GDPR - Right to be forgotten and it's extent
Sep 22, 2018, 4:38 pm
#1
Original Poster
Join Date: Jun 2018
Posts: 59
GDPR - Right to be forgotten and it's extent
Hey everyone,
I was wondering if anyone has some insight to using GDPR to request an action for an airline to delete your account with them.
Also how far up the chain will affect. For instance if I wanted my personal information destroyed by Aer Lingus and request to be forgotten under GDPR, would my account for BA be affected? Since they are both owned by IAG, will requesting such and action from one airline affect another airline owned by the same group?
Could anyone advise me on what I would expect to happen if I was to go down that route?
Thanks
Echo
I was wondering if anyone has some insight to using GDPR to request an action for an airline to delete your account with them.
Also how far up the chain will affect. For instance if I wanted my personal information destroyed by Aer Lingus and request to be forgotten under GDPR, would my account for BA be affected? Since they are both owned by IAG, will requesting such and action from one airline affect another airline owned by the same group?
Could anyone advise me on what I would expect to happen if I was to go down that route?
Thanks
Echo
Sep 22, 2018, 5:12 pm
#2
FlyerTalk Evangelist
Join Date: Oct 1999
Location: Juneau, Alaska.
Programs: AS 75K;BA Silver;AA G;HH Dia;HY Glob
Posts: 15,796
Well, the aer club terms and conditions provide the following:
Probably want to look at the privacy statement.
I don’t see why closing your aer club account would have any particular effect on your BA Executive Club account.
15. Member's right to terminate Membership
Members may terminate their Membership at any time by contacting AerClub either online or by writing to AerClub at Aer Lingus, Dublin Airport, Co Dublin, stating that they no longer wish to be a Member and (if applicable) enclosing their Card cut in half. Any such termination will result in a loss of all Avios and does not relieve the Member of any continuing obligations under these AerClub Terms and Conditions. Data in relation to a closed Account will be processed in accordance with the Aer Lingus Privacy Statement available here: https://www.aerlingus.com/support/le...acy-statement/.I don’t see why closing your aer club account would have any particular effect on your BA Executive Club account.
Sep 22, 2018, 5:16 pm
#3
Join Date: Dec 2009
Location: Flatland
Programs: AA Lifetime Gold 1MM, BA Gold, UA Peon
Posts: 6,105
(as I understand it)
The GDPR rights to be forgotten are not transitive. Requesting one company to forget about you does not require them to take action to have your information removed at other companies, even those they have shared your information with. In fact for them to be able to have your information removed from another company would be contrary to some principles of the GDPR about accurate processing of information in the interests of the person whose information it is.
I also think most companies are unlikely to do this if the information was shared for some business trading relationship (eg frequent flyer alliance, marketing details passed to other companies, etc). They probably will remove it if it was shared as part of a service provider agreement (example: the company uses a customer-relations-as-a-service provider and will cause your information to be removed from customer-relations service).
The GDPR rights to be forgotten are not transitive. Requesting one company to forget about you does not require them to take action to have your information removed at other companies, even those they have shared your information with. In fact for them to be able to have your information removed from another company would be contrary to some principles of the GDPR about accurate processing of information in the interests of the person whose information it is.
I also think most companies are unlikely to do this if the information was shared for some business trading relationship (eg frequent flyer alliance, marketing details passed to other companies, etc). They probably will remove it if it was shared as part of a service provider agreement (example: the company uses a customer-relations-as-a-service provider and will cause your information to be removed from customer-relations service).
Sep 22, 2018, 6:36 pm
#4
Original Poster
Join Date: Jun 2018
Posts: 59
How about my Iberia account? I just tried to look for terms for it and couldn't see it 🤔
Sep 22, 2018, 8:08 pm
#5
Join Date: Jan 2016
Location: LON
Programs: BAEC
Posts: 3,911
To a certain extent it depends which legal entity you make the right to be forgotten application to. If you apply to Aer Lingus then it will be the data controlled by that legal entity. If you apply to IAG group, then it will be the data they control but could be instructed to include all their subsidiary companies.
If you do wish to exercise the right to be forgotten it can be useful to first do a data subject access request' to first understand what data they have about you, and what data they hold about you that is discretionary, and what they might have to continue to hold by law - for example there might be some data they have to retain for legal or compliance reasons or to.perform a contract that you cannot withdraw consent for.
If you do wish to exercise the right to be forgotten it can be useful to first do a data subject access request' to first understand what data they have about you, and what data they hold about you that is discretionary, and what they might have to continue to hold by law - for example there might be some data they have to retain for legal or compliance reasons or to.perform a contract that you cannot withdraw consent for.
