Cybersecurity Policy Report, Watchdog Complains About European Airline’s Privacy Practices, (Dec 19, 2024)
The European Center for Digital Rights (NOYB) has filed a complaint with the Italian data protection authority, Garante, against Ryanair, a European regional airline group, alleging that the company violates customers’ rights to data protection in violation of the European Union’s General Data Protection Regulation (GDPR).
In order to book a flight on Ryanair’s website, customers must create mandatory accounts and submit to account authentication procedures that use biometrics, NOYB noted in a news release.
The mandatory accounts aren’t needed to book flights on other airlines, and Ryanair’s retention of customer data violates the GDPR’s data minimization principle, NOYB said.
For people who don’t want their biometric data processed, Ryanair requires a hand-written signature and a copy of the customers government ID. This, according to NOYB, creates an additional burden for customers refusing consent to use their biometric data, in violation of the consent requirements of the GDPR.
According to NOYB, the real purpose of the verification process is to “prevent online travel agencies from setting up accounts to buy and subsequently re-sell Ryanair flights on their websites.” Requiring customers to book their flights directly with Ryanair generates additional revenue for the airline from hotel bookings, insurance, and rental cars, NOYB asserted.
In addition to violating the principle of data minimization, NOYB alleges that the mandatory verification process violates the purpose limitation principle under the GDPR, and Ryanair fails to meet the consent requirements in accordance with articles 6 and 9 GDPR.
NOYB notes that based on Ryanair’s annual revenue of 10 billion euros ($10.3 billion), Garante could impose a fine of up to 431 million euros ($446 million).
News: DataPrivacy GDPR LitigationEnforcement