Data Privacy

Privacy regulations, PII handling, and data protection requirements.

Scope

Regulations

• GDPR (EU General Data Protection Regulation)
• CCPA (California Consumer Privacy Act)
• Other regional regulations (LGPD, PDPA)

Data Categories

• Personal Identifiable Information (PII)
• Sensitive personal data
• Travel data
• Payment information

Privacy Operations

• Consent management
• Data subject requests
• Breach notification
• Privacy by design

Research Topics

• GDPR Article 6 lawful bases
• CCPA consumer rights
• Cross-border data transfers
• Data retention requirements
• Cookie consent requirements
• Privacy impact assessments
• DPO requirements
• Breach notification timelines

GDPR Compliance

Lawful Bases (Article 6)

Data Subject Rights

Implementation

Data Subject Request Flow:
1. Receive request (web form, email)
2. Verify identity
3. Acknowledge receipt (within 72 hours)
4. Process request
5. Respond (within 30 days)
6. Document and audit

CCPA Compliance

Consumer Rights

• Right to know (disclosure)
• Right to delete
• Right to opt-out (sale of data)
• Right to non-discrimination

Required Disclosures

• Categories of data collected
• Purposes of collection
• Third parties shared with
• Sale of personal information

PII Classification

Data Categories

High Sensitivity:
├── Passport/ID numbers
├── Payment card data (PCI scope)
├── Date of birth
├── Biometric data
└── Health information (SSR codes)

Medium Sensitivity:
├── Full name
├── Email address
├── Phone number
├── Physical address
└── Booking history

Low Sensitivity:
├── Booking reference
├── Flight preferences
├── Seat preferences
└── Meal preferences

Handling Requirements

Data Retention

Retention Schedule

Deletion Process

Retention Period Expired
        ↓
Identify data locations
        ↓
Verify no legal holds
        ↓
Execute deletion
        ↓
Verify and document

Privacy by Design

Principles

1. Proactive not reactive
2. Privacy as default
3. Privacy embedded in design
4. Full functionality
5. End-to-end security
6. Visibility and transparency
7. Respect for user privacy

Implementation Checklist

• Minimal data collection
• Purpose limitation
• Consent mechanisms
• Data encryption
• Access controls
• Audit logging
• Retention policies
• Deletion capabilities

Consent Management

Consent Types

Cookie Categories

Essential:
├── Session management
├── Security tokens
└── Load balancing

Functional:
├── Language preference
├── Currency selection
└── Recent searches

Analytics:
├── Page views
├── User journeys
└── A/B testing

Marketing:
├── Advertising
├── Retargeting
└── Social media

Cross-Border Transfers

Transfer Mechanisms

APIS Data

Special handling for government data sharing:

• Legal basis: Legal obligation
• Minimize data to required fields
• Secure transmission
• No secondary use

Breach Response

Notification Timeline

Response Process

1. Detect and contain
2. Assess scope and impact
3. Notify authorities (if required)
4. Notify affected individuals
5. Remediate
6. Document and learn