Last edited by plunet; Sep 22, 2018 at 9:12 pm
Sep 22, 2018, 9:34 pm
#6
Join Date: Jun 2016
Location: Surrey
Programs: BA Gold, VS Gold, Eurostar CB, IHG Spire, Hilton Diamond, Bonvoy Titanium, Hertz President Circle
Posts: 435
I've had my Iberia account forgotten. Was surprisingly prompt. Had a few days of being worried when I realised there was a chance my baec account could get wiped but in the end only IB was deleted.
Sep 22, 2018, 10:02 pm
#7
FlyerTalk Evangelist
Join Date: Nov 2011
Location: Brighton. UK
Programs: BA Gold / VS /IHG Diamond & Ambassador
Posts: 14,176
Does IAG as the parent / holding company actually hold any personal data such as FF programme data?
My relationship is with BA not with IAG so if I want to delete my BA account it’s BA that I would contact.
Im sure you would be most unhappy if say your IB account was deleted because you asked EI to delete your EI account.
Is that what you want?
My relationship is with BA not with IAG so if I want to delete my BA account it’s BA that I would contact.
Im sure you would be most unhappy if say your IB account was deleted because you asked EI to delete your EI account.
Is that what you want?
Sep 22, 2018, 10:21 pm
#8
Join Date: May 2016
Location: HK
Programs: IHG Spire Elite Ambassador, Hilton Diamond, Aegan Gold, British Airways Bronze
Posts: 182
Would that be a trick to prevent the famous negatives avios on Iberia after transferring avios from the promotion they ran? Transfer the avios to BA, use the right to be forgotten on Iberia, create a new clean Iberia account?
Sep 23, 2018, 2:42 am
#9
Join Date: Dec 2009
Location: Flatland
Programs: AA Lifetime Gold 1MM, BA Gold, UA Peon
Posts: 6,105
The Right to be Forgotten is not absolute; in particular, keeping user information to substantiate legal claims (such as a breach of Avios terms and conditions amounting to fraud) is permitted. See the list of exceptions here: https://ico.org.uk/for-organisations...ht-to-erasure/
Sep 23, 2018, 2:44 am
#10
Join Date: Jun 2008
Location: Oslo, Norway
Posts: 557
Also have in mind that you can not demand that all types of data is removed on request, there might be other laws in place (example tax/accounting) mandating to keep data for a longer time. etc. For example one reason for not removing removing data from a frequent flyer account might be that you have pending award-flights. You can demand deletion if "the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed"
See GDPR article 17.
See GDPR article 17.
Sep 23, 2018, 2:45 am
#11
Join Date: Aug 2018
Posts: 53
The GDPR legislation doesn't go into that detail. It might happen in the future, as the need arises. But now everything is still pretty vague. The right to be forgotten is also not absolute. For example, you need to keep invoices for 10 years, on which your details will also be included.
Sep 23, 2018, 3:08 am
#12
Join Date: May 2016
Location: HK
Programs: IHG Spire Elite Ambassador, Hilton Diamond, Aegan Gold, British Airways Bronze
Posts: 182
If that were to be the case, it seems quite dishonest to me.
The Right to be Forgotten is not absolute; in particular, keeping user information to substantiate legal claims (such as a breach of Avios terms and conditions amounting to fraud) is permitted. See the list of exceptions here: https://ico.org.uk/for-organisations...ht-to-erasure/
The Right to be Forgotten is not absolute; in particular, keeping user information to substantiate legal claims (such as a breach of Avios terms and conditions amounting to fraud) is permitted. See the list of exceptions here: https://ico.org.uk/for-organisations...ht-to-erasure/
Sep 23, 2018, 4:38 am
#13
Ambassador, British Airways; FlyerTalk Posting Legend
Join Date: Apr 2012
Location: Leeds, UK
Programs: BA GGL/CCR, GfL, HH Diamond
Posts: 42,887
If that were to be the case, it seems quite dishonest to me.
The Right to be Forgotten is not absolute; in particular, keeping user information to substantiate legal claims (such as a breach of Avios terms and conditions amounting to fraud) is permitted. See the list of exceptions here: https://ico.org.uk/for-organisations...ht-to-erasure/
The Right to be Forgotten is not absolute; in particular, keeping user information to substantiate legal claims (such as a breach of Avios terms and conditions amounting to fraud) is permitted. See the list of exceptions here: https://ico.org.uk/for-organisations...ht-to-erasure/
Sep 23, 2018, 6:05 am
#14
Join Date: Dec 2009
Location: Flatland
Programs: AA Lifetime Gold 1MM, BA Gold, UA Peon
Posts: 6,105
Indeed, some people (in general, not in this discussion) want the "right to be forgotten" to be some sort of magical wand of amnesia that they can wave on anyone they want for their own advantage. That's not quite what it is meant for.
Sep 23, 2018, 9:03 am
#15
FlyerTalk Evangelist
Join Date: Oct 1999
Location: Juneau, Alaska.
Programs: AS 75K;BA Silver;AA G;HH Dia;HY Glob
Posts: 15,796