Amadeus IT Group

Spain's data protection authority (AEPD), acting as lead GDPR supervisory authority, fined Amadeus IT Group EUR14.4 million (reported as up to EUR18M including a prior 2022 Article 12 infringement) for building passenger profiles from tens of millions of airline booking records without a valid legal basis or adequate transparency, under a project Amadeus called a three-month statistical test but which the AEPD found had used data going back to 2019. Passengers were not informed their booking data was being reused for purposes unrelated to their original reservation, and at least one airline involved was reportedly unaware of the project. The fine was among the largest ever imposed on a B2B data processor under GDPR's one-stop-shop mechanism and is binding across the EU.