TSA Metastasizing?

Cory Doctorow's open letter to American Airlines about his recent experience with airport security at Heathrow is worth reading. Here's an excerpt:

The security officer then handed me a blank piece of paper and said, “Please write down the names and addresses of everyone you're staying with in the USA.” I actually began to write this out when I was brought up short. “Wait a second — since when does AA compile a written dossier on the names and addresses of my friends? Why are you asking me this? Do you have a privacy policy and a data-retention policy I can inspect prior to this?” The security officer told me that this was a Transport Security Agency (TSA) regulation. I asked for the name or number of the regulation, its text, and the details of the data-retention and privacy practices in place at AA UK. The security officer wasn't able to answer my questions, and she went to get her supervisor. After several minutes, her supervisor appeared and said, after introducing himself, “Sir, this is for your own protection.”

It's of course possible it's not really a TSA rule at all; although I wouldn't be a bit surprised if it's something special rolled out for the inauguration coronation.

Thing is, though, if they are doing this in the UK, they face a populace with actual rights:

Under the UK Data Protection Act, AA is required to be accountable for the personal information it collects from the public. On presentation of a nominal fee of ten pounds, AA is expected to provide a reasonable accounting of what information it has gathered from me and how it uses that information. I believe gathering these dossiers means that you incur this liability not only to me, but to all of my friends, too — in other words, if you require me to give you my friends' name and address, my friends also have the right to find out how you use that information. This explodes your data-retention liability, potentially by an order of magnitude.