CHAPTER 4
Applicable Laws, Regulations, and Standards

Laws, regulatory actions, and industry standards pertaining to data protection and privacy have increased in the United States and around the globe as technology makes the collection and use of data easier and more effective. Airports must understand the legal landscape as they look to collect and make use of data. As entities that work in national and international commerce, legal considerations may implicate or be affected by the laws of differing jurisdictions, and not just those of the location where an airport is situated or where an airline directly operates. Similarly, data collection activities may have industry specific standards that airports must consider before participating in the activity.

The following discussion highlights key legal and industry standard considerations. A more in-depth legal discussion of data privacy can be found in ACRP Legal Research Digest 42: Legal Implications of Data Collection at Airports.³² Airports should consider seeking legal counsel when implementing data protections or privacy management policies or practices or when addressing data issues.

Key legal and regulatory takeaways:

• Technology and data collection capabilities have developed faster than laws.
• The U.S. legal landscape is complex and requires review of multiple state and local laws.
• Airports need to consider their role in data activity, i.e., as market participants or government entities.
• Trend in statutory and regulatory development is toward protecting individual privacy.

Overview of Legal Considerations

Federal

The United States does not have a centralized comprehensive body of law that governs privacy issues or data security; it is a patchwork quilt of federal, state, and even local laws addressing privacy. This is in stark contrast to international legal environments, such as Canada or the EU, where privacy and data security are addressed by laws with universal applicability.

The trend in statutory and regulatory developments at the federal and state level in the United States and internationally is the expansion of individual privacy protections. Given this trend, airport operators should consider individual privacy in developing policies and practices.

The United States currently has a sectoral approach to data privacy and protection statutes and regulations at the federal level.³³ Statutes and regulations focus on specific sectors, like healthcare or finance, or on specific activities, like credit checks or consumer activities.³⁴ These laws typically respond to technology or process innovations that spur individual harm in specific industries.³⁵

The statutes either broadly apply the Fair Information Practice Principles (FIPPs) or specifically address harmful actions.³⁶

The Childrenʼs Online Privacy Protection Act of 1998 (COPPA) is a federal law that limits companiesʼ abilities to use data collected about children under 13 years of age. COPPA applies the FIPPs, but the law is specific rather than broad in that it applies only to children, only to private sector companies, and only to data collected online. Companies that collect data from children must post a privacy policy that details protections, and they must collect consent from a parent or guardian. The law limits how long companies can keep data and requires confidentiality to comply with the stated purpose of the collection activity. Most airline websites indicate the collection of data on children under 13 is solely for the purpose of completing travel reservations and the information will not be used for any other purpose. Additionally, many airline websites indicate that any information inadvertently collected from children under 13 will be deleted once discovered. While COPPA may not apply to an airport website in the intended use of that website and intent of the airport entity, private sector business partners of airports should consider how to comply with COPPA. An airport using or partnering with a private entity for online activities (such as an online survey used by a private entity third party as part of the provision of Wi-Fi) that involve data collection should consider how or if COPPA is applicable.

The Privacy Act of 1974 (Privacy Act), which prescribes how federal agencies collect and use individualsʼ data, is narrow in a different way than COPPA.³⁷ The Privacy Act requires that federal agencies communicate what type of information they collect and maintain on individuals; provides individuals a right to access and correct that information; and requires each agency to guard against unauthorized disclosure of information. Agencies must publish System of Record Notices (SORN) for each record that agencies maintain, and the Privacy Act provides a private cause of action for violations, usually in the form of injunctive relief.

Under the Privacy Act of 1974, the dissemination of collected PII is limited to circumstances specifically addressed in statutorily specified exceptions. Exceptions include sharing necessary information for governmental operations or special circumstances like law enforcement requirements, health or safety requirements, or other government processes like court orders or congressional requests. Absent an exception, federal agencies must receive express written consent from individuals to release information. Additionally, the Privacy Act of 1974 provides individuals the ability to access and correct or amend records that are inaccurate, irrelevant, or incomplete.³⁸

Airport operators will interact with the Privacy Act of 1974 in two primary ways.

