Data Privacy: How American Express Global Business Travel Keeps Your Personal Information Private

From the United States (US) to the European Union (EU), different destinations have unique data privacy regulations to protect personal information. Your travel management partner’s data protection should comply with these rules, as well as keep up to date as they develop. With new technologies constantly emerging and public interest growing, service providers have to make sure they’re doing all they can to keep personal information private. American Express Global Business Travel (Amex GBT) is at the forefront of maintaining your privacy, limiting data loss, as well as keeping your travelers and company’s information secure.

Let’s take a quick look at the global privacy events that have happened recently.

EU AI Act

In May, we saw the AI Act approved by the EU to develop and integrate safe artificial intelligence systems across the single market. The Act aims to respect EU residents’ rights following a risk-based approach.

Personal Information Protection Law in China

In September, the Guide for Sensitive Personal Information Identification was finalized and introduced by the Chinese National Information Security Standardization Technical Committee. This follows the introduction of China’s first data protection law, the Personal Information Protection Law, in November 2021.

Asia-Pacific regulations

Outside of China, several countries have introduced data privacy laws. These include:

• Singapore’s Personal Data Protection Act.
• South Korea’s Personal Information Protection
• Japan’s Act on the Protection of Personal Information.
• Vietnam’s Personal Data Protection Decree.
• Malaysia’s Personal Data Protection Act.
• Indonesia’s Personal Data Protection Law.
• Thailand’s Personal Data Protection Act.

US state laws

Similar to the above, the US has a range of privacy laws across several states that went into force in 2024. These include:

• Florida Digital Bill of Rights, primarily targeting big tech companies.
• Oregon Consumer Data Privacy.
• Texas Data Privacy and Security Act.
• Montana Consumer Data Privacy
• California Consumer Privacy Act.
• Amendments to the Colorado Privacy Act.

Data privacy at Amex GBT

Whether you’re flying to the US or boarding the train across Europe, business travel runs on personal information. Without it, your travelers’ trips would fail to take flight.

Any company that deals with data collection or data retention is open to certain security vulnerabilities. That’s why at Amex GBT, every solution we offer has been thoroughly tested to protect your data while complying with relevant regulatory requirements.

Privacy as priority number 1

Maintaining industry-leading privacy risk management is an endeavor that reaches all parts of Amex GBT. To head our comprehensive program, we have a chief privacy officer, supported by a global team, who provides:

• Supplier oversight.
• Data privacy impact assessments.
• Data minimization techniques.
• Data incident reporting and investigation.

Privacy is in our DNA

Privacy protection at Amex GBT is built upon three pillars that offer strong, safe, and secure data management. These are:

• Dedicated data protection resources: Managed by our Global Privacy Office and Chief Information Security Office.
• Protection in policy and practice: Compliance with Federal Financial Institutions Examination Council guidelines and the EU Data Protection Regulation model accountability program. As well as third-party oversight with privacy and compliance by design throughout product development.
• Sophisticated technical controls: A proprietary network for personal data, with industry-leading firewall and virus protection, monitoring and alert systems, as well as authentication requirements to further enhance our data security programs.

As a result of these protections, Amex GBT has been recognized as one of the most trusted companies for privacy in the travel management industry since 2005.¹

Binding Corporate Rules

Amex GBT also operates under our EU and UK-approved Binding Corporate Rules, the only travel management solution to do so. These policies ensure that the same level of protection is maintained for all intra-company transfers. The 10 Data Protection and Privacy Principles are managed by the Global Privacy Team and the Chief Information Security Office. These data security professionals are essential in proactively preventing unauthorized access while maintaining an appropriate amount of data portability.

AI at Amex GBT

AI is almost certain to remain an integral part of our daily lives. This is especially true for travel management. At Amex GBT, the protection of personal data is at the top of our priorities. As a result, in 2024 we launched an initiative to drive AI innovation and governance. This team is tasked with exploring AI technologies that could be used across the business, working with privacy, legal, and cybersecurity teams to find the right solutions while mitigating any potential risks.

Cybersecurity

Cyberattacks pose a threat to any company that stores personal information, particularly sensitive data. Defending this information – in all its forms – is critical to Amex GBT’s Cybersecurity Governance Program. Building on the principles from the US National Institute of Standards & Technology, the program protects our software by preparing and preventing attacks before they even happen. Amex GBT’s Bank Holding Company Act status means we’re subject to higher security standards from the Federal Financial Institutions Examination Council guidelines. Defending your privacy takes many forms across our software including:

• Penetration testing.
• Configuration and patch management.
• 24/7 real-time monitoring, analysis, and alerting.
• Real-time attack termination.

Travel safer with the right partner

Amex GBT is committed to making sure that your personal information stays private. From updating services with the latest global regulation changes to robust integral security design, you can travel happy knowing we’ve got you covered.

But why wait for the unexpected to happen? Stay prepared and contact us today to see how Amex GBT can keep your company’s private data private.

¹TRUSTe and the Ponemon Institute.