I used to work for an airline that used Amadeus and was fairly familiar with it. Every booking agent had access to a terminal connection to the mainframe (similar to ssh or telnet). Everyone had unique login credentials and every action can be tracked through the booking history.

Here are a few notes:

- Credit card numbers are obfuscated right after they are first used. Only certain back offices have unrestricted access.

- Viewing all the travel information in the PNR is important. For example, if a flight is arriving late, it can be useful to know that the passenger has a connecting flight with another airline on the same ticket to arrange for another connecting flight.

- Reservations are archived after a certain amount of days after the last flight. They can be retrieved in view only mode but you have to specify a date range.

- Most tickets and vouchers are non-transferable (at least for the airline I worked for) . Even changing a name on a reservation is a pain. You either have to make a new booking and re-issue the ticket or get a support desk to change the name on the current reservation and re-issue the ticket. A regular agent changing more than 3 letters of a name will result in a cancelled itinerary.

- It is possible to enter restricted comments on a PNR. You can even set who can view them. Agency only, Airline only even a specific office.

I get that he was saying that the system is unsafe but a lot of it is only in relation to the web interfaces. You can't get direct GDS access unless you're working directly for an airline or travel agency. Those people definitely need to see most of the information on the record.

Anyways, just thought I would provide some info.