NOYB, a digital rights group led by Austrian privacy activist Max Schrems, has filed a complaint against Ryanair, Europe’s largest airline by passenger numbers, alleging violations of customers’ data protection rights. The complaint, filed with Spain’s data protection agency, focuses on Ryanair’s use of facial recognition to verify the identity of customers booking through online travel agents.
Ryanair claims that it must use facial recognition for verification due to safety and security requirements since online travel agents often do not provide the airline with customers’ contact and payment details. However, passengers have the option to avoid facial recognition verification by arriving at the airport at least two hours before departure or by submitting a form and picture of their passport or national ID card in advance.
NOYB argues that there is no reasonable justification for Ryanair to implement this facial recognition system and claims that it violates customers’ data protection rights. The group believes that Ryanair is willing to compromise customers’ data protection to gain an unfair competitive advantage over other booking channels.
Organization alleges that Ryanair’s verification procedures are not valid under the GDPR
Ryanair, in response, asserts that both its biometric and non-biometric verification processes fully comply with all regulations under the General Data Protection Regulation (GDPR), introduced in 2018. The airline argues that the customer verification process is necessary to protect customers from potential issues caused by online travel agents providing incorrect information or payment details.
NOYB has a track record of successfully launching privacy challenges against large multinational companies across the European Union under the GDPR. The organization alleges that Ryanair’s verification procedures are not valid under the GDPR because the airline fails to provide comprehensible information about the purpose of the facial recognition process.
The complaint against Ryanair marks another instance of the ongoing tension between data privacy concerns and technological advancements in the travel industry.
