One side story. It is third party app that is not authorized by AA. Instead of get permission through a contract, the app developer scraped AA's data without AA's permission.
If it’s an app on apples App Store you do
If you then share confidential information with third parties your employer may (or may not) have a case.
It's not especially surprising airlines don't want unauthorised third party apps accessing and storing personal data from their intranets, even if the third party developer is very ethical about not leaking it to people without passwords and makes beautiful UX
Copyright etc could restrict copying information displayed on a website, but if someone can legally write down information via pen and paper they can see then they can scrape it. The process being automation doesn’t inherently matter.