Record €18m fine for an IT service provider to the aviation sector – reuse of customer data
Spain’s data protection agency, the Agencia Española de Protección de Datos ( AEPD ), has fined Amadeus IT Group, S.A. ( Amadeus ) €18 million in relation to a traveller profiling pilot project. The enforcement decision, published in May 2026, has found breaches of Article 14 and Article 6 REGULATION (EU) 2016/679 ( GDPR ). Amadeus has made a €14.4 million voluntary payment, representing a 20% reduction from the proposed total fine, and has stated that they intend to appeal the ruling. Background Amadeus is a major Global Distribution System ( GDS ) provider and is one of the largest travel booking networks used by airlines and travel agencies, responsible for processing the personal data of millions of individuals for bookings in the travel industry. Following an anonymous complaint on 26 September 2023, the AEPD initiated proceedings against Amadeus to investigate possible GDPR breaches in relation to a pilot scheme called ‘PLATAFORMA.1’ (the