OhDoctor

Sorry if this has been brought up already, but I searched and couldn't find much.

With California's Consumer Privacy Law going into effect soon, will AA be compelled to release Helix scores on request? The law specifically mandates that "(a) A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer the categories of personal information it has collected about that consumer." Wouldn't Helix information fall under this umbrella?

javabytes

Nope.

robertablake

Interesting question. Since the law is for disclosure of collected information. The helix score is not information collected by AA but information created by AA, no?

MSPeconomist

It's a summary that aggregates information collected by AA.

USFlyerUS

No. AA does not "collect" a Helix score. It's computed, not collected, based on a number of factors. I also have a hard time seeing how such a score is "personal information" of the consumer. It's an internal metric that's computed based on a variety of data points. Also, note the law saws the "categories of personal information", not the personal information itself.

Why does knowing your score matter, though?

javabytes

And the data being scored by Helix does not fall under the scope of personal data either.

OhDoctor

Home airport? How often you fly? Information on complaints you've filed? Categories like these are considered fair game under the law when it comes to other companies (Airbnb, for starters). Why wouldn't it apply here?

OhDoctor

It's computed based on collected data. And I'm not saying that knowing the score actually matters -- I'm asking if the law will impel companies like AA or Hyatt to disclose the data they are using to compile these secret customer scores.

OhDoctor

Exactly -- so wouldn't they be required to disclose what they're collecting? It seems the express purpose of the law.

robertablake

Maybe AA will need to disclose what the personal data they've collected, but not need to disclose the computed helix score?

USFlyerUS

Your post said "to release Helix scores on request". Knowing the categories of data AA or Hyatt collects is one thing, but there's no way AA will be forced to reveal the score itself.

UKtravelbear

Yes they would have to disclose the data about you they have collected - that's clear enough from your quote of the law in post one!

But it appears that they don't have to disclose to you the results of any processing of that information in giving you some sort of score or rating etc

Don't get confused by the data being collected and the processing of it. They are not the same.

If the law had said something like 'and disclose the results of any processing of personal data' then you could have a case to get your score. But it apparently dosen't say that.

IIRC people are using UK Data Protection laws to get their BA 'CIV' score but that's because the UK / European law allows for the disclosure of the results of processing your data. Under UK laws when a business / organisation register to collect data you have to state what data you are going to collect and what you are going to do with it. You can't just collect data because you want to have it or think it would be nice to have it - you have to have a need to collect it for the running of your business.

OhDoctor

Right, I guess it would be the elements of the score, and not the score itself (although I'm sure a lawyer out there could argue otherwise). But wouldn't that be interesting in and of itself, given how much people speculate about what exactly goes into these scoring systems?

fotographer

I would tend to think that the Helix score that AA has acquired thru ways in which we have no idea.. would only benefit AA and have no real impact in our lives.
I know, I dont loose sleep wondering what my helix score is.

ijgordon

I don't read anything in your quote of the law that suggests they have to tell you what each element of data collected is used for. So I don't see how you're going to get any insight into which pieces of personal data are used for calculating the score.
Further, I don't know if something even like "$ spent on AA tickets in the last 12 months" would even be considered personal data, would it? It certainly doesn't seem to be something that would be covered under the GDPR definition of personal data, and surely that's the kind of metric AA would be using in calculating customer value scores. While age--personal data--might matter, hair color--also personal data--would not.