In the matter of the General Data Protection Regulation
DPC Complaint Reference:
IMI Reference:
In the matter of a complaint, lodged by with the Romanian National Supervisory
Authority for Personal Data Processing pursuant to Article 77 of the General Data Protection
Regulation, concerning Ryanair DAC
Record of Amicable Resolution of the complaint and its consequent withdrawal pursuant to
Section 109(3) of the Data Protection Act, 2018
Further to the requirements of EDPB Guidelines 06/2022 on the practical implementation of
amicable settlements Version 2.0 (adopted on 12 May 2022)
RECORD OF AMICABLE RESOLUTION FOR THE
PURPOSE OF EDPB GUIDELINES 06/2022 ON THE
PRACTICAL IMPLEMENTATION OF AMICABLE
SETTLEMENTS VERSION 2.0
(ADOPTED ON 12 MAY 2022)
Dated the 23rd day of December 2022
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
Background
1. On 14 September 2020, (“the Data Subject”) lodged a complaint pursuant to
Article 77 GDPR with the Romanian National Supervisory Authority for Personal Data
Processing (“the Recipient SA”) concerning Ryanair DAC (“the Respondent”).
2. In circumstances where the Data Protection Commission (“the DPC”) was deemed to be the
competent authority for the purpose of Article 56(1) GDPR, the Recipient SA transferred the
complaint to the DPC on 7 May 2021.
The Complaint
3. The details of the complaint were as follows:
a. The Data Subject first contacted the Respondent on 28 July 2020 via its app, raising
concerns with regard to the processing of certain travel documents, which occurred
while at the check-in counter of Ryanair at Otopeni airport in Bucharest. During the
interaction with staff at the airport, the Data Subject asserts that photographs were
taken of their travel documents, and sent to the Respondent’s immigration
department without prior consent. The Data Subject considered that there was no
lawful basis for the processing of their personal data in this manner, and asserted that
they were not provided with any information on the processing.
b. The Data Subject first raised their concerns with the Respondent on 28 July 2020,
though after receiving no response from the Respondent, the Data Subject then
contacted the Recipient SA on 14 September 2020, to raise the issue further.
c. Following the complaint to the Recipient SA, the Recipient SA provided the Data
Subject with the relevant contact details to raise the request with the DPO of the
Respondent. The Data Subject therefore contacted the Respondent on 25 November
2020. The Respondent provided an initial response to the Data Subject on 23
December 2020, clarifying the factual background and providing the Data Subject with
information on the processing of their data. However, the Data Subject remained
dissatisfied, and thus reverted to the Recipient SA to further pursue their complaint.
d. In particular, the Data Subject noted that they did not consent to the processing of
their personal data, either verbally or in writing, and that the Respondent had
therefore violated Articles 6 and 7 of the GDPR. The Data Subject also reiterated the
assertion that they were not provided with sufficient information on the processing
of their data, and that this deemed the Respondent to be in violation of Article 13
GDPR. The Data Subject also raised the concern that the means of processing their
personal data were not secure.
Action taken by the DPC
4. The DPC, pursuant to Section 109(4) of the Data Protection Act, 2018 (“the 2018 Act”), is
required, as a preliminary matter, to assess the likelihood of the parties to the complaint
reaching, within a reasonable time, an amicable resolution of the subject-matter of the
complaint. Where the DPC considers that there is a reasonable likelihood of such an amicable
resolution being concluded between the parties, it is empowered, by Section 109(2) of the
2018 Act, to take such steps as it considers appropriate to arrange or facilitate such an
amicable resolution.
2
5. Following a preliminary examination of the material referred to it by the Recipient SA, the DPC
considered that there was a reasonable likelihood of the parties concerned reaching, within a
reasonable time, an amicable resolution of the subject matter of the complaint. The DPC’s
experience is that complaints of this nature are particularly suitable for amicable resolution in
circumstances where there is an obvious solution to the dispute, if the respondent is willing
to engage in the process. In this regard, the DPC had regard to:
a. The relationship between the Data Subject and Respondent (being, in this case, an
individual consumer and a service provider); and
b. The nature of the complaint (in this case, an assertion by the Data Subject that their
personal data had been processed in an unlawful manner).
6. While not relevant to the assessment that the DPC is required to carry out pursuant to Section
109(4) of the 2018 Act, the DPC also had regard to EDPB Guidelines 06/2022 on the practical
implementation of amicable settlements Version 2.0, adopted on 12 May 2022 (“Document
06/2022”), and considered that:
a. the possible conclusion of the complaint by way of amicable resolution would not
hamper the ability of the supervisory authorities to maintain the high level of
protection that the GDPR seeks to create; and that
b. such a conclusion, in this case, would likely carry advantages for the Data Subject,
whose rights under the GDPR would be vindicated swiftly, as well as for the controller,
who would be provided the opportunity to bring its behaviour into compliance with
the GDPR.