• Airports seeking to partner with federal agencies for data collection will need to enter into agreements with that agency and potentially consent to the applicable agencyʼs terms. This concept is further discussed in the biometric discussion later in this report. All airports and airlines have experience implementing notice and consent measures that comply with the Privacy Act of 1974 through the aviation worker credentialing process. To credential workers, the airport or airline must execute written notice and consent documents for the information collected and used in the vetting process that is held by the federal government.
• Many states have adopted the Privacy Act of 1974 provisions for their governmental entities.

Similarly, the E-Government Act of 2002 requires government agencies to assess the impact on privacy for systems that contain PII in Privacy Impact Assessments (PIAs).³⁹ While neither the Privacy Act nor the E-Government Act generally apply to non-federal agencies and have not been interpreted to apply to non-federally operated airports, both acts may tangentially affect airport operators that seek to share data with federal agencies or seek federal agencies to initiate certain programs at their facilities. Airport operators should use relevant SORNs or PIAs when seeking to partner with federal agencies in a data activity. Further, airports may consider creating

their own SORN or PIA, absent a requirement, to assist with organizing a data activity and ensuring proper protections are considered and put in place.

From a regulatory perspective, the FTC has the authority to protect consumers from unfair and deceptive acts, and the agency has slowly built up a “common law of privacy” using a range of enforcement practices.⁴⁰ Understanding FTC actions is an important consideration in assessing data use practices. The agency focuses on failures to implement reasonable data security practices or protect general privacy concerns. The FTC has paid particular attention to social media companies, mobile app developers, data brokers, ad tech participants, and companies operating in IOT. The FTC has stated it is concerned with data practices where companies claim one thing and do another; customers have little choice but to consent; permissions are not meaningful or informed; targeting occurs; practices are buried behind multiple layers of user interfaces; representations are misleading; and protections are miscommunicated. The FTC recommends following FIPPs principles and sector-specific codes of conduct, privacy by design, and clear standards of transparency.⁴¹ Airports should consider company data collection practices before engaging with them where data activity is involved.

Airport operators should monitor FTC enforcement actions to better understand notice and consent practices for the collection of identifiable information in connection with consumer activities. Similarly, airports should monitor FTC enforcement actions regarding data security. Failure to adhere to the common law of privacy advanced under the FTC may expose airports to FTC fines or penalties or potential civil liability. Even if the practices cannot be addressed under the FTC, there are many states that have developed consumer protections law and practices modeled after the FTC Act and in some ways even exceed its scope.

The United States has seen movement toward more comprehensive data privacy protection statutes and rules. In the 116th Congress, multiple data-related bills were introduced and one, the American Data Privacy Protection Act (ADPPA), showed the most potential for passage of a comprehensive measure that the United States has seen. The bill would have created consumer data protections based on the core FIPPs principles and would have limited collection activities to providing requested products or services, and to other specific circumstances.⁴² The issues of state law preemption stalled the billʼs momentum in 2022.⁴³ Additionally, in August 2022, the FTC issued a proposed rulemaking, citing its frustration with Congressʼs failure to act.⁴⁴ The proposal would create a comprehensive federal rule addressing data privacy and security; the proposed rulemaking remains pending at the time of this reportʼs publication.

These initiatives by Congress and the FTC indicate the federal government is moving toward enhanced data privacy protection and potentially a more comprehensive approach.

State

State and local laws regarding public sector and consumer data protection and privacy management; the collection of biometrics; and freedom of information affect airport data collection activities. In some cases, these statutes are modeled after federal statutes, like the Privacy Act of 1974, and in other cases states have implemented more stringent measures. Airport operators must balance these requirements with their operational needs and strategic business goals. For example, an airport may face strict public sector laws regarding data collection but may have the ability to partner with private sector entities that have fewer restrictions. The following section explores state law considerations; it is not an exhaustive analysis as laws differ from jurisdiction to jurisdiction.

Further complicating the issues of state law is that some state laws may have reach outside their states. This is not uncommon in cases of consumer protections where, in the age of internet commerce, transactions may involve residents of other states or occur on computers or devices

located in other states. Therefore, airports may need to familiarize themselves with data protection statutes in multiple states.

