Aggregation of this type of public data (face recognition, license plates, cookies, etc) can absolutely create new privacy concerns. We should have privacy laws that protect us from this type of aggregation. Whether those laws should extend to plane transponder data comes down to the tradeoff between loss of privacy/security and transparency gains.
What I don't like is the argument that purely because some piece of information is "public", we should allow companies to aggregate and sell this data.