i.e. immigration, customs and health information) and start checks before
the journey itself. In this way, an air carrier’s role in the collection and use of information is minimised - preferably with the
airline’s involvement being simply to check that the passenger has the relevant authorisation granted through such platforms.
 A41-WP/73 -4-
LE/4

3. A CONSISTENCY ISSUE THAT MERITS CONSIDERATION

3.1 This lack of global consistency noted above has significant implications for States, air
carriers and the “orderly and harmonious development of international air transport” as per Resolution
A40-9. Some generalised examples are provided below:

3.1.1 Consider that State A amends its border management legislation to require a passenger to
provide a new personal information element (such as health information) at short notice. If it asks an air
carrier to collect and transmit this element, the air carrier may protest that State B’s law does not allow the
transmission as State B’s law does not recognise State A’s law as a justification. Should State A persist
with the requirement, potentially affecting connectivity, or attempt to sign a treaty with State B?

3.1.2 Consider that State X’s regulator requires data to be ‘localized’ or stored within its
jurisdiction and not transferred outside its territory. The air carrier is requested to create a subsidiary and
store the personal information locally for its passenger operations to and from the country. The air carrier’s
traffic rights to and from X are premised on it being a foreign carrier, incorporated in State Y. State X’s
data protection law does not have any specific provisions for civil aviation. How should State Y’s civil
aviation authority (NAA) and the air carrier approach this requirement?

3.1.3 Consider that State C requires all carriers to retain personal information, including for
example health data, for inspection by its authorities for a period of four years. State D forbids retention
after a specific period for this type of information and does not recognise compliance with a foreign law as
a valid legal ground. How should these requirements be reconciled?

3.2 These provide only some examples relevant to the interaction between international
carriage by air and data protection laws. As a result, the following can be observed:

3.2.1 The lack of a consistent framework in the context of international civil aviation creates
uncertainty for each State’s ability to protect their nationals’ interests.

3.2.2 Governments who wish to modernise their operational procedures, and rely more upon
data-driven processes, for example, may be unable to easily do so because of the practical impact of multiple
foreign laws that apply to air carriers serving their jurisdiction.

3.2.3 Air carriers face considerable cost and complexity in addressing domestically-focused and
divergent data protection laws, with this multiplied by the size and variety of their route network.

3.3 IATA respectfully urges close consideration of this issue by the ICAO Legal Committee.
An expert group could be considered and may include civil aviation regulators, civil aviation legal experts,
privacy and data protections experts, civil society, and air carriers with a view to guidance material for
States to refer to when developing, updating or benchmarking their legislation.

3.4 In doing so, States can improve consistency, reduce uncertainty, and thereby promote the
orderly development and efficiency of international civil aviation, maximizing the social and economic
value that it creates.

— END —