State Constitutional Protections

The constitutions of some states have specific provisions affording data protection and privacy management protections. These states include Alaska, Arizona, California, Florida, Hawaii, Illinois, Louisiana, Missouri, Montana, New Hampshire, South Carolina, and Washington. While there is some commonality among these provisions, they vary significantly. ACRP Legal Research Digest 42 includes a more detailed discussion.⁴⁵

State Public Sector Data Security Laws

All U.S. states have measures in place that protect data collected by their government entities. As of 2020, 32 states have passed statutes requiring government agencies to implement data security measures that protect the data they hold.⁴⁶ Many of these statutes are patterned after the Privacy Act of 1974. Some of the recent statutes offer a more comprehensive statewide approach to security and oversight. This includes measures for audits and assessments of data security practices as well as the development of standards and guidelines. Some statutes include additional safeguards for sensitive information to prevent unauthorized access, destruction, use, modification, or disclosure.⁴⁷ Many state laws also provide requirements of data once its retention is no longer mandated.⁴⁸

Common state government data requirements are unauthorized access, destruction, use, modification, and disclosure.

As governmental entities, airports should determine whether their data management activities are governed by the data privacy laws of their respective states. Some of those laws extend coverage to all governmental entities and political subdivisions in the state. An airport in such a state would be bound to comply with the requirements. Even in the instances where data protections of state law were not mandatory for an airport to follow, those laws would provide a data protection framework that warrants consideration.

State Private Sector Security Laws

States have begun regulating the security practices of private sector entities that collect and maintain personal information. The National Conference of State Legislatures (NCSL) documented that, as of May 2019, at least half of the states had promulgated legislation specifying data security practices for private entities that collect state citizensʼ personal information. The number of states with such laws doubled between 2016 and 2019, due to the growing concerns over cyberthreats to data. Statutes require private entities to take reasonable measures to protect data.⁴⁹ In addition to these statutes, some states impose security requirements through regulatory processes.

The requirements of these statutes vary from state to state. While the requirements may not be applicable directly to the practices of governmental entities like airports, they may be applicable to vendors and commercial entities working with airports. Airports need to familiarize themselves with the security regulations in their state. These requirements should be incorporated into contract language for agreements with private sector entities working at airports. They also may inform airport judgments of tenant and vendor data security practices employed at the airport.

State Consumer Data Protection

States have increasingly considered consumer data protection laws in recent years—including 2023—focusing on the process of collecting, storing, using, sharing, and securing data. The statutes seek to codify rights and protections for personal data of consumers. Ten states have passed data

protection laws and 22 others considered or are considering data privacy legislation in 2023. Many bills under consideration are classified as comprehensive, meaning they address collection, use, and disclosure of personal information by businesses and provide express consumer rights, including access, correction, and deletion of personal information collected by businesses.⁵⁰ Other bills are more targeted to specific industries or data activities, such as information brokers, childrenʼs online privacy, internet service provider (ISP), and website privacy.⁵¹ Of note, Hawaii and Minnesota considered bills regarding location data in 2023.⁵²

As of the writing of this report, five states have adopted comprehensive consumer privacy statutes. Of the five statutes passed, four became active in 2023.

• California
  • California Consumer Privacy Act of 2018 [Cal. Civil Code §1798.100 et seq.]
  • California Consumer Privacy Rights Act [2020 Proposition 24]
• Colorado
  • Colorado Privacy Act, 2021 [Colo. Rev. Stat. §6-1-1301 et seq.] (effective 1 JUL 2023)
• Connecticut
  • Connecticut Personal Data Privacy and Online Monitoring [2022 SB 6] (effective 1 JUL 2023)
• Virginia
  • Virginia Consumer Data Protection Act [Va. Code §59.1-575 et seq.] (effective 1 JAN 2023)
• Utah
  • Utah Consumer Privacy Act, 2022 [Utah Code Ann. §13-61-101 et seq.] (effective 31 DEC 2023).

The ultimate impact of these legislative efforts is difficult to gauge at this point. The statutes target the collection of data through websites and online practices, extending the application of the statutes beyond the stateʼs borders. Airports need to consider the provisions of these types of statutes if they are using their websites and internet services to engage in commerce with residents in these five states. Given the trends in legislation, the number of states with consumer data protection laws will likely increase.

