Data Protection and Privacy Management at U.S. Airports: Guidelines (2026)
Chapter: 1 Introduction
CHAPTER 1
Introduction
Airports collect, process, and use large amounts of data from airport users, including personal identification, biometric information, and payment information. Methods used by airports for these data activities are evolving as technologies available to airports and their passengers continue to develop at a rapid pace. Consider the following hypothetical situation:
A business traveler is sitting at home preparing for multiple upcoming trips. She lives equidistant from a large hub airport and a smaller airport. In choosing the airport from which to depart and airline to fly, she begins perusing the airport and airline websites. The large airport offers a unique frequent traveler program that will enable her to prepay for express parking; use a Bluetooth-based quick-pay function for concessions; and access high-speed Wi-Fi in the terminal. The larger airport has contactless bag-drop, security, and boarding capabilities. The smaller airport isnʼt quite as high tech but offers a travel planning tool on its website, prepaid parking, and a contactless curb-to-gate process. The business traveler notices that the smaller airport has a privacy notice page on its website regarding temporary marketing research underway and an ongoing data collection for safety and security purposes. She recalls a friend recently complaining about her data being stolen and personalized ads that were pinging her cellular phone as she traveled through an airport.
The traveler is hesitant about data collection activities, which she knows are occurring at both airports. She appreciates the smaller airportʼs transparency and books her travel out of that airport after deciding that the larger airportʼs added amenities and convenience are not worth compromising her data privacy.
The amenities mentioned in the above scenario are just a few of the ongoing data collection activities that affect passengersʼ and other visitorsʼ engagements with the airports they visit. The rapid pace of technological development has resulted in innovative, data-centric activities being deployed or considered across airport operations. These technological and process advancements have outpaced legal and policy developments, business strategy and planning, and even consumer expectations.
These data enhancements present opportunity and risk for airport operators. Airports should use the abundance of data available to improve operations, customer experience, and revenue. Alternatively, these practices introduce multiple risks related to misuse of data, unauthorized access, and customer and partner relationships. Data operations, misuses, or breaches can negatively affect customer trust.
Airports must comply with an increasing number of data protection and privacy statutes and regulations. The scope, jurisdiction, and potential for new requirements complicates airport operatorsʼ investment and strategic planning decisions.
Airports also face risks with partner engagements related to data activities. The TSA, Customs and Border Protection (CBP), airlines, airports, and even some vendors have interrelated interests in data activities. Each entity is currently conducting their own research and developing their own programs. This creates risk for airport operators that their data programs may not sync with partner activities or that their chosen practices may not work with government or partner requirements.
For example, many airports do not want to invest in a biometric process currently because unknowns still exist regarding how TSA will deploy biometrics and partner with stakeholders. Similarly, airlines are engaging in biometrics, which will affect airport biometric efforts.
Managing the complexities and sensitivities of data activities will require data management processes. More specifically, airports will need to protect their own and their customersʼ interests in the data. This includes ensuring that airports maintain their data value and that they protect their customersʼ privacy interests. Many airports are in the early stages of considering data management or do not have plans or practices in place. This guide will help airport operators understand current data practices, build awareness of compliance requirements, and incorporate data protection and privacy management into their business and operational activities. The guide will cover comprehensive data concepts but will focus discussions and recommendations on data protection and privacy management.
Research Objectives
The objective of the research was to develop guidelines to help airports of all types and sizes identify:
- Types of information that can be collected for use by various stakeholders
- Customer data subject to protection
- Compliance data protection management practices, policies, and systems
- Practices that enhance trust and accountability around data privacy practices for their individual customers and general policies for other data use
For the purposes of our study
- Data includes information from multiple sources, some of it anonymized and some of it individuated customer data
- Customer data includes, but is not limited to, personal identifiable information (PII)
- Trust includes instilling confidence in the airportʼs uses and protections of customer data (e.g., published disclosure statements, transparency, and associated customer communication)
Report Layout
Chapter 2 Current Practices discusses key findings from the project teamʼs research to frame later discussions. The chapter reviews airport public-facing policy statements, practices, and challenges that are in place at airports.
Chapter 3 Identifying Data and Managing Its Value reviews where and how airports find data and identify value, along with challenges in classifying that data to protect personal and business interests. The chapter explores the nuances of personal information and PII to provide background information for airport decision-making. Finally, the report discusses marketing concepts that will drive data collection activities related to objective and affect data management and privacy protection practices.
Chapter 4 Applicable Laws, Regulations, and Standards reviews current rules and trends, and introduces pertinent standards.
Chapter 5 Key Technology Concepts Interrelated with Data Protection and Privacy Management discusses how cybersecurity, biometrics, and artificial intelligence (AI) are related to data protection and privacy management and argues why they need to be addressed in airport data governance programs. The section introduces each concept and provides considerations as they relate to data protection and privacy management.
Chapter 6 Recommended Practices acknowledges the importance of data management and data governance as comprehensive topics that include data protection and privacy management but focuses on recommended practices that address governance and contractual issues, customer outreach and communication on data protection and disclosure, and employee and tenant education strategies.
Chapter 7 The Use Cases section ties everything together. The chapter is organized based on the NIST privacy framework and applies the FIPPs. Each discussion is organized to provide high-level considerations for airport operators considering the specific use cases.
Chapter 8 Conclusion is the last chapter.
