Friday, 9 June 2006

Expedia auditors lose laptop with customer credit card numbers

After it was reported in the press beginning last Friday, Expedia, Inc. (parent company of,,,,,,,, and, among other divisions and subsidiaries), admitted that a laptop computer containing (unencrypted) records on almost a quarter of a million customers, including names and credit card numbers, was stolen from an unattended parked car where it had been left by one of Expedia’s auditors from Ernst & Young .

Naturally, my first question was whether the data on the laptop included reservation data (such as anything that would identify the specific hotel, the date of the stay, or the room type or number of beds), or merely financial and transaction data (names, credit card numbers, and amounts billed).

Ronald Low, a spokesperson for the crisis public relations firm to whom Expedia referred me for comment, was quick to assure me that, “The information on the Ernst & Young laptop was credit card transaction information and did not contain reservation data.”

Notably, Expedia has not said whether it had in place the contractual privacy commitments from Ernst & Young that would be required under Canadian (and other countries’) laws — although not under USA law — as a precondition to allowing Erndst & Young to access personal information in customer or reservation records. operates one of the world’s largest travel Web site affiliate networks , many of whose members (in addition to the other Expedia divisions in the USA, Canada, and Europe), hide the service behind their own “private label”. Many customers may never have realized they were dealing with rather than the company that operates the “private label” Web site. In the past, this lack of transparency has been one of the major themes of customer compliants against, especially when customers had problems at check-in and didn’t knom whom to call. And customers of Expedia divisions in Canada and Europe may not have known that their personal data was being passed on to in the USA.

So, I asked, (1) does attempt to identify, or keep a record of, the country from which personal information was collected, and (2) are the actions being taken the same for all people whose data may have been on the stolen laptop, or are any different or additional actions being taken with respect to people from whom data may have been collected while they were in Canada or the European Union (e.g. as potentially identifiable from the IP address or the origination of the transaction through or, in light of the differences in Canadian and European Union data protection law?

The response on behalf of Expedia? “We do not track or capture geographies aside from the address customers provide for the transaction.”

In other words, the word’s largest Internet travel agency — even though it requires cookie acceptance for purchases, and undoubtedly logs IP addresses and tracks referrals by affiliate — makes no attempt to keep track of the jurisdiction and legal conditions under which personal information is provided, or ensure that those restrictions accompany the data whenit is passed on. Even if they wanted to comply with the law in Canada and the EU, where they operate entire divisions, their current data structures aren’t adequate to support compliance with the laws in those jurisdictions.

From what I’ve seen of industry norms, Expedia is no exception. Neither computerized reservation systems nor the AIRIMP (more on the latest AIRIMP revisions in a forthcoming post) support transmitting or recording the jurisdiction or rules under which any portion of the data in a passenger name record (which typically includes data entered in multiple jurisdictions, so a single field for the entire PNR would not suffice). But if Expedia can get away with ignoring data protection laws in countries where they do billions of dollars a year in busisness, so can the little guys.

This should be the test case of whether USA-based travel companies that do business in, and/or accept personal data from affiliates in, Canada and the EU need to track the jurisdiction and conditions governing use of that data, and ensure that those jusirsdictional and usage-restriction notes follow the data wherever it goes.

If you reserved a hotel through, and you were in Canada or the EU at the time, demand an explanation from the company, and complain to your national privacy commissioner or other national data protection authorities.

[Addendum, 11 June 2006: While you’re at it, ask Expedia, Inc. for a complete copy of all your PNRs and reservation records from all Expedia, Inc., divisions, and a complete arecord of all third parties who have been given access to them. Please let me know what response you get.

You’re entitled to this under Canadian or EU law, even though Expedia’s USA customers have no similar right under USA privacy (non)law. Both and other Expedia divisions do business in Canada and are subject to the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA, they are required on request to provide Canadian customers with access to the information they have about them, and to “provide an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed”. The last time I discussed this with Expedia’s Chief Privacy Officer and Customer Relationship Management Director, Tony Gonchar, he claimed no one from Canada had ever made such a request, so it had not yet been necessary for Expedia to consider how they would respond.

Expedia boasts about its privacy policy as “exemplary”, but it’s exemplary only of travel and reservation companies’ typical disrepect for privacy. For starters, you can’t get to Expedia’s privacy policy or even the privacy policy unless you have already accepted Expedia’s browser cookies, which you might not want to do until after you’ve read the policy on how Expedia uses cookie data. Each time I’ve reported this to Gonchar, he’s claimed it was merely an oversight. Each time, the privacy policy has briefly been accessible without cookies. Each time, it has reverted within a few weeks to being accessible only with cookies.

More fundamentally, Expedia’s privacy policies aren’t part of their contractually enforceable terms of service. The policies misstate Expedia’s practices: they claim that Expedia only collects personally identifiable information that customers voluntarily provide, but Expedia PNRs actually contain data about travellers that was entered by many third parties.

