From: Edward Hasbrouck <edward@hasbrouck.org> 
Sent: 3 April 2007
To: Klaas Bruin <klaas.bruin@klm.com
Subject: Request for personal data

Mr. Klaas J. Bruin
Privacy Officer
KLM Royal Dutch Airlines
Corporate Privacy Office (AMS/PI)
P.O. Box 7700, 1117 Schipol
The Netherlands

Dear Mr. Bruin,

Thank you for introducing yourself at the European Parliament hearing on
PNR transfers to the EU.  As I mentioned, I travelled on KLM from my
home in San Francisco to the hearing in Brussels, so I have the
opportunity to learn more about KLM's practices in handling my own
travel data.

If you are not the "data controller", please forward this request to the
correct person at KLM, and please tell me who that person is.

The undersigned, Edward Hasbrouck, a citizen of the USA residing at 1130
Treat Ave., San Francisco, CA 94110, USA, files this request with your
company pursuant to the Personal Data Protection Act of the Netherlands
and article 12 of the European Data Protection Directive 95/46/EC.

I request that you provide me with all of the information to which I am
entitled pursuant to that Act and that Directive, including all of my
personal data, the details of all processing of my data (including the
purposes of the processing), and all recipients of my data.

In accordance with the European Data Protection Directive, I also
specifically request that you inform me whether any of my personal data
have been transferred outside of the territory of the European Union, in
whatever form or by whatever means, whether to governmental or
commercial or other entities, and if so exactly which data, when, to
whom, for what purposes or programs such as the USA's "Automated
Targeting System (ATS) or "Advance Passenger Information System" (APIS),
and subject to what enforceable contractual commitments from the
recipient, including to which agency or agencies of the government of
the United States of America and to which commercial entity or entities
in the USA or other countries, including PNR hosting services (such as
computerized reservation systems or global distribution systems), PNR
processing services (such as the Amadeus Revenue Integrity division,
formerly Airline Automation, Inc.), travel transaction and customer data
aggregation and analysis services (such as the Vistrio joint venture of
Sabre and Equitec), and code-sharing "partners" including Northwest
Airlines  

I also request that you inform me of your policies for use, access,
retention, and destruction of this data, and those of any recipients of
this data, particularly those outside the European Union.

If you subscribe to a computerized reservations system (CRS), I request
in accordance with Article 9a(1)(d) of the EU Code of Conduct for CRS's
(Council Regulation No 2299/89 of 24 July 1989, as amended), that you
inform me of the name and address of the CRS system vendor, the purposes
of the processing, the duration of the retention of individual data and
the means available to the data subject of exercising her or his access
rights.

This request includes all personal data processed by you of which I am
the data subject, including but not limited to:

1. Passenger name records (PNR's)

2. PNR histories

3. Cancelled PNR's and their histories

4. System logs of access to these PNR's and PNR histories

5. Departure control system records and access logs

6. Advance Passenger Information (API) records and logs

7. AIRIMP, EDIFACT, or other message records

8. Ticketing records

9. Bank Settlement Plan (BSP), interline, or other settlement records

10. Financial and billing records

11. Frequent flyer account records

12. Customer, Web user, or traveller records or profiles

13. Web site visitor, usage, and query records and logs

This request includes, but is not limited to, personal data pertaining
to my journeys as follows:

KL 606 24MAR2007  SFOAMS
ARNK
KL1722 28MAR2007 BRUAMS
KL 605 28MAR2007 AMSSFO

My "Worldperks" frequent flyer number account number is 380562313.

Please note that, should you not answer this request within the legally
required maximum, or should your answer fail to fully answer my request,
I reserve the right to bring the case before the competent judicial
authorities, and/or to inform the Dutch Data Protection Authority of
your failure to answer.  

Should you have any questions or require further information from me to
expedite your response to this request, please contact me by e-mail or
by phone at +1-415-824-0214.

Sincerely,

Edward Hasbrouck
San Francisco, CA, USA
3 April 2007

----------------
Edward Hasbrouck
<edward@hasbrouck.org>
<http://hasbrouck.org>
+1-415-824-0214

"The Practical Nomad: How to Travel Around the World"
(3rd edition, 2004, 4th edition forthcoming 2007)
"The Practical Nomad Guide to the Online Travel Marketplace"
<http://www.practicalnomad.com>