Amadeus IT Group—Spain fined Amadeus IT Group a record EUR14.4M for profiling millions of airline passengers without legal basis
Spain's data protection authority (AEPD), acting as lead GDPR supervisory authority, fined Amadeus IT Group EUR14.4 million (reported as up to EUR18M including a prior 2022 Article 12 infringement) for building passenger profiles from tens of millions of airline booking records without a valid legal basis or adequate transparency, under a project Amadeus called a three-month statistical test but which the AEPD found had used data going back to 2019. Passengers were not informed their booking data was being reused for purposes unrelated to their original reservation, and at least one airline involved was reportedly unaware of the project. The fine was among the largest ever imposed on a B2B data processor under GDPR's one-stop-shop mechanism and is binding across the EU.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Corporate Transparency | -against | secondary | -0.50 |
| User Privacy | -against | primary | -1.00 |
| Overall incident score = | -0.725 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.64)
Evidence (2 signals)
Legal analysis: record EUR18M fine for Amadeus over GDPR violations from traveller data reuse
A GDPR legal analysis publication detailed Spain's AEPD decision fining Amadeus for reusing millions of travelers' booking records to build behavioral profiles without a valid legal basis, noting aggravating factors including scale, a prior 2022 Article 12 infringement, and Amadeus's sophistication as a routine large-scale data processor.
El Confidencial: AEPD hits Amadeus with record fine over passenger data collected for airline/hotel business
Spanish outlet El Confidencial reported the AEPD's record fine against Amadeus for collecting millions of passenger data points for a commercial profiling project with airlines and hotels, noting Amadeus's defense that the project was a limited three-month test was contradicted by AEPD evidence showing use of data dating back to 2019.