State Consumer Protection Laws

Consumer protection laws exist in all 50 states, but the use and efficacy of these laws vary significantly—like the provisions of the Federal Trade Commission Act (FTCA), which seeks to protect consumers from unfair or deceptive practices. The scope of protections under the statutes and the mechanisms for enforcement differ significantly from state to state. In some states, the state attorney general has joined the FTC in enforcement actions relating to deceptive practices around data. For example, the FTC and the state of New Jersey jointly brought actions against a television manufacturer whose products were providing user viewing data back to the company.⁵³ This action was brought pursuant to the provisions of the FTCA and the New Jersey consumer protection statute.⁵⁴

This joint action suggests that airports and their counsel should analyze their data practices in terms of the traditional consumer fraud statutes of their state. While those statutes have not been used in connection with data privacy actions, the possibility exists in some jurisdictions. The NCLS has created a compendium of state unfair and deceptive practice statutes.⁵⁵

State Data Breach Laws

All 50 states have created statutes that outline the responsibility of public and private data-holding entities if and when a data breach occurs. The statutes define actions required when PII is breached, including notice requirements for persons affected. These notice requirements frequently include time frames for notification and manner of notification (e.g., electronic, certified mail). They also specify the entity responsible for notification. Statutes also frequently

specify reporting requirements to state or local agencies. In some states the breach laws afford liability defenses for entities with reasonable security practices.

Understanding applicable breach requirements is an important step in planning data collection and use. Data breaches can create significant financial liability and legal obligations. In some cases, it can also result in fines and penalties. Breaches also can cause reputational damage.

Data breach liability risk may make PII data collection and use less attractive. In the event of a breach, airports, airlines, and their supporting vendors need to understand their responsibilities. These responsibilities should be addressed and trained for in emergency response programs.

NCLS maintains a reference index of state security breach notification laws.⁵⁶ State statutes should be reviewed by legal counsel and that counsel should be an integral part of response planning. Counsel should evaluate data collection and use practices as well as attendant security measures given the risk imposed by breach laws.

State Data Disposal Laws

Destruction of data is governed by statutes in many states. The NCSL reported that, as of 2020, 24 states had data destruction requirements for private entities.⁵⁷ This is in addition to statutorily specified data destruction requirements for government-held data in several states. These statutes include determinations regarding what PII must be destroyed as well as acceptable measures of destruction.⁵⁸

State laws are in addition to data disposal requirements set out by the FTC Disposal Rules that apply to persons and entities that use consumer reports.⁵⁹ The FTC Disposal Rules apply to the reports themselves and the information derived from them.⁶⁰

Legal counsel needs to review state law to determine whether there are applicable destruction requirements. Where those destruction requirements are specified, the airport needs to ensure that practices conform with those requirements. Where no destruction requirements are imposed, the airport may wish to consider using the FTC requirements as guidance for development of a data destruction program.

State Records Retention, Open Record, and Freedom of Information Laws

Airport data collection activities raise questions under requisite state and local laws regarding records retention and dissemination. All states have statutory enactments that address record retention and dissemination. As airports seek to collect data, they need to ensure their data retention policies meet rules set by state statutes and local ordinances. They should understand that information may be required to be disclosed pursuant to statutes. This may influence the type of information they are willing to collect.

Records retention requirements need to be checked to determine what type of information constitutes a record and whether that record has a retention period mandated by law or ordinance. The existence of these laws may require that airports maintain records for longer periods of time than the airports believe is operationally required. For example, in many states, recorded closed-circuit television (CCTV) video is deemed a record and must be retained for a specified number of years. This retention can have significant impacts on video systems requiring extensive storage costs. These cost factors may make the recording of video prohibitively expensive.

Conversely, statutorily established records retention policies may require airports to purge or eliminate data they may otherwise want to keep. For example, to protect against liability suits, an airport may want to keep video of its facility operations for a period commensurate with the statute of limitations for filing a lawsuit. However, a record retention statute might preclude the airport from keeping the video data for that amount of time.

