## Facts

- American Airlines collected passengers’ personally identifiable information during ticketing, including names, addresses, and credit-card numbers.
- American provided the information to Airline Automation, Inc. to transmit passenger data to the Transportation Security Administration for security-screening purposes.
- Airline Automation also transmitted passengers’ personal information to four private research companies.
- The research companies used the data for research unrelated to security screening.
- Passengers filed a putative class action alleging unauthorized disclosure of their personal information.
- Plaintiffs asserted claims under the Electronic Communications Privacy Act (including the Stored Communications Act), state-law privacy tort theories, and breach of contract based on alleged privacy promises in the ticketing relationship.
- Defendants (American, Airline Automation, and the research companies) moved for summary judgment on all claims.

## Issues

1. Whether defendants’ collection, transmission, and disclosure of passenger data to research companies created liability under the ECPA/Stored Communications Act.
2. Whether the Airline Deregulation Act preempted state-law privacy and contract claims challenging airline data practices connected to ticketing and security-related services.
3. Whether plaintiffs could satisfy essential elements of state-law privacy torts (including any requirement of broad “publicity” and offensiveness) based on disclosure to a limited set of recipients.
4. Whether plaintiffs showed a legally cognizable injury or compensable damages sufficient to proceed on privacy and contract theories.

## Decision

- The court granted summary judgment for defendants in substantial part, disposing of plaintiffs’ federal and state claims.
- The ECPA/Stored Communications Act claims failed as a matter of law on the record presented.
- Many state-law claims were held preempted by the Airline Deregulation Act because they related to airline services such as ticketing, reservations, and security-related data handling.
- To the extent any state-law or contract theories were not preempted, the court concluded plaintiffs failed to establish required elements or compensable damages and granted summary judgment.

## Legal Principles

- ECPA/Stored Communications Act liability requires satisfaction of statutory coverage and elements; commercial handling of customer identifying information may fall outside the statute’s actionable prohibitions on the facts presented.
- The Airline Deregulation Act preempts state laws (including tort and contract rules as applied) that relate to an air carrier’s prices, routes, or services; services may include ticketing, reservations, and security-related processes.
- Common-law privacy torts often require more than limited disclosure to a small number of entities and may require proof of “publicity,” offensiveness, causation, and non-speculative harm.
- Contract-based privacy claims generally require enforceable contractual terms and proof of compensable damages; speculative privacy fears without concrete misuse may be insufficient.

## Conclusion

The court entered summary judgment largely for the airline, its data-processing vendor, and the recipient research firms, rejecting federal ECPA liability and holding that state privacy and contract challenges to airline data-sharing tied to ticketing and security services were largely preempted or unsupported by required elements and damages.


In re Am. Airlines, Inc. Priv. Litig., 370 F. Supp. 2d 552 (N.D. Tex. 2005)