The Airlines Reporting Corporation (ARC), in which Lufthansa also holds a stake, collects extensive data on air travelers and sells this information to U.S. authorities, including Immigration and Customs Enforcement (ICE). According to publicly released procurement documents, the ARC offers software called the Travel Intelligence Program (TIP) that allows authorities to centrally search a database containing 12 billion passenger flight records per year. ICE praises the ARC as a central hub for financial processing and data exchange in the aviation industry, offering "unmatched insights and analytics" with its comprehensive data.
The primary function of the ARC is to accredit travel agencies and manage financial transactions between them and over 240 airlines worldwide. US travel agencies are required to submit their ticket sales and funds to the ARC daily. They also submit weekly reports containing copies of all issued tickets, including price details and payment method. This activity creates a comprehensive, real-time database of airline tickets sold. The TIP program allows authorized law enforcement and security officials to search this database for travel patterns of persons of interest. Searches can be conducted using various criteria, such as name, itinerary, and payment method. The registry contains over one billion records with up to 39 months of past and future travel data.
In addition to ICE, the Department of Homeland Security, the Department of Defense, and the Department of the Treasury also use TIP. Data and consumer protection organizations are concerned about this massive registry and the associated access possibilities. US civil rights activist Edward Hasbrouck describes the ARC as a virtual monopoly on processing flight bookings in the US. Bill McGee of the consumer protection organization American Economic Liberties Project calls the sale of personal information to the US government "appalling." A spokesperson for the ARC explained that TIP was set up after the terrorist attacks of September 11 to assist investigators. It is still unclear whether governments in other countries also have access to this data and to what extent the practices are compatible with the European General Data Protection Regulation (GDPR), if data from EU citizens is also collected. Airlines and travel agencies generally do not explicitly inform their customers about this data transfer.
and 