Records retention schedules are often set by government officials like state archivists or secretary of state offices. Airport legal counsel should be consulted to assist in determining whether data is covered under local law and what the specific retention requirements are. The Brechner Center for Freedom of Information at the University of Florida offers a state-by-state reference compendium for data retention statutes.⁶¹

All states have their own version of the federal Freedom of Information Act (FOIA). These freedom of information, open records laws, or sunshine statutes as they are called, allow for public access to a wide range of documents and records maintained by state and local governments. These statutes can be accessed and compared through many publicly available sources. The statutes generally define the records that are subject to requests; specify the process for making and responding to requests; indicate information exempt from requests; and outline the allocation of cost in connection with requests. How those statutes address these issues varies from state to state. For example, some states liberally construe exemptions to production while others construe the exemptions much more narrowly. Some states limit the ability of responding public entities to charge fees for preparation and production of responses while other states permit entities to recoup preparation and production costs. How a jurisdiction addresses these issues affects the administrative burden that responses to information requests will impose on an airport. Where that burden is elevated, the airport may be disinclined to collect information.

These freedom of information statutes may affect confidential information. Most statutes have some privacy exemption with respect to information requests. There are some protections, generally to a lesser degree, for trade secrets or proprietary business information. It is important for the airport to understand the limitations and to communicate those limitations to people and entities from the airport. This will require a state-by-state analysis.

Important questions regarding the retention and dissemination of data include:

• What constitutes a “record” under state and local law?
• What does the record law deem “proprietary,” “trade secret,” or “private” and what protections are these against dissemination of those materials?
• What are the costs and burdens, including operational administrative costs, imposed by retention and dissemination requirements?
• Can those costs or burdens be mitigated by different data collection and use strategies?
• Have customers and partners received adequate notice of the risks to data imposed by state or local data retention and dissemination requirements?
• What is the possibility that data retention and dissemination requirements can be changed?

State and Local Biometric Regulation

Regarding biometrics, three states have passed legislation regulating private industry use of biometric information and 12 states considered legislation in 2023. The 2008 Illinois Biometric Information Privacy Act (BIPA) is the most comprehensive of the three state laws, including provisions regarding collection, retention, use, disclosure, and destruction of biometric information.⁶² The statute provides for a private right of action, which has resulted in some significant enforcement activity. Texasʼs and Washingtonʼs laws are broader and do not provide a private right of action.⁶³

Protection for biometric data is also found in some of the consumer data privacy statutes.⁶⁴ Additionally, several local governments have enacted ordinances establishing moratoriums on facial biometric use.⁶⁵ The collection and use of biometrics, particularly the use of facial biometrics, is a source of substantial controversy. A 2020 Government Accountability Office (GAO) report notes that the use of biometrics has broad commercial use cases for facial biometrics and that use is expanding in the marketplace.⁶⁶

The GAO report noted little in the way of legal and regulatory controls over commercial uses. The report does note the existence of nationally and internationally promulgated standards that

regulate biometric use—particularly, standards applied in the EU under General Data Protection Regulation. It also noted the work of the to evaluate the efficacy of publicly available algorithms for application of facial biometrics.⁶⁷

International

The EUʼs General Data Protection Regulation (GDPR) is perhaps one of the most significant and influential governmental efforts addressing individual privacy.⁶⁸ The GDPR establishes a range of rights for individuals with respect to their personal information. It is a comprehensive regulation that applies equally to government and private use of individual data.

The GDPR became effective in 2016 and is built on the foundation of privacy rights established by the European Data Protection Directive (EDPD), which had been in effect since 1995.⁶⁹ Between these two governmental initiatives, GDPR and EDPD, the EU has almost three decades of experience in the comprehensive management of data privacy. That experience has served as a model internationally for the development of government privacy structures, including here in the United States.⁷⁰

The GDPR focuses on protection of individualsʼ data ownership and establishes measures to safeguard those rights. The GDPR imposes requirements on the entities controlling or processing data. Among the safeguards are accountability and security measures that must protect data by design and by default. The concept of individual consent is critical.

GDPR provides data subjects with the following privacy rights.