Worst of all, as has been going on for years and as I discussed in this NPR interview in 2003, says that “ shares your PII with our authorized service providers that perform certain services or functions on our behalf…. These service providers will disclose information about your traveller profile to hotel, airline, rental car and/or other travel suppliers whose products you have purchased…. [W]e have not placed limitations on these suppliers from using or disclosing your information without your permission.” That appears to be as flagrant as possible an admission of noncompliance with the requirement of PIPEDA that “An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.”

Expedia and say that, “[W]e encourage you review the information privacy practices of any travel suppliers whose products you purchase on”, but it’s often impossible to identify those suppliers and other third-party personal information recipients before making a purchase. Nowhere during the process of buying an airline ticket, for example, does Expedia or identify in which CRS the data will be stored. Nor is it possible to identify at what step in the research, reservation, and purchasing process personal data begins to be passed to a CRS or other third party, or the PNR is “ended” and permanently saved, or which data is passed to the CRS and stored in the PNR rather than in external Expedia (or other third-party) databases.]

Link | Posted by Edward on Friday, 9 June 2006, 09:34 ( 9:34 AM)

i''m the reservations manager of a large los angeles area resort. we have more problems with bookings made through expedia than all other online booking agents combined. their current policy is to not share any contact information for their customers with the hotels they book at. this means if there is any problems with the reservation, we have no way in which to contact the customer to correct the issue. me and my staff spend dozens of hours every week trying to sort out booking issues with expedia as well as

last week while on the phone with a high level employee of expedia, i was asked for a client's credit card number. when i refused to tell him the complete card number, i was told that this was how they identify their customers...nice

Posted by: stugots, 27 July 2006, 21:54 ( 9:54 PM)

Do you know this? EXPEDIA is in listed the top ripoff link at the bad business bureau ( and has two "dedicated" websites due to poor customer support and lies: (read some lies here) and

Kind regards

Posted by: John, 2 August 2006, 15:08 ( 3:08 PM)

It's not Expedia's fault the lap top was stolen people make mistakes. Credit card companies have fraud departments for reasons just like this. If a clients card number was leaked and used the "victim" would report the incorrect charge and the creditor would reverse the charge/ issue a new credit card number... WOW Big deal!

Posted by: Ryan, 6 December 2008, 05:23 ( 5:23 AM)

We have more problems with bookings made through expedia than all other online booking agents combined. Their current policy is to not share any contact information for their customers with the hotels they book at. This means if there is any problems with the reservation, we have no way in which to contact the customer to correct the issue. Me and my staff spend dozens of hours every week trying to sort out booking issues with expedia as well as

Posted by: aakansha, 9 March 2009, 21:11 ( 9:11 PM)

Expedia should be very vigilant now because of what happen. Those are people's personal account. If something happen like fraudulent activities the company should have a plan to stop those kind of activities.

Posted by: Anonymous, 3 September 2009, 18:39 ( 6:39 PM)

I also have had a bad experience with Expedia and will never use it again. Their customer serice is terrible! First you speak to someone in India, after several attempts to get someone to answer the phone. The Indian's accent is nearly impossible to understand, it took two of us to translate what she was saying. When we requested a supervisor it took 20 minute to be connected. The problem arose after we made two separate round trip reservations on a single transaction. Apparently this is something the airlines do not allow. None the less Expedia accepted and confirmed the reservation, only to notify us a week later that it would cost an additional $350 to make two separate reservations instead of the one they confirmed. They denied all responsibility for the mixup and even said it was our fault for trying to do something that is not allowed. When I asked if it isn't allowed why does your computer system permit it and why would you confirm the reservation. I was told it is up to the customer to know what is allowable in making the reservation. My opinion is they acting as agent entered into a contract with me to provide airline reservations as I requested them. It is also their obligation as agent to know what the airline reservation rules are.


Posted by: Lacy Scott, 19 September 2009, 18:56 ( 6:56 PM)

It's not Expedia's fault the lap top was stolen people make mistakes. Credit card companies have fraud departments for reasons just like this

Posted by: may tinh xach tay, 19 May 2010, 01:15 ( 1:15 AM)
Post a comment

Save personal info as cookie?

Bio | Blog | Blogroll | Books | Contact | Disclosures | Events | FAQs & Explainers | Home | Newsletter | Privacy | Resisters.Info | Search | Sitemap | The Amazing Race | The Identity Project | Travel Privacy & Human Rights | Twitter

"Don't believe anything just because you read it on the Internet. Anyone can say anything on the Internet, and they do. The Internet is the most effective medium in history for the rapid global propagation of rumor, myth, and false information." (From The Practical Nomad Guide to the Online Travel Marketplace, 2001)
RSS 2.0 feed of this blog
RSS 2.0 feed of this blog
RSS 1.0 feed of this blog
Powered by
Movable Type Open Source
Movable Type Open Source 5.2.13

Pegasus Mail
Pegasus Mail by David Harris