ANNEX V

July 6, 2023

Commissioner Didier Reynders

European Commission

Rue de la Loi / Wetstraat 200

1049 1049 Brussels

Belgium

Dear Commissioner Reynders:

The United States Department of Transportation (“Department” or “DOT”) appreciates the opportunity to describe its role in enforcing the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) Principles. The EU-U.S. DPF will play a critical role in protecting personal data provided during commercial transactions in an increasingly interconnected world. It will enable businesses to conduct important operations in the global economy, while at the same time ensuring that EU consumers retain important privacy protections.

The DOT first publicly expressed its commitment to enforcement of the U.S.-EU Safe Harbor Framework in a letter sent to the European Commission over 22 years ago, commitments that were repeated and expanded upon in a 2016 letter regarding the EU-U.S. Privacy Shield Framework. The DOT pledged to vigorously enforce the U.S.-EU Safe Harbor Privacy Principles, and then the EU-U.S. Privacy Shield Principles, in those letters. The DOT extends this commitment to the EU-U.S. DPF Principles and this letter memorializes that commitment.

Notably, the DOT confirms its commitment in the following key areas: (1) prioritizing investigation of alleged EU-U.S. DPF Principles violations; (2) appropriate enforcement action against entities making false or deceptive claims of EU-U.S. DPF participation; and (3) monitoring and making public enforcement orders concerning EU-U.S. DPF Principles violations. We provide information about each of these commitments and, for necessary context, pertinent background about the DOT’s role in protecting consumer privacy and enforcing the EU-U.S. DPF Principles.

1. Background

A. DOT’s Privacy Authority

The Department is strongly committed to ensuring the privacy of information provided by

consumers to airlines and ticket agents. The DOT’s authority to take action in this area is found in 49 U.S.C. 41712, which prohibits a carrier or ticket agent from engaging in “an unfair or deceptive practice” in air transportation or the sale of air transportation. Section 41712 is

patterned after Section 5 of the Federal Trade Commission (FTC) Act (15 U.S.C. 45). Recently, DOT issued regulations defining unfair and deceptive practices, consistent with both DOT and FTC precedent (14 CFR § 399.79). Specifically, a practice is “unfair” if it causes or is likely to cause substantial injury, which is not reasonably avoidable, and the harm is not outweighed by

benefits to consumers or competition. A practice is “deceptive” to consumers if it is likely to mislead a consumer, acting reasonably under the circumstances, with respect to a material matter. A matter is material if it is likely to have affected the consumer's conduct or decision with respect to a product or service. Aside from these general principles, DOT specifically interprets section 41712 as prohibiting carriers and ticket agents from: (1) violating the terms of its privacy policy; (2) violating any rule issued by the Department that identifies specific privacy practices as unfair or deceptive; or (3) violating the Children’s Online Privacy Protection Act (COPPA) or FTC rules implementing COPPA; or (4) failing, as a participant in the EU-U.S. DPF, to comply with the EU-U.S. DPF Principles.

As noted above, under federal law, the DOT has exclusive authority to regulate the privacy practices of airlines, and it shares jurisdiction with the FTC with respect to the privacy practices of ticket agents in the sale of air transportation.

As such, once a carrier or seller of air transportation publicly commits to the EU-U.S. DPF Principles, the Department is able to use the statutory powers of section 41712 to ensure compliance with those principles. Therefore, once a passenger provides information to a carrier or ticket agent that has committed to honoring the EU-U.S. DPF Principles, any failure to do so by the carrier or ticket agent would be a violation of section 41712.

B. Enforcement Practices

The Department’s Office of Aviation Consumer Protection (“OACP”) investigates and prosecutes cases under 49 U.S.C. 41712. It enforces the statutory prohibition in section 41712 against unfair and deceptive practices primarily through negotiation, preparing cease and desist orders, and drafting orders assessing civil penalties. The office learns of potential violations largely from complaints it receives from individuals, travel agents, airlines, and U.S. and foreign government agencies. Consumers may use the DOT’s website to file privacy complaints against airlines and ticket agents.

If a reasonable and appropriate settlement in a case is not reached, OACP has the authority to institute an enforcement proceeding involving an evidentiary hearing before a DOT administrative law judge (“ALJ”). The ALJ has the authority to issue cease-and-desist orders and civil penalties. Violations of section 41712 can result in the issuance of cease and desist orders and the imposition of civil penalties of up to $ 37 377 for each violation of section 41712.