• Access to information regarding the processing of your personal data.
• Access to your personal data.
• Ability to request erasure of your personal data when it is no longer needed or if processing is unlawful.
• Ability to object to the processing of your personal data being used for marketing purposes or on grounds pertinent to your situation.
• Request restriction of personal data in specific instances.
• Receive personal data in machine-readable format and send it to another controller.
• Request that decisions based on automated processing concerning you or significantly affecting you based on your personal data are made by natural persons, not only by computers. You also have the right in this case to express your point of view and to contest decisions.⁷¹

Airports need to understand the requirements of GDPR for two reasons. First, there may be some instances where the requirements of GDPR are legally applicable to data collection and use activities of U.S. airports. The GDPR has no legal enforcement power regarding the operation of U.S. airports, although it may be implicated where airports collect data in the EU or about EU citizens. Both activities can occur through the use of online services or applications, particularly in connection with international travel. Airport counsel should review their airportʼs practices to ensure that it is not engaged in activities that implicate the GDPR or ensure that their practices with respect to those activities comply with GDPR requirements.

Second, the GDPR is influencing legal developments in the United States.⁷² As discussed earlier, lawmakers at the federal and state levels are considering or are implementing more comprehensive data requirements.

Airports may consider GDPR requirements as best practices. Many businesses that provide goods and services in international commerce, or desire to do so, will need to achieve compliance with GDPR. These businesses find that compliance with GDPR requirements generally ensures compliance with national requirements that are either similar or lesser. In effect, the economic

power of the EU compels businesses to meet the GDPR standards so they can do business there and it is easier to apply the higher data privacy standards across all their international operations rather than approach data practices on a country-by-country basis. Therefore, airports may not be imposing a significant burden on their vendors by imposing GDPR data management requirements as many of the vendors are likely already employing GDPR compliance practices with respect to data privacy.

Industry Standards and Practices

Industry standards and practices provide a strong resource for airport operators to address data protection and privacy issues. These documents are often referenced by regulatory agencies, like the FTC, in making determinations regarding whether policies or practices are reasonable. The following applicable industry standards or practices will assist airport operators in establishing a baseline of operation and provide program justifications or defenses to challenges.

Fair Information Practice Principles

FIPPs are a cornerstone of privacy regulation and policy development in the U.S. The principles resulted from a U.S. Department of Health and Human Services (HHS) advisory committee recommendation for Congress to adopt the core principles of consent, access, data integrity, enforcement, and remedies.⁷³

Core FIPPs principles are

• Access and amendment: Data subjects should have access to their PII and appropriate opportunity to correct or amend PII. Airports may choose to restrict access to certain datapoints when related to security considerations.
• Accountability: Requires the implementation of processes and practices to monitor and audit compliance with the stated purpose for the data collection, FIPPs principles, and other applicable data protection and privacy requirements or standards. This may include appointing an oversight authority in the airport and assigning roles for system owners and program managers to implement accountability processes and practices.
• Authority: Only create, collect, use, process, store, maintain, disseminate, or disclose PII when authority to do so exists. Document authority in appropriate notice, such as a privacy impact assessment or statement of record notification.
• Minimization: PII data must be relevant and necessary for the stated data activity purpose. Airports should limit collection, creation, use, maintenance, and disclosure of PII accordingly. PII should be maintained for only as long as necessary to accomplish the stated goal. Airports may consider implementing minimization practices on other sensitive data activities to reduce the risk of unauthorized disclosures.
• Quality and integrity: Collect and manage PII and other data activities with accuracy, relevancy, timeliness, and completeness to ensure fairness to individuals affected. Collecting data directly from individuals increases accuracy.
• Individual participation: Request consent from individuals before collecting, using, processing, storing, sharing, or disclosing PII where practicable. Airports should consider implementing a process for the airport to intake and respond to privacy complaints and inquiries.
• Purpose specification and use limitation: Provide individuals notice of the PII data activityʼs purpose and authority to collect the data if relevant. Data uses should be limited to the purpose specified in the notice. Airports should only share PII internally where a need to know exists. Airports should restrict external uses of PII to those that fall within the legally defined routine uses and are compatible with the original collections and purpose specifications. Data collectors should establish written information sharing agreements.

• Security: Coordinate with relevant airport departments, such as information technology (IT), to ensure security controls are in place and are commensurate with the sensitivity of the information held. Enact rules to prevent inappropriate, unauthorized, or unlawful access, use, disclosure, or destruction. Establish relevant security standards.
• Transparency: Provide direct notice through privacy statements on forms where PII data is entered by individuals; on signage where PII is indirectly collected, or more sensitive data is collected; and by publishing privacy documentation.

