cross-posted from: https://links.hackliberty.org/post/125466
My credit card issuer apparently never gets to know what I purchased at stores, cafes, & restaurants -- and rightfully so. The statement just shows the shop name, location, and amount.
Exceptionally, if I purchase airfare the bank statement reveals disclosures:
- airline who sold the ticket
- carrier
- passenger name
- ticket number
- city pairs
So that’s a disturbing over-share. In some cases the airline is a European flag carrier, so IIUC the GDPR applies, correct? Doesn’t this violate the data minimization principle?
Airlines no longer accept cash, which is also quite disturbing (and illegal in jurisdictions where legal tender must be accepted when presented for PoS transactions).
Has anyone switched to using a travel agent just to be able to pay cash for airfare?
UPDATE
A relatively convincing theory has been suggested in this other cross-posted community:
https://links.hackliberty.org/comment/414338
Apparently it’s because credit cards offer travel insurance & airlines have incentive to have another insurer involved. Would be useful if this were documented somewhere in a less refutable form.
GDPR question still outstanding.
That’s been suggested in the parent thread and another crosspost. It’s the most popular answer but I don’t buy it.
Why would the airline risk the liability of excessive oversharing of personal data for no benefit in return? Is the bank giving them a reduced transaction fee for sharing that data?