TL;DR for the DPO
The point is not the travel sector: it is REUSE. Data collected to deliver a service, reused years later to build profiles and develop products. The charges are Art. 14 (notice when data does not come from the data subject) and Art. 6 (no valid basis: legitimate interest was invoked but never balanced).
The three points that matter
- 'Reasonable expectation' is the real test: someone booking a flight expects their data to serve the flight, not to feed a technology provider's product development years later. Once reuse leaves that expectation, legitimate interest does not hold.
- Article 14 is the forgotten one: when data arrives from another party in the chain rather than from the data subject, the notice is still due - and that is where almost everyone stops.
- The legitimate interest balancing must be DOCUMENTED beforehand, not reconstructed in defence. A written, dated and filed LIA is what separates a defensible position from an assertion.
What to do now, in practice
1) In the Art. 30 register, for each activity ask: is the data used ONLY for the stated purpose? Look especially at internal analytics, model training, product development and 'improvement' statistics; 2) where data comes from third parties, check the Art. 14 notice exists and was actually provided; 3) for every legitimate interest invoked, require a written LIA: purpose, necessity, balancing, mitigation; 4) beware historical data: an archive collected years ago does not become freely reusable with the passing of time.
Why it matters for your clients
Reuse for 'product improvement' is today the most frequent request reaching the DPO from marketing and development teams, often with the line 'it's data we already have'. Eighteen million is a clear answer: having it does not mean being able to use it for anything. And with the AI Act arriving, the same question will return as 'can we train a model on it?'.
Official source:Spanish Data Protection Agency - sanction against Amadeus IT Group S.A., published 26 May 2026Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
