Judge: Defunct airport fast pass company can't sell customer data

Computerworld - A federal judge in New York has issued an order banning the operator of a now-defunct registered air traveler program from selling any of the highly personal data it collected on tens of thousands of people who signed up for the program.

The order enjoins Verified Identity Pass Inc. (VIP) of New York from selling, transferring or disclosing to any third-party the data it collected while operating the Clear service, which was designed to help air travelers get through airport security checks faster. The service was one of seven approved by the Transportation Security Administration and had been available at 21 major airports, including New York's JFK and La Guardia, Boston's Logan and Atlanta's Hartsfield-Jackson airports.

VIP shut the program down abruptly with no notice on June 22 because of financial reasons. The move left about 260,000 customers wondering about the fate of data collected about them, including full names, Social Security numbers and biometric identifiers such as finger prints and iris scans. In a note on the company's Web site, VIP informed customers that their data would be protected in compliance with TSA's privacy and security standards. At the same time, it left open the possibility that it would sell the data to a third party if it were to be used specifically for a registered flyer program.

Yesterday's decision prohibits VIP from doing that. The judge noted that the Clear program's membership agreement expressly forbade VIP from selling the information to third parties. As a result, the court found an immediate need for "preliminary injunctive relief" preventing the transfer or disclosure of the information. The ruling noted the circumstances under which the program closed and said there was a risk of the data being disclosed because of a lack of accountability and oversight over how the data is stored.

The judge's ruling came in response to a motion filed as part of a class action lawsuit filed against VIP over its handling of the Clear program closure. The lawsuit seeks to force VIP to refund the money it collected from members who signed up for the program and to prevent the company from selling the data.

Todd Schneider an attorney with Schneider, Wallace, Cottrell, Brayton, Konecky, LLP, a San Francisco law firm representing one of the parties in the lawsuit, welcomed the ban. "They have some very valuable information," Schneider said. "When people agreed to give their personal information they didn't do it for the purpose of having it sold. They did it for the purpose of the preferred traveler program."

However, there is still a chance the order could be withdrawn over a protest filed by VIP's lawyers, Schneider warned. He said VIP's attorneys believe the judge signed the order without giving them a chance to weigh in.

Read more about privacy in Computerworld's Privacy Knowledge Center.