Friday, 9 June 2006
Expedia auditors lose laptop with customer credit card numbers
After it was reported in the press beginning last Friday, Expedia, Inc. (parent company of Expedia.com, Expedia.ca, .Expedia.co.uk, Expedia.de, Expedia.fr, Expedia.it, Expedia.nl, Hotwire.com, and Hotels.com, among other divisions and subsidiaries), admitted that a laptop computer containing (unencrypted) records on almost a quarter of a million Hotels.com customers, including names and credit card numbers, was stolen from an unattended parked car where it had been left by one of Expedia's auditors from Ernst & Young .
Naturally, my first question was whether the data on the laptop included reservation data (such as anything that would identify the specific hotel, the date of the stay, or the room type or number of beds), or merely financial and transaction data (names, credit card numbers, and amounts billed).
Ronald Low, a spokesperson for the crisis public relations firm to whom Expedia referred me for comment, was quick to assure me that, "The information on the Ernst & Young laptop was credit card transaction information and did not contain reservation data."
Notably, Expedia has not said whether it had in place the contractual privacy commitments from Ernst & Young that would be required under Canadian (and other countries') laws -- although not under USA law -- as a precondition to allowing Erndst & Young to access personal information in customer or reservation records.
Hotels.com operates one of the world's largest travel Web site affiliate networks , many of whose members (in addition to the other Expedia divisions in the USA, Canada, and Europe), hide the Hotels.com service behind their own "private label". Many Hotels.com customers may never have realized they were dealing with Hotels.com rather than the company that operates the "private label" Web site. In the past, this lack of transparency has been one of the major themes of customer compliants against Hotels.com, especially when customers had problems at check-in and didn't knom whom to call. And customers of Expedia divisions in Canada and Europe may not have known that their personal data was being passed on to Hotels.com in the USA.
So, I asked, (1) does Hotels.com attempt to identify, or keep a record of, the country from which personal information was collected, and (2) are the actions being taken the same for all people whose data may have been on the stolen laptop, or are any different or additional actions being taken with respect to people from whom data may have been collected while they were in Canada or the European Union (e.g. as potentially identifiable from the IP address or the origination of the transaction through Expedia.ca or Expedia.uk), in light of the differences in Canadian and European Union data protection law?
The response on behalf of Expedia? "We do not track or capture geographies aside from the address customers provide for the transaction."
In other words, the word's largest Internet travel agency -- even though it requires cookie acceptance for purchases, and undoubtedly logs IP addresses and tracks referrals by affiliate -- makes no attempt to keep track of the jurisdiction and legal conditions under which personal information is provided, or ensure that those restrictions accompany the data whenit is passed on. Even if they wanted to comply with the law in Canada and the EU, where they operate entire divisions, their current data structures aren't adequate to support compliance with the laws in those jurisdictions.
From what I've seen of industry norms, Expedia is no exception. Neither computerized reservation systems nor the AIRIMP (more on the latest AIRIMP revisions in a forthcoming post) support transmitting or recording the jurisdiction or rules under which any portion of the data in a passenger name record (which typically includes data entered in multiple jurisdictions, so a single field for the entire PNR would not suffice). But if Expedia can get away with ignoring data protection laws in countries where they do billions of dollars a year in busisness, so can the little guys.
This should be the test case of whether USA-based travel companies that do business in, and/or accept personal data from affiliates in, Canada and the EU need to track the jurisdiction and conditions governing use of that data, and ensure that those jusirsdictional and usage-restriction notes follow the data wherever it goes.
If you reserved a hotel through Hotels.com, and you were in Canada or the EU at the time, demand an explanation from the company, and complain to your national privacy commissioner or other national data protection authorities.
[Addendum, 11 June 2006: While you're at it, ask Expedia, Inc. for a complete copy of all your PNR's and reservation records from all Expedia, Inc., divisions, and a complete arecord of all third parties who have been given access to them. Please let me know what response you get.
You're entitled to this under Canadian or EU law, even though Expedia's USA customers have no similar right under USA privacy (non)law. Both Hotels.com and other Expedia divisions do business in Canada and are subject to the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA, they are required on request to provide Canadian customers with access to the information they have about them, and to "provide an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed". The last time I discussed this with Expedia's Chief Privacy Officer and Customer Relationship Management Director, Tony Gonchar, he claimed no one from Canada had ever made such a request, so it had not yet been necessary for Expedia to consider how they would respond.
More fundamentally, Expedia's privacy policies aren't part of their contractually enforceable terms of service. The policies misstate Expedia's practices: they claim that Expedia only collects personally identifiable information that customers voluntarily provide, but Expedia PNR's actually contain data about travellers that was entered by many third parties.
Worst of all, as has been going on for years and as I discussed in this NPR interview in 2003, Expedia.ca says that "Expedia.ca shares your PII with our authorized service providers that perform certain services or functions on our behalf.... These service providers will disclose information about your traveller profile to hotel, airline, rental car and/or other travel suppliers whose products you have purchased.... [W]e have not placed limitations on these suppliers from using or disclosing your information without your permission." That appears to be as flagrant as possible an admission of noncompliance with the requirement of PIPEDA that "An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party."
Expedia and Expedia.ca say that, "[W]e encourage you review the information privacy practices of any travel suppliers whose products you purchase on Expedia.ca", but it's often impossible to identify those suppliers and other third-party personal information recipients before making a purchase. Nowhere during the process of buying an airline ticket, for example, does Expedia or Expedia.ca identify in which CRS the data will be stored. Nor is it possible to identify at what step in the research, reservation, and purchasing process personal data begins to be passed to a CRS or other third party, or the PNR is "ended" and permanently saved, or which data is passed to the CRS and stored in the PNR rather than in external Expedia (or other third-party) databases.]Link | Posted by Edward on Friday, 9 June 2006, 09:34 ( 9:34 AM)