Qantas
One booking becomes several files: the seller, the carrier, the booking system behind them, and the border authorities of every country on your route. The file outlasts the trip by years, mostly on the companies' own judgement of what is necessary.
Reported incidents
Regulator ends inquiries into its 2025 breach without an investigation
2026-07-16Affected Overseas contact centre records
Australia's Privacy Commissioner said on 16 July 2026 that preliminary inquiries into Qantas's 2025 data breach had not shown that it likely broke privacy law, and that no full investigation would follow. Attackers had used social engineering on an overseas contact centre provider working for Qantas. In July 2025 Qantas said 5.7 million people's records were taken: 2.8 million with names, email addresses and frequent flyer numbers, and 1.7 million with added details such as home addresses, dates of birth and phone numbers. Qantas said credit cards and passport details were not taken. The regulator gave the number of Australians affected as about 5 million.
People affected typically ask Qantas to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.