Core principles of privacy for UK flight bookings
No matter the price point of the flight, the same data protection rules apply. Reputable booking sites follow these key principles:
- Transparency:ย Booking websites are transparent about the information they collect and how they will use it. This is detailed in their publicly available privacy policy, which is accessible to all users.
- Lawfulness and purpose:ย Companies must have a legal basis to process your information, such as needing it to fulfill a contract (your booking), complying with a legal obligation, or relying on legitimate interests. Data collected for one purpose, such as ticketing, cannot be used for a different purpose, such as marketing, without separate consent.
- Data minimization:ย Sites collect only the data necessary for the intended purpose. For example, while an airline needs passport information, a car park at the airport would not.
- Data retention:ย Personal data is not kept for longer than necessary. Websites and airlines have a data retention policy and will securely delete or anonymize information once there is no longer a legal or business need for it.
- Data sharing:ย Companies do not sell, rent, or trade your personal information. They only share it with third parties who need it to provide a service, such as airlines, hotels, or payment processors.ย
What data is typically collected
When you book a flight, websites gather personal information to process your travel arrangements. This may include:ย
- Identity data:ย Names, date of birth, gender, and passport details.
- Contact data:ย Telephone number, email address, and home address.
- Financial data:ย Payment information, though sensitive card details are often processed by a payment provider and not stored by the booking company.
- Sensitive data:ย This is only collected with your explicit consent and when necessary, such as for specific medical assistance or dietary requirements.
- Technical data:ย Information about your browsing behavior, IP address, and how you use the website is collected through automated technologies like cookies.ย
Your rights as a customer
Under UK data protection law, you have specific rights concerning your personal data:ย
- Right to access:ย You can ask for a copy of the personal information a company holds about you.
- Right to rectification:ย You can request that inaccurate or incomplete information be corrected.
- Right to erasure:ย In some circumstances, you have the right to have your personal data deleted.
- Right to object:ย You can object to certain types of data processing, such as for marketing purposes.
- Right to withdraw consent:ย If you previously gave consent for your data to be processed for a specific reason, you can withdraw that consent at any time.ย
How to protect your personal information
- Keep booking details confidential:ย Your booking reference number (PNR) can grant access to your booking details, so keep it secure.
- Safeguard your login details:ย Do not share your account login information, and remember to log out when using a public computer or device.
- Be aware of phishing:ย Be cautious of unsolicited emails that illegally attempt to gather your personal information.ย
If you have concerns about how your data is being handled, you can contact the Information Commissioner’s Office (ICO) in the UK for assistance.