Ryanair flight booking practices catch eye of EU privacy watchdog

Ireland's Data Protection Commission (DPC), the European Union’s top data privacy regulator, launched an inquiry into Ryanair’s use of customer biometrics.

Europe’s major low-cost airline Ryanair has a case under its name in the DPC offices. The privacy watchdog said it had received multiple complaints about the company requesting additional ID verification from customers who book flights via third-party vendors.

The inquiry will focus on whether the company’s Customer Verification Process is in line with the EU's General Data Protection Regulation (GDPR), arguably the toughest privacy and security law in the world. The key issue is the carrier’s use of facial recognition tech.

“The verification methods used by Ryanair included the use of facial recognition technology using customers’ biometric data. This inquiry will consider whether Ryanair’s use of its verification methods complies with the GDPR,” Graham Doyle, Deputy Commissioner with the DPC, said.

On its website, Ryanair says that the additional verification is necessary because “third-party travel agents often do not provide Ryanair with the passenger’s correct email address and payment details.”

Reacting to the DPCs inquiry, the company said it welcomes the privacy watchdog's move, adding that Ryanair's verification process is fully in line with GDPR.

“We welcome this DPC inquiry into our Booking Verification process, which protects customers from those few remaining non-approved OTAs, who provide fake customer contact and payment details to cover up the fact that they are overcharging and scamming consumers,” the company said.

Ireland-headquartered Ryanair is Europe’s largest airline in terms of passengers, with 184 million reported in its latest annual report. The company employs over 27,000 staff and recently reported revenue exceeding $13 billion.

Updated on October 4th [02:50 p.m. GMT] with a statement from Ryanair.