It has emerged that the U.S. Securities and Exchange Commission subscribed to a database containing more than 1 billion airline booking records worldwide, tracking personal travel information and sparking controversy. The data included names, payment information, origin and destination cities and flight numbers. The SEC also used an alert function that automatically checked new travel bookings by specific individuals.

On Aug. 6 local time, blockchain outlet Decrypt reported that the information used by the SEC was provided through the Airlines Reporting Corporation (ARC) Travel Intelligence Program.

ARC is jointly owned by American Airlines, Delta Air Lines and United Airlines, and handles payments and settlement between airlines and travel agencies. The program is also reported to have included and sold booking data made through online travel platforms such as Expedia and Kayak, as well as airline reservation information.

According to disclosed documents, the SEC's use of the information went beyond simple searches. It used a function that automatically matched a watchlist with new booking data. It also requested up to 25 alerts a day so it could check travel bookings made in the past 24 hours.

A particular point of controversy is that the SEC did not need a court order or a separate compulsory process to obtain the information. The possibility has been raised that, rather than demanding submissions directly, the agency may have accessed the data by purchasing information held by a private data broker.

The issue is expanding into a broader debate over the scope of information collection by financial regulators. The SEC's original role is to monitor insider trading, market manipulation and investment fraud. The data used this time could also track an individual's travel movements and payment information, not just financial activity.

Concerns are also being raised that for cryptocurrency users, it could become possible to conduct wide-ranging analysis of personal activity if payment methods linked to exchange accounts, records of attendance at blockchain-related events and overseas travel information are combined.

The controversy is drawing attention as it intersects with changes in the SEC's cryptocurrency enforcement direction after the launch of Trump’s second-term administration. The SEC appears to have eased direct regulatory enforcement against major cryptocurrency companies, but critics say its approach of obtaining information through private data businesses could still be used.

Critics call this a 'data broker loophole'. They argue that if government agencies can obtain information that is difficult to secure through legal procedures by buying data, it could effectively become a way to circumvent existing surveillance systems.

ARC's Travel Intelligence Program is known to have been provided to multiple government agencies, including the Federal Bureau of Investigation, the Internal Revenue Service and the Department of Homeland Security, as well as the SEC, until it ended in 2025. Disclosed documents showed the data included not only U.S. domestic flights but also international departure and arrival flights.

ARC explained that the program's purpose was crime prevention and strengthening national security. It said the service was created after the Sept. 11 attacks in 2001 and stressed it could be used to track money launderers and terrorism-related criminals. Preventing money laundering is one of the key issues that regulators have consistently flagged in the cryptocurrency industry.

This is not the first time the SEC has faced controversy over its use of data. In the past, allegations were raised during the Coinbase investigation that the SEC showed strong interest in securing user information.

With the disclosure of the documents, the focus of the debate is shifting beyond whether the SEC obtained the information to how it collected and used personal data. With financial regulators and investigative agencies able to combine travel and payment information through the private data market, personal-data protection issues are expected to be highlighted again for general users as well as cryptocurrency investors.