Amicable Resolution
7. The DPC engaged with both the Data Subject (via the Recipient SA) and Respondent in relation
to the subject matter of the complaint. Further to that engagement, the Respondent provided
the following information in respect of these concerns, as laid out in paragraph 3 above:
a. With regard to the concerns raised in relation to consent, the Respondent confirmed
that it did not rely on consent as a legal basis to process the relevant personal data,
and at no point in time did it purport that the processing of travel documentation
takes place based on consent. Rather, the Respondent noted that it processes travel
documents of its passengers who are seeking to board flights on the basis of Article
6(1)(f) GDPR (i.e. legitimate interests) and outlined the clear legitimate interest that
it had in ensuring that all passengers meet the entry requirements of the country of
destination. In limited cases (approx. 20 from 2500 flights per day), this would require
consultation with its specialist immigration team.
b. In respect of the concerns related to the information provided to the Data Subject,
the Respondent was of the view that the Data Subject had previously been provided
with sufficient information on the processing of their personal data, prior to its
collection. In this regard, the Respondent provided the relevant references to its
privacy policy, which was linked in each communication issued to the Data Subject.
The Respondent further noted that it’s General Terms and Conditions of Carriage also
clearly inform passengers that correct travel documentation must be presented
3
before boarding and that the Respondent would be permitted to take copies of these
documents.
c. With regard to the security of the processing, the Respondent confirmed that the
photos of the documents were taken on work issued mobile phones and transmitted
by email. The Respondent noted that only the minimum amount of data necessary
was collected and transmitted to the immigration team and confirmed that the
supervisor in question erased the copies of the personal data from their device and
email account immediately thereafter, as per the established procedures of the
Respondent. The DPC was provided with a copy of the Respondent’s documented
procedures in this regard. The Respondent further confirmed that it had circulated a
reminder memo to all ground handling staff in all airports with which it had a
relationship to remind supervisors of the procedure in place for dealing with
passenger documents and sending requests to its immigration support team.
8. The DPC provided this information to the Data Subject via the Recipient SA on 03 December
2021. However, the Data Subject responded to the content of this letter on 9 February 2022,
to raise a concern with regard to one of the discrete issues raised in the complaint. Specifically,
the Data Subject believed that the Respondent had processed the relevant personal data
without implementing appropriate technical and organisational measures to ensure a level of
security appropriate to the risk.
9. The DPC thus engaged in further correspondence with the Respondent in relation to this issue,
and provided the comments of the Data Subject to the Respondent on 31 March 2022, with
the aim of bringing about an amicable resolution to the complaint. In its response, the
Respondent provided further clarity on the issues raised by the Data Subject in their
complaint. In particular, the Respondent confirmed that the relevant emails were only sent to
the immigration team from pre-approved email accounts operated by supervisors. Further, all
data transmitted from the email addresses in question was encrypted using TLS and the
Microsoft mail system used was configured to use TLS by default. The Respondent further
confirmed that all the emails received by its immigration support team are stored within the
relevant Exchange mailbox used by that team, access to which is governed by active directory
authentication employing multi-factor authentication technology to prevent unauthorised
access. The Respondent further confirmed to the DPC that it was unaware of any occurrence,
including in the present case, in which immigration data had been breached in transit or sent
to an unintended recipient.
10. The DPC’s letter outlining the information provided by the Respondent issued to the Data
Subject on 5 July 2022 via the Recipient SA. The DPC requested that the Data Subject notify it,
within a specified timeframe, if they were not satisfied with the information provided in
relation to their complaint and wished to further pursue the matter. On 14 September 2022,
the Recipient SA confirmed that no response had been received from the Data Subject.
11. On 10 October 2022 and in light of the foregoing, the DPC wrote to the Recipient SA noting
that the DPC considered the complaint to have been amicably resolved and withdrawn in
accordance with section 109(3) of the Act and that it would conclude the case and inform the
Respondent.
12. In circumstances where the subject matter of the complaint has been amicably resolved, in
full, the complaint, by virtue of Section 109(3) of the 2018 Act, is deemed to have been
withdrawn by the Data Subject.
4
Confirmation of Outcome
13. For the purpose of Document 06/2022, the DPC confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties
concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
c. Having consulted with the supervisory authorities concerned on the information set
out above, as required by Document 06/2022 the DPC has now closed off its file in
this matter.
14. If dissatisfied with the outcome recorded herein, the parties have the right to an effective
remedy by way of an application for judicial review, by the Irish High Court, of the process
applied by the DPC in the context of the within complaint.
Signed for and on behalf of the DPC:
_____________________________
Deputy Commissioner
Data Protection Commission
5