Amadeus IT Group, S.A. – €18,000,000 Fine (Spain, 2026)

The DPA initiated proceedings against Amadeus IT Group, S.A., the controller, after receiving an anonymous complaint alleging the unlawful use of travel booking data for profiling. The controller operated a Global Distribution System (GDS), a B2B reservation system used by airlines, hotels and travel agencies. The complaint alleged that personal data of travellers worldwide had been consolidated in a data platform and used to create travel histories and profiles, without consent and without adequate information being provided to the travellers. During the investigation, the DPA found that the controller had used Passenger Name Record (PNR) data from its GDS for a pilot project. The DPA considered that, for data obtained from hotel chains, the controller acted as processor, while for its own GDS PNR data it acted as controller. The relevant data had originally been collected for travel reservations, but was later used to test the feasibility of developing a new product. The controller stated that the pilot was never commercialised and was later discarded, including for data protection reasons. It also claimed that the processing of its own GDS data was based on legitimate interest and that information on the processing was available in its privacy policy. The DPA held that the controller violated Article 14 GDPR. Since the data had not been obtained directly from the data subjects and was later used for a different purpose, the controller had to provide information about that further purpose before the processing took place. The DPA found that a general reference in a website privacy notice was insufficient to meet this obligation, especially because the GDS service was B2B and the controller had no direct relationship with the end travellers. Data subjects could not reasonably be expected to know that travel reservation data would later be used by a company with which they had no direct relationship to test a new product. The DPA also held that the controller violated Article 6 GDPR. The controller could not rely on legitimate interest because the processing concerned PNR data collected for reservations and used years later for a pilot project. The DPA considered that the data subjects had no reasonable expectation that their data would be reused in this way. The DPA also found no evidence of consent, contractual necessity, legal obligation, vital interest, public interest task, or any other valid legal basis. The DPA further noted that Regulation (EC) 80/2009 requires identifiable individual reservation data under the control of a system vendor to be made inaccessible online no later than 72 hours after the last element of the reservation and destroyed within three years, with access only allowed for billing disputes. Nevertheless, the controller used active and inactive PNR data from 2019 three years later for the pilot. For the infringement of Article 14 GDPR, the DPA imposed a fine of €9,000,000. For the infringement of Article 6 GDPR, it imposed another €9,000,000, resulting in a total fine of €18,000,000. The controller made a voluntary payment without admitting liability, which according to the Spanish Administrative Law (39/2015) reduced the fine by 20% to €14,400,000 and terminated the procedure. No additional corrective measure was imposed beyond the monetary sanction and the termination of the procedure by voluntary payment.