Multiple federal statutes and regulations, state laws, and organizational policies leverage the principles as a basis for their information management.⁷⁴ For example, federal agencies use FIPPs in their PIAs and SORNs that they must complete before participating in data collection like biometrics or digital identity. Further, FIPPs are referenced in data breach case law and administrative actions.⁷⁵

The FIPPs address PII by design but also provide guidance for broader data collection that occurs at airports and involves personal and sensitive data. Airports can leverage the FIPPs as a starting point to assess practices and processes for their data collection activities.

The core FIPPs principles are based on the Federal Privacy Council and Department of Homeland Securityʼs interpretations and are modified for airport applications.⁷⁶

National Institute of Standards Privacy Framework

National Institute of Standards and Technology (NIST) Privacy Framework is a proven and reliable tool that assists entities in developing and maturing their privacy programs. The proven reliable framework was developed with input from security, privacy, and technology experts and practitioners. The FTC promotes the Privacy Framework as a baseline for entities seeking to develop and mature their privacy programs.

The Privacy Framework uses an enterprise risk management approach for entities to identify controls that align with their data privacy positions. This assists in the development of roadmaps and privacy programs through planning and engagement. More specifically, the NIST Privacy framework assists organizations in managing privacy risk by: (1) taking privacy into account in the design and deployment of systems and products that affect individuals; (2) facilitating communication about their privacy practices; and (3) encouraging cross-organizational workforce collaboration.⁷⁷ The framework is scalable and can adapt with program or data activity changes.

NIST designed the Privacy Framework similar to its Framework for Improving Critical Infrastructure Cybersecurity because of crossover.⁷⁸ The framework is made up of three tiers—Core, Profiles, and Implementation—to connect mission drivers, and roles to reinforce how organizations manage privacy risk. Implementing these tiers will assist entities in approaching privacy risks and managing data life cycles.

National Institute of Standards AI Risk Management Framework (AI RMF 1.0)

The NIST released the AI Risk Management Framework (AI RMF) in January 2023. The AI RMF addresses risks in design, development, use, and evaluation of AI products, services, and systems.⁷⁹ Airports should consider the parameters of this tool with respect to any use of AI to collect or process data.

AI systems sometimes do not operate as intended because they are making inferences from patterns observed in data rather than a true understanding of what causes those patterns. Ensuring these inferences are helpful and not harmful is fundamental to trustworthy AI. Key characteristics

that support trustworthiness include accuracy, privacy, reliability, robustness, safety, security, and mitigation of harmful bias.

Payment Card Industry Data Security Standard (PCI DSS)

The payment card industry data security standard (PCI DSS) guidelines were established by the credit card industry to provide a baseline for protection of cardholdersʼ data. The standards ensure that goods and services providers apply a baseline of protections for PII and financial data required for card transactions as the data passes through numerous points of control that involve multiple companies.⁸⁰ Airports, as entities potentially having multiple roles in credit card processing, must align their practices to PCI DSS requirements.

Airports may play multiple roles within the PCI environment. They may act as merchants by accepting credit cards, or as service providers when their network or applications are used for the purpose of storing, processing, or transmitting data.⁸¹

International Civil Aviation Organization (ICAO) Standards

International Civil Aviation Organization (ICAO) is a United Nations agency, established to help countries share their skies to their mutual benefit. ICAO assists the 193 Contracting States with the Chicago Convention as they cooperate to adopt standards, practices, and policies for international civilian flight. Industry and civil society groups, in addition to relevant multilateral organizations, contribute to these ICAO outcomes as Invited Organizations. ICAO Secretariat is funded and directed by the Contracting States to provide, among other services, technical, legal, and administrative support for their air transport cooperation.

ICAOʼs Annex 9 provides a strong example of industry standards and guidelines that promote passenger facilitation across multiple government actors, airlines, and vendors. Annex 9 contains the international framework of standards, recommended practices, and guidance materials regarding facilitation procedures, including passenger data.⁸² These documents address Passenger Name Record (PNR) data, an Application Programming Interface (API) data service, and machine-readable technology requirements. These standards and guidelines create uniform measures for data transfer and handling in a manner that minimizes cost, ensures accurate and complete information, protects personal data, achieves timeliness, and provides efficiency and efficacy of data and risk management.