The Department does not have the authority to award damages or provide pecuniary relief to individual complainants. However, the Department does have the authority to approve settlements resulting from investigations brought by its OACP that directly benefit consumers (e.g., cash, vouchers) as an offset to monetary penalties otherwise payable to the U.S. Government. This has occurred in the past, and may also occur in the context of the EU-U.S. DPF Principles when circumstances warrant. Repeated violations of section 41712 by an airline would also raise questions regarding the airline’s compliance disposition which could, in egregious situations, result in an airline being found to be no longer fit to operate and, therefore, losing its economic operating authority.

To date, the DOT has received relatively few complaints involving alleged privacy violations by ticket agents or airlines. When they arise, they are investigated according to the principles set forth above.

C. DOT Legal Protections Benefiting EU Consumers

Under section 41712, the prohibition on unfair or deceptive practices in air transportation or the sale of air transportation applies to U.S. and foreign air carriers as well as ticket agents. The DOT frequently takes action against U.S. and foreign airlines for practices that affect both foreign and U.S. consumers on the basis that the airline’s practices took place in the course of providing transportation to or from the United States. The DOT does and will continue to use all remedies that are available to protect both foreign and U.S. consumers from unfair or deceptive practices in air transportation by regulated entities.

The DOT also enforces, with respect to airlines, other targeted laws whose protections extend to non-U.S. consumers such as the Children’s Online Privacy Act (“COPPA”). Among other things, COPPA requires that operators of child-directed websites and online services, or general audience sites that knowingly collect personal information from children under 13 provide parental notice and obtain verifiable parental consent. U.S.-based websites and services that are subject to COPPA and collect personal information from foreign children are required to comply with COPPA. Foreign-based websites and online services must also comply with COPPA if they are directed to children in the United States, or if they knowingly collect personal information from children in the United States. To the extent that U.S. or foreign airlines doing business in the United States violate COPPA, the DOT would have jurisdiction to take enforcement action.

II. EU-U.S. DPF Principles Enforcement

If an airline or ticket agent chooses to participate in the EU-U.S. DPF and the Department receives a complaint that such an airline or ticket agent had allegedly violated the EU-U.S. DPF Principles, the Department would take the following steps to vigorously enforce the EU-U.S. DPF Principles.

A. Prioritizing Investigation of Alleged Violations

The Department’s OACP will investigate each complaint alleging EU-U.S. DPF Principles

violations, including complaints received from EU data protection authorities (“DPAs”) and take enforcement action where there is evidence of a violation. Further, OACP will cooperate with the FTC and Department of Commerce and place a priority on allegations that the regulated entities are not complying with privacy commitments made as part of the EU-U.S. DPF.

Upon receipt of an allegation of a violation of the EU-U.S. DPF Principles, OACP may take a range of actions as part of its investigation. For example, it may review the ticket agent or airline’s privacy policies, obtain further information from the ticket agent or airline or from third parties, follow up with the referring entity, and assess whether there is a pattern of violations or significant number of consumers affected. In addition, it would determine whether the issue implicates matters within the purview of the Department of Commerce or FTC, assess whether consumer education and business education would be helpful, and as appropriate, initiate an enforcement proceeding.

If the Department becomes aware of potential EU-U.S. DPF Principles violations by ticket agents, it will coordinate with the FTC on the matter. We will also advise the FTC and the Department of Commerce of the outcome of any EU-U.S. DPF Principles enforcement action.

B. Addressing False or Deceptive Participation Claims

The Department remains committed to investigating EU-U.S. DPF Principles violations, including false or deceptive claims of participation in the EU-U.S. DPF. We will give priority consideration to referrals from the Department of Commerce regarding organizations that it identifies as improperly holding themselves out to be EU-U.S. DPF participants or using the EU- U.S. DPF certification mark without authorization.

In addition, we note that if an organization’s privacy policy promises that it complies with the EU-U.S. DPF Principles, its failure to make or maintain a self-certification through the Department of Commerce likely will not, by itself, excuse the organization from DOT enforcement of those commitments.

C. Monitoring and Making Public Enforcement Orders Concerning EU-U.S. DPF Violations

The Department’s OACP also remains committed to monitoring enforcement orders as needed to ensure compliance with the EU-U.S. DPF Principles. Specifically, if the office issues an order directing an airline or ticket agent to cease and desist from future violations of the EU-U.S. DPF Principles and section 41712, it will monitor the entity’s compliance with the cease-and-desist provision in the order. In addition, the office will ensure that orders resulting from EU-U.S. DPF Principles cases are available on its website.

We look forward to our continued work with our federal partners and EU stakeholders on EU-U.S. DPF matters.

I hope that this information proves helpful. If you have any questions or need further information, please feel free to contact me.

Sincerely,

Pete BUTTIGIEG