The answer, in the USA, is no. There are no legal restrictions at all. In the US, travel information and other personal information provided in the course of commercial transactions is considered the property of the company, not the propoerty of the “data subject”. Unless there is an explicit provision to the contrary in your contract, US law assumes that when you provide information, you intend to give the compayy all rights to use, sell, retain or transfer it, in perpetuity, without further notice, consent, or compensation to you. If this isn’t what you mean to do, make sure that the contract spells out something different (keeping in mind that most privacy policies are not part of the contract).

In practice, CRS’s and travel compnaies can’t tell where the data in their reservation recrods was collected, or which countries privacy and data protection laws apply to it. There is no field in a PNR to indicate in which jurisdiction the data was collected. So CRSs should be required to apply the highest standards to their entire database. But they don’t. Typically, they assume that all the data in their reservations for flights, hotels, etc. in the the US were made in the US, and subject only to US law — even though people in the EU, Canada, and other countries around the world make reservations, through offices and travel agencies in their countries, for US travel. The problems is that authorities in Canada, EU members, and other countries have failed to enforce their laws against outsourcing and offshoring personal data to companies in the US that don’t protect it in accordance with the legal obligations of compnaies in those countries where it was collected.