Spain’s data protection watchdog has imposed a record €18 million ($20.5 million) fine on travel technology giant Amadeus for the alleged misuse of passenger data in a traveler profiling project.
The penalty, issued by the Spanish Data Protection Agency (AEPD), is the largest ever handed down by the regulator. However, the amount was reduced by 20% to €14.4 million ($16.4 million) after Amadeus opted for an early payment settlement, while not admitting liability.
According to the AEPD, Amadeus used historical passenger booking information stored within its global distribution system (GDS) to support a pilot initiative known internally as the Traveler Centric Platform. The project was designed to assess the commercial potential of highly personalized travel recommendations and traveler profiling services for airlines, hotels and travel agencies.
Regulators found that the company processed personal data from millions of travelers without a sufficient legal basis and failed to adequately inform affected individuals about how their information was being used. The agency concluded that the practices breached key provisions of the European Union’s General Data Protection Regulation (GDPR), including requirements relating to lawful data processing and transparency.
The investigation was launched following an anonymous complaint filed in 2023. Authorities said the pilot project combined booking data from airlines and travel agencies with hotel customer information to create detailed traveler profiles based on reservation histories and travel behavior.
Amadeus has strongly disagreed with the regulator’s interpretation of the GDPR and said it plans to challenge the decision in court. The company argues the sanction is disproportionate and maintains that the project was conducted with appropriate safeguards.
The case is being closely watched across the travel sector, where airlines, hotels and technology providers are increasingly investing in personalization and customer data analytics. Privacy experts say the ruling sends a clear signal that travel companies must ensure robust legal grounds and full transparency.
