From: Edward Hasbrouck <edward@hasbrouck.org>
To: Joan Gabel <jogabel@airfrance.fr>
Subject: Re: request for access to personal data
Date: Wed, 25 Mar 2009 13:33:34 -0700

Thank you for your message, and for sending it by e-mail.

As I had already advised the "Direction Juridique" of Air France by fax 
yesterday (see attached copy), I am leaving for Europe tonight, so I won't 
receive any physical deliveries until after my return April 12th.

With respect to the specifics in your letter, the only reason I was forced 
to send my request to the general address for Air France's head office was 
that Air France failed to provide any more precise contact address (and, 
in fact, failed to provide any contact information or notice of data 
subjects' rights under French data protection law).  I believe this 
illustrates exactly why French law requires you to designate a point of 
contact for such requests.  I trust that, having seen the problems you 
have caused yourselves by failing to provide the required notice of a 
responsible person or department, and a means to contact them, you will 
forthwith have a notice such added to your English-language Web sites.  

I did everything possible to direct my letter to the appropriate office: I 
noted on the envelope "Attn: Data Controller", and I headed the letter in 
boldface, in French, "Demande de droit d’accès aux informations" above the 
English "Subject: Request for access to personal data".

After receiving no reply to my *written* request within the time limit set 
by law, I have already made plans to alter my next European trip (at 
considerable expense in time and money) so as to pass through Paris for a 
day in order to exercise my right to access your records in the only other 
remaining manner, *sur place* (in person) at your offices, as is my right.

As I have already advised the "Direction Juridique", in order to ensure 
that they have ample forewarning and ample (further) time to have all my 
data, and a full explanation of it, available for inspection and copying, 
I will be at their office either Thursday or Friday, April 2nd or 3rd.

I have asked the "Direction Juridique", to provide me with their exact 
location (as I'm sure you know, Air France's headquarters at that address 
at CDG Airport is a large complex of buildings), and the hours they are 
open and that the responsible person(s) will be available on those days.

Anything you can do in getting me the necessary information to enable me 
to exercise my rights next week "sur place" would be much appreciated.

I particular, I would appreciate your assistance in identifying the 
building and/or rooom number, the hours of operation of that office on 
those dates, and if at all possible a contact name, direct phone number, 
and e-mail address.  I would also appreciate any assistance you can 
provide in ensuring that your colleagues in Paris have a complete copy of 
all of your records pertaining to me, and a complete explanation of the 
meaning of that data, available for me at that place and time. 

I have also advised the French data protection authority, CNIL, of Air 
France's failure to response to my request as required by law.  It was 
only through the assistance of the CNIL, in response to my complaint  
against Air France, that I was referred to the "Direction Juridique" as 
the responsible section within Air France, or obtained their fax number.

I look forward to meeting with the "Direction Juridique" next week, and to 
reviewing and obtaining a copy of your complete dossier about me and a 
complete explanation of the meaning of the information in that dossier.

I would also be interested in what steps you and Air France are taking to 
bring Air France's English-language Web site directed at customers in the 
USA into compliance with French data protection law, which governs all 
operations of Air France worldwide as a French corporation.

Sincerely,

Edward Hasbrouck

Attachments:
  Documents\AF\AF-request.pdf
  Documents\AF\AF-request2.pdf