Ryanair, the budget airline, is in hot water as the Irish data protection watchdog challenges the company’s processing of personal data for booking flights.

The inquiry, launched by the Irish Data Protection Commissions (DPC), will investigate Ryanair’s requirement of supplemental ID verification of customers who book through third-party websites or online travel agents, as well as what happens to this data, which is often biometric.

“The DPC has received numerous complaints from Ryanair customers across the EU/EEA who after booking their flights were subsequently required to undergo a verification process,” Graham Doyle, deputy commissioner of the DPC, said.

“The verification methods used by Ryanair included the use of facial recognition technology using customers’ biometric data. This inquiry will consider whether Ryanair’s use of its verification methods complies with the GDPR.”

The inquiry will not delve into if the process itself is permittable, but if it follows GDPR guidelines to protect personal data. Multiple EU states will be involved in the probe.

Ryanair has longstanding issues with unauthorised third-party websites that sell the its tickets, which cause the airline to implement the Customer Verification Process in the first place.

This process requires ticket purchasers to complete and ID check to confirm their tickets with the airlines, which could jeopardise the purchase made on third-party sites.

Recommended reading

• Demystifying GDPR & AI: Safeguarding Personal Data in the Age of LLMs
• Meta Delays AI Training in Europe Following Regulatory Concern
• X’s Default Data Harvesting for AI Model Under Regulatory Scrutiny

“We welcome this DPC inquiry into our Booking Verification process, which protects customers from those few remaining non-approved OTAs, who provide fake customer contact and payment details to cover up the fact that they are overcharging and scamming consumers,” a Ryanair spokesperson said, as reported by The Register.

“Customers who book through these unauthorized OTAs are required to complete a simple verification process (either biometric or a digital verification form) both of which fully comply with GDPR.

“This verification ensures that these passengers make the necessary security declarations and receive directly all safety and regulatory protocols required when travelling, as legally required.”