PIPEDA Case Summary #2009-006

Airline ticket seller was mistaken in its collection of exact age information

[Principles 4.1.4 and 4.4.1]

When an individual was ordering an airline ticket online from a discounter, she was required to provide her month and year of birth for a quotation for travel insurance. The online ticketing company claimed that, under provincial law, it had to collect each customer’s month and year of birth to at least provide them with an insurance quote, even if they chose to refuse the offer. The Assistant Commissioner determined that, in fact, the provincial legislation did not require the exact age of a customer, nor the month and year of their birth, to obtain an insurance quote—knowing the age category (i.e. age range) to which customers belonged would be sufficient.

The organization consequently changed its practices and procedures for purchasing airline tickets online so that less specific customer age information was requested.  

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

A customer of an online service that sells discounted airline tickets purchased a ticket from the organization’s website.

During the transaction she noticed the following:

• she was required to provide her birth month and year of birth for the purpose of obtaining a quotation for travel insurance;
• she was unable to make the purchase without entering her birth month and year;
• after entering her birth month and year, she was given the option to decline to purchase travel insurance; and
• on the e-mail confirming her ticket purchase, her birth year and month were visible, even though she did not purchase travel insurance.

The customer contacted the organization and was told the following:

• a customer’s birth month and year of birth were required for the purpose of offering travel insurance to customers; and
• it had recently retained counsel to draft a company privacy policy.

The customer was not satisfied with the answer. She believed that providing such personal information should not be mandatory, as some customers would make their own travel insurance arrangements.

The organization claimed that it was required to specify the availability and cost of any applicable trip cancellation insurance under 34.(5) of Ontario Regulation 26/05 of the Ontario Travel Industry Act 2002. This law governs registered travel wholesalers and retailers. According to the organization, in order to comply with this legislation, it needed to obtain each customer’s month and year of birth during the ticket registration process.

This Office reviewed Ontario Regulation 26/05, Subsection 33(4) and only partly confirmed the organization’s claim. In fact, the cost of travel insurance is determined through the use of a five-part formula, one component of which is a traveller’s age, not their month and year of birth. 

Since the organization is a registrant of the Travel Industry Council of Ontario (TICO), we also reviewed its most recent edition of its Code of Practice for Electronic Commerce. (TICO is mandated by the Ontario government to administer the Ontario Travel Industry Act.)

 Appendix C : “TICO Guidelines for Disclosure” of the Code of Practice was consistent with section 36 of Ontario Regulation 26/05 in indicating that registrants should advise their customers of the availability of trip cancellation insurance and out-of-province health insurance, if applicable. However, we also determined that less detailed age information, such as an age range (e.g. 18-59), will suffice to meet the legal obligations under the Ontario Travel Industry Act.

The Assistant Commissioner therefore recommended that the organization change its online registration process so that customers could indicate only their age or the age range applicable to them. She also recommended that this information be removed from e-ticket confirmation material.

The organization was also required to have a privacy policy, to make the policy available to its customers and to post it on its website.

The organization agreed to carry out the recommendations. The only exception would be that full dates of birth would still be required for tickets for infants younger than 24 months, since the airline would have to confirm an infant’s exact age to qualify for discounted fares.

Findings

Issued March 24, 2009

Application: Principle 4.1.4 states that organizations shall implement policies and practices to give effect to the principles of Schedule 1 of the Act. Principle 4.4.1 establishes, in part, that organizations shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfil the purposes identified.

In making her determinations, the Assistant Commissioner deliberated as follows:

• The organization did not have a privacy policy, which was in contravention of Principle 4.1.4 of the Act. The organization complied with the Assistant Commissioner’s recommendation to post a privacy policy on its website.
• The organization’s collection of each customer’s month and year of birth was unwarranted and contravened Principle 4.4.1. The organization complied with the Assistant Commissioner’s recommendation to use age ranges, except for infants younger than 24 months, to comply with a requirement of the airlines.

Conclusion

The Assistant Commissioner concluded that the complaint was resolved.