It think you'll find that on page 47 of subparagraph 4 of the t+c you agreed to 27 years ago when you first flew on AA (since amended twice daily), that the data in question is in fact property of AA.

In all seriousness, this is the crux of many of the issues on the internet: Data about you, or generated by your activities, is probably not your in a legal sense.

In other words AA gives users a limited license to access AA data, and they are mad that you are allowing TPG to use that license. AA sees this as sharing your Spotify password to give them access to music.

I'm just responding to the claim of the parent comment that public stuff on the internet should remain public... This information is expressly NOT public, not sure why the expectation is that everyone should be able to see it.