On Data Privacy Day, yep, you read that right, Google it, I’m here to share the story of 17-year-old Daisy Fichthorn of Darien, Conn. May it be a warning that despite the fact that 51 countries note the importance of privacy and data protection, in the airline world this means less to some companies than others.
Anyway back to Daisy. The Connecticut teen downloaded the coronavirus vaccination verification app, VeriFLY to her phone earlier this month because she hoped it would make it easier to navigate through the gauntlet of Covid-related travel restrictions before her flight to Zaragosa, Spain. In emails, American Airlines was pretty relentless in urging her and the rest of its customers to use the app.
Only later, did Daisy’s father, John, learn that among pages of legalese his daughter scrolled through before clicking “accept”, was a sweeping waiver of her privacy rights.
VeriFLY’s terms and conditions require users to consent to “unrestricted, unconditional, unlimited, worldwide, irrevocable, perpetual, transferable and cost-free right and license” to do anything it wants with the material submitted by the app’s users.
“I think it’s shocking,” Mr. Fichthorn said. “Why would I give a for-profit business perpetual lifetime rights to my personal information to use in any manner they feel like, including social media?”
VeriFLY, which has been downloaded tens of thousands of times, partners with American, British Airways, Aer Lingus and other airlines, hotels and cruise ship operators. In an email, VeriFLY said travelers were not required to use the app and could submit their Covid information in person at the airport. Well yeah, American makes that abundantly clear and not in way that makes it seem to be the desirable choice.
On the other hand, download the app and the scope of the agreement raises troubling consumer rights and privacy questions at a time when federal lawmakers are pushing technology companies to make their terms and conditions more understandable to users.
In the case of VeriFLY the terms are “overbroad and terrible,” said Nancy Kim, a professor at Chicago-Kent College of Law who focuses on consent, contracts and privacy law. “I can’t think of a legitimate reason why providing this travel app requires these rights.”
VeriFLY is owned by the Ireland-based Daon which provides identity services and other travel-related IT in the field of biometrics and security.
Apps like VeriFLY let travelers know in advance what they must do to meet the covid-related entry requirements at their destination. That’s no small feat considering that the rules change from country to country and on an almost daily basis.
Like competing apps offered by airlines and the airline trade association, vaccination information remains on the traveler’s own device. Where VeriFLY differs from others is in its terms and conditions which appears to be part of a general trend to whittle away consumer rights, Ms. Kim said.
VeriFLY’s partnership with American means that had she not agreed to the terms and conditions, Daisy Fichthorn could not have checked in for her flight online. But a glitch in the program kept the app from working and she and her father stood in line at the airport anyway.
Airlines don’t like that any more than travelers do. As one airline industry insider explained to me, pre-certification apps help airlines move travelers through the system faster. With personnel shortages and more people flying, airports are no longer set up for people to check-in at an airline counter nor are the counters staffed to do so. That could be enough to encourage American to push its customers to VeriFLY. But could there be more? I can’t say and American and British Airways won’t say.
That didn’t sound like what the two privacy lawyers told me. They said it was definitely not standard verbiage. I went back to Mr. Aaron to clarify but he must have had enough of me by then because I haven’t heard back. American also wouldn’t say why it is encouraging its customers to surrender “unrestricted, unconditional, unlimited, worldwide, irrevocable, blah, blah, blah…” Nor would the spokeswoman opine on whether American thought such an agreement was in their customers’ best interests. The lack of response from everyone I tried to get information from makes me think I must be on to something but what?
Look, I tried, I really did, but I just can’t say what this partnership between travel companies and VeriFLY is all about. Either somebody at VeriFLY slapped some do-it-yourself Terms & Conditions to an otherwise principled operation and the whole thing is on the up and up or maybe something more intrusive is going on. When questions abound and no one wants to answer, that’s enough for Daisy and me to get nervous. And perhaps you should be too.
Happy Data Privacy Day to all.
Author of The New York Times bestseller, The Crash Detectives, I am also a journalist, public speaker and broadcaster specializing in aviation and travel.