Attn: Data Controller
Subject: Request for access to the personal data processed by or on behalf of your company Dear , The undersigned, , a citizen of residing at
, files this request with your company pursuant to Section 7 of the U.K. Data Protection Act 1998, implemented pursuant to article 12 of the European Data Protection Directive 95/46/EC. I request that you provide me with all of the information to which I am entitled pursuant to that Act and that Directive. I note in particular that clause (1)(d) of Section 7 of the Data Protection Act 1998 applies to information used for evaluating matters relating to me, such as whether to conduct more intrusive or intensive questioning or search of my person or luggage, whether to identify me as a "selectee" or for "secondary screening", whether to permit me to check in for or board any flight, and whether to permit me to depart from any country or enter any other. Accordingly, I specifically request that you inform me of the logic to be involved in taking those decisions. In accordance with the European Data Protection Directive, I also specifically request that you inform me whether any of my personal data have been transferred outside of the national territory of the U.K., in whatever form or by whatever means, whether to governmental or commercial or other entities, and if so exactly which data, when, to whom, for what purposes or programs such as the USA's "Automated Targeting System (ATS) or "Advance passenger Information System" (APIS), and subject to what enforceable contractual commitments from the recipient, including to which agency or agencies of the government of the United States of America and to which commercial entity or entities in the USA or other countries, including PNR hosting services (such as computerized reservation systems or global distribution systems), PNR processing services (such as the Amadeus Revenue Integrity division, formerly Airline Automation, Inc.), and travel transaction and customer data aggregation and analyis services (such as the Vistrio joint venture of Sabre and Equitec). I also request that you inform me of your policies for use, access, retention, and destruction of this data, and those of any recipients of this data, particularly those outside the U.K. If you subscribe to a computerized reservations system (CRS), I request in accordance with Article 9a(1)(d) of the EU Code of Conduct for CRS's (Council Regulation No 2299/89 of 24 July 1989, as amended), that you inform me of the name and address of the CRS system vendor, the purposes of the processing, the duration of the retention of individual data and the means available to the data subject of exercising her or his access rights. I agree to pay your fee of not more than the maximum of 10 pounds, as prescribed by the Data Protection Act. This request includes all personal data processed by you of which I am the data subject, including but not limited to: 1. Passenger name records (PNR's) 2. PNR histories 3. Cancelled PNR's and their histories 4. System logs of access to these PNR's and PNR histories 5. Departure control system records and access logs 6. Advance Passenger Information (API) records and logs 7. AIRIMP, EDIFACT, or other message records 8. Ticketing records 9. Bank Settlement Plan (BSP), interline, or other settlement records 10. Financial and billing records 11. Frequent flyer account records 12. Customer, Web user, or traveller records or profiles 13. Web site visitor, usage, and query records and logs This request includes, but is not limited to, personal data pertaining to my journeys as follows: I have attached copies of my tickets, itineraries, or reservation confirmation printouts for these flights. My frequent flyer number account number is . Please note that, should you not answer this request within the legally required maximum of 40 days, or should your answer fail to fully answer my request, I reserve the right to bring the case before the competent judicial authorities, and/or to inform the Information Commissioner's Office of your failure to answer. Should you have any questions or require further information from me to expedite your response to this request, please contact me . Sincerely,