ICAO also serves as an avenue for addressing concerns that impact all or most Contracting States, and its initiatives and areas of focus can overlap with other organizations, such as International Air Transport Association (IATA). (An example of this is a working paper that was presented by IATA at the 38th Session of an ICAO Legal Committee meeting in April 2022: “Privacy Laws and International Carriage by Air.”) In that ICAO working paper, the issue presented is that the implementation of privacy laws specific to a jurisdiction fail to account for the inherent nature of air travel, which is to move passengers from one jurisdiction to another, and that airlines are left trying to comply with laws of multiple jurisdictions that may conflict in regard to what passenger data is governed, and how passenger data should be gathered, used, stored, and transmitted. To add additional complexity, almost every jurisdiction has requirements, separate from its privacy laws, that require airlines to share data with government agencies, or private industry representatives of those agencies. As the ICAO working paper states:

The paper concludes by recommending further study of this issue by the ICAO Legal Committee.

Airports and airport stakeholders may find helpful guidance in the ICAO standards and should consider revisiting the standards regularly for up-to-date information.

International Air Transport Association (IATA) Standards

IATA is a trade association that represents approximately 300 airlines (83% of total air traffic). IATA supports many areas of aviation activity and helps formulate industry policy on critical aviation issues. IATAʼs mission includes developing global commercial standards that assist airlines by simplifying processes and increasing passenger convenience while reducing costs and improving efficiency. IATA helps airlines to operate safely, securely, efficiently, and economically under clearly defined rules. IATA supports these aspects of its mission through the publication of resolutions, industry standards, and recommended practices.

• Resolutions are binding for IATA member airlines. Adopting, changing or rescinding a resolution requires unanimous support from all airlines participating in the conference.
• Industry standards are binding for IATA members airlines, unless the member airline informs the Secretary of the Conference in writing that it is not bound by this Standard. Adoption of industry standards requires the support of 80% of the airlines participating in the conference.
• Recommended Practices are not binding but provide guidance. Adoption of the recommended practice requires the support of two thirds of the airlines participating in the conference.

Resolutions and industry standards are mandatory practices for IATA Member Airlines (unless a member airline opts out in writing), while recommended practices are created as a form of best practice and can be implemented at the discretion of the airlines. Their common purpose is to steer the industry and establish standard rules for the functioning of IATA mechanisms, while promoting collaboration between the airlines.

There are a myriad of resolutions, industry standards, and recommended practices that cover almost any imaginable issue that might impact an airline and many of these will be relevant to airports as well. These documents can be a useful resource for an airport as it considers a specific issue, especially when the issue involves an airlineʼs operation. An example of this would be the implementation of common use technology in an airport. Common use standards allow airlines, airports, and ground handling agents to support the optimization of passenger processes using shared technologies.

The following resolution and recommended practices contained in the IATA Passenger Standards Conference Manual (PSCM) support common use technology:

However, airport and airline needs and technologies evolve continuously, so while the above documents may be helpful, the speed of change requires airports and airlines to be flexible and

prepared, whether to implement new technology solutions or adapt to new compliance and data use requirements.

Open Identity Exchange (OIX) Trust Framework

The Open Identity Exchange (OIX) has created trust framework guidance for digital identification programs.⁸⁵ A trust framework is agreed upon by a set of stakeholders with common goals related to an identity ecosystem.⁸⁶ The trust framework defines rights and responsibilities, specifies community policies and standards, and defines processes and procedures.⁸⁷ A trust framework informs organizations who they are dealing with and what an individual can do based on verification of their identification documentation.⁸⁸ Multiple trust frameworks may exist within a community.

The trust frameworkʼs identity ecosystem manages access to multiple relying party systems by creating a common user base and transactions. Airport operators may have multiple trust framework scenarios depending on their operation and partners. A credential service provider manages registrations and authentications of usersʼ data. The users provide their information once to the credential service provider and receive access to the relying partiesʼ systems.

The trust framework rules provide structure for transactions to create efficiency and maintain security and trust. Trust framework rules should include requirements for registration and enrollment, identity proofing, credential management, privacy and security measures, data handling, and other technical specifications.⁸⁹ Airports will need to leverage the rules and requirements they have established through the governance framework to protect their interests, consider CBP, TSA, and airline requirements and any vendor considerations.