A few weeks ago, somebody posted on my Mastodon feed a link to an old article from 404 Media called How to Opt-Out of Airlines Selling Your Travel Data to the Government (I'm sorry kind stranger, I probably boosted your message but forgot to bookmark it to give you credit here). The article explains that there is a data broker — the Airlines Reporting Corporation (ARC) — that sells flight data to multiple parts of the Department of Homeland Security (DHS) and a host of other government agencies.

I was curious, decided to follow the process described in the post, and e-mailed privacy@arccorp.com with the subject "Data deletion" and the body:

Hi,

I wish to delete my personal data held by ARC.

Thanks, Sergi

I got the following reply the next day, which was surprisingly fast:

We have received your recent request regarding the use of your personal information. We take your privacy seriously and are committed to complying with applicable data protection laws.

Next Steps

We will process your request as soon as possible and, in any event, within the timeframes required by law. In order to verify your identity, we need to know your full name, including middle name if applicable, as well as the last four digits of any and all credit card number(s) that you used to purchase air travel. Please also provide your address of residence. Any information collected for verification will be used solely for this purpose, and we will promptly delete any such information once the verification process is complete. If we do not receive this information, we may not be able to process your request. You will receive confirmation once your request has been fulfilled, along with information about any further actions, if necessary.

Additional Information

If your request relates to specific types of data or processing (e.g., direct marketing, profiling, or third-party sharing), please specify so we can address your request accurately. There may be certain legal exceptions where we are required to retain or process some information, such as to comply with legal obligations. If this applies, we will inform you accordingly.

If you have any further questions or would like to clarify your request, please reply to this message. Thank you for reaching out regarding your privacy rights.

Best, ARC Privacy

Providing all this data felt a bit scary, but I guess they need to know who you are to know what to delete. So I replied with my name and last name, four last digits of a couple of credit cards, and my address. Then, I waited. Twelve days later — and probably would have been sooner if Thanksgiving wasn't during that time — I got this:

We have received your request regarding the retention, use, and/or deletion of your personal information. We take your privacy seriously and are committed to complying with applicable data protection laws. We have repeatedly searched our files and are unable to locate any of your personal information in our system. Any information you provided for verification will not be used for any other purposes and will be deleted.

If you have any further questions or concerns, please reply to this message.

Best, ARC Privacy

Which was not what was I was expecting. If that's true, I guess it's good news. But I wonder if they botched the search — having two last names separated with a space causes data input errors too frequently in the US — and that's why they couldn't find my data.

If you give it a try and get a different outcome, I'm curious to hear out!