Record fine against Amadeus for illegal profiling of travelers

May 27th, 2026   Rédaction   No Comment   Technology    AEPD, Amadeus, amende, Espagne, RGPD    1539 views

The Spanish Data Protection Agency (AEPD) has taken a rather heavy-handed approach in the global technology sector, imposing the largest fine in its institutional history on Amadeus IT Group.

The Iberian regulator has officially fined the reservation systems giant €18 million for unlawfully exploiting the personal data of millions of international travelers as part of an internal pilot project conducted without a valid legal basis and without informing the individuals concerned at any point.

The ruling by the supervisory authority concludes unequivocally that the company violated two key articles of the General Data Protection Regulation (GDPR) by misusing confidential information stored in its Global Distribution System (GDS) to fuel a secret experimental program aimed at developing new predictive products for airlines, hotels, and travel agencies.

Amadeus’s underlying business objective was to create highly detailed traveler profiles by analyzing their flight history, preferred destinations, travel frequency, and precise spending habits.

According to confidential documents seized during the investigation by the AEPD (French Data Protection Authority), this technological project aimed to offer tourism operators « targeted and hyper-personalized » search functionalities thanks to an « in-depth understanding of the end customer. »

This record fine of €18 million is divided into two separate penalties of €9 million each: the first severely punishes the complete lack of a legal basis to legitimize such mass data processing, while the second stems directly from the blatant failure to inform users, who were never notified that their private travel data would be reused years later for purely marketing purposes, radically different from the initial booking.

The history of the pilot project reveals that it began as early as 2021 in close collaboration with two major hotel chains, whose brand names have been deliberately omitted from the official resolution; During these technical tests, Amadeus cross-referenced the hotels’ customer files with airline passenger name records (PNRs) to reconstruct complete and predictive travel histories.

The AEPD (Spanish Data Protection Authority) strongly emphasizes that historical databases dating back to 2019 were accessed for this purpose, which is particularly problematic under European law, which strictly limits the retention period for personal data and restricts access to it to very specific emergency situations.

This extensive regulatory investigation was launched following an anonymous complaint filed in 2023, alerting authorities to the global reach of this profiling system and its potential impact on billions of passenger records, including those of millions of Spanish citizens.

Although Amadeus ultimately decided to abandon the project after internally identifying critical risks to its customers’ privacy, the regulatory authority considers the mere fact of having developed and tested such a system to be a clear violation punishable by heavy financial penalties.

Under Spanish legal mechanisms, if the decision is ratified, the technology company will be eligible for a 20% discount through the advance payment scheme, reducing the bill to €14.4 million.

However, Amadeus maintains its categorical rejection of the AEPD’s findings and stated in an official press release that it « respectfully » contests the regulator’s interpretation, announcing its firm intention to appeal.