1(23)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY) final
decision, no. DI-2021-3397. Only the Swedish version of
the decision is deemed authentic.
Case number:
DI-2021-3397 Final decision pursuant to Article 60
Date of decision: under the General Data Protection
2025-06-30
Regulation – Flightradar24 AB
Decision of the Swedish Authority for Privacy
Protection (IMY)
IMY finds that Flightradar24 AB (company no. 556895-1213) has processed personal
data in violation of Articles 12(2) and 12(6) of the General Data Protection Regulation1
(GDPR) during the period 25 May 2018-22 June 2021 (the relevant period).
IMY gives Flightradar24 AB a reprimand under Article 58(2)(b) of the GDPR for the
infringement of Articles 12(2) and 12(6), due to Flightradar24 AB having a routine to
request personal registration certificates and thereby not facilitating the exercise of the
complainants’ right to erasure regarding complaints 1-3, and regarding specifically
complaint 3, requesting additional information to confirm the identity of the complainant
without demonstrating reasonable grounds to doubt the complainant’s identity.
IMY orders Flightradar24 AB, pursuant to Article 58(2)(d) of the GDPR, to take
measures so that the complainants’ requests for erasure, regarding complaints 1 and
2, are handled in accordance with the rules laid down in Articles 12 and 17 of the
GDPR and to cease the publication of data relating to the complainants’ aircraft on
www.flightradar24.com, with the result that the information on the website no longer
makes it possible to identify the complainants. The order is issued on the condition that
Flightradar24 AB does not have reasonable grounds to doubt the identity of the
complainants pursuant to Article 12(6) of the GDPR and does not need to request
additional information, and the obligation to comply with the request for erasure is not
subject to any applicable exceptions in Article 17(3) of the GDPR. The measures must
be taken no later than one month after this decision has become final.
IMY orders Flightradar 24 AB, pursuant to Article 58(2)(c) of the GDPR, to comply with
the complainant’s request for erasure, regarding complaint 3, by ceasing the
Postal address: processing which entails the publication of data relating to the complainant’s aircraft on
Box 8114 www.flightradar24.com, with the result that the information on the website no longer
104 20 Stockholm makes it possible to identify the complainant. The order is issued on the condition that
Website: the obligation to comply with the requests for erasure are not subject to any applicable
www.imy.se
E-mail:
[email protected] 1 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
+46 8-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
IMY Case no: DI-2021-3397 2(23)
Date: 2025-06-30
exceptions in Article 17(3) of the GDPR. The measures must be taken no later than
one month after this decision has become final.
IMY Case no: DI-2021-3397 3(23)
Date: 2025-06-30
Content
Decision of the Swedish Authority for Privacy Protection (IMY) .....................................1
Report on the supervisory case ......................................................................................4
The case handling................................................................................................4
The complaints.....................................................................................................4
What Flightradar has stated .................................................................................5
Aircraft registration numbers are not personal data ..................................5
Description of the procedure for collecting and publishing the data ..........6
Description of the types of data processed ...............................................6
Purpose of data collection and publication ................................................7
Handling of requests from data subjects ...................................................7
Legal basis ................................................................................................8
The complaints ..........................................................................................8
Justification of the decision ...........................................................................................10
Scope of the investigation ..................................................................................10
Aircraft data may constitute personal data.........................................................10
Applicable provisions ..............................................................................10
IMY:s assessment ...................................................................................12
Summarizing conclusion .........................................................................14
Flightradar has a legal basis for processing in article 6(1)(f) .............................15
Applicable provisions ..............................................................................15
IMY:s assessment ...................................................................................16
Requests by data subjects to exercise their rights.............................................18
Applicable provisions ..............................................................................18
IMY:s assessment ...................................................................................18
Choice of intervention ........................................................................................21
Applicable provisions ..............................................................................21
IMY:s assessment ...................................................................................21
How to appeal ...............................................................................................................23
IMY Case no: DI-2021-3397 4(23)
Date: 2025-06-30
Report on the supervisory case
The case handling
The Swedish Authority for Privacy Protection (IMY) has initiated supervision of
Flightradar24 AB (Flightradar or the company) due to several complaints. One
complaint was submitted directly to IMY. The other complaints have been submitted to
IMY by the supervisory authorities of the countries where the respective complainants
lodged their complaints, in its capacity as lead supervisory authority under Article 56 of
the GDPR. The handover has been made by the supervisory authorities of the
countries where the complainants lodged their complaints (Germany and Denmark), in
accordance with the GDPR’s provisions on cooperation concerning cross-border
processing.
The investigation in the case has been carried out through correspondence. In light of
the fact that the supervisory case concerns cross-border processing, IMY has used the
mechanisms for cooperation and consistency provided for in Chapter VII of the GDPR.
The supervisory authorities concerned have been the data protection authorities in
Poland, Germany, Slovakia, the Netherlands, Latvia, Italy, France, Denmark, Hungary,
Portugal, Austria, Finland, Spain and Cyprus.
The complaints
The complainants have mainly stated the following.
In a complaint lodged directly with IMY (complaint 1) it is stated that Flightradar tracks
the complainant’s privately-owned aircraft and publishes information on its location and
flight routes. Flightradar did not comply with the complainant’s request to cease this
processing. The complainant has not given their consent to the processing.
In a complaint from Germany (complaint 2), the complainant states that they privately
own an aircraft of a certain type with a certain registration number. If the registration
number is published on www.flightradar24.com (Flightradar’s website), the
complainant’s movement patterns and location data can be seen, such as details of
departure and destination, routes, speed and altitude. The data is collected with
electronic tools and receivers that are forwarded to a central office. The complainant
considers that this constitutes a violation of their personal integrity. Flightradar offers to
quickly handle requests by aircraft owners to block their aircraft through a payment
service (500 USD).
In a complaint from Denmark (complaint 3), the complainant states that they are the
only pilot of a helicopter with a specific registration number. The complainant uses the
helicopter for transport in their capacity as CEO of a company. It is public information
in Denmark who owns the helicopter. The helicopter has a transmitter that sends out
signals about location and altitude for air traffic safety reasons. On the ground, the
data is collected through receivers set up by hobbyists and sold or donated to
companies such as Flightradar. The location of the helicopter can be seen by
searching its registration number on the Flightradar website. The complainant has
previously had the visibility of the helicopter blocked on Flightradar’s website, but it has
reappeared.
Another complaint from Germany (complaint 4) states that Flightradar discloses
personal data about the complainant’s privately-owned aircraft, such as identification
IMY Case no: DI-2021-3397 5(23)
Date: 2025-06-30
number2, movement pattern and location. After making a complaint to the data
protection authority in Hessen in Germany, Flightradar has anonymized the
registration number to D-xxxx. However, this has not been the case for some time, as
shown by the attached screenshot from the service from 10 October 2020.
What Flightradar has stated
Flightradar has mainly stated the following.
Aircraft registration numbers are not personal data
The company does not consider aircraft registration numbers to be personal data.
Registration numbers are merely a means of identifying a specific aircraft, not a
specific person. There are no public registers to look up owners of private aircraft and
thereby make a connection to a specific person (cf. the Swedish Transport Agency's
(Transportstyrelsen) aircraft register, where there are no names for private individuals
who are registered owners, partners or holders).3
The data that the company collects and displays to provide the service do not relate to
individuals in a manner that is necessary to constitute personal data. The content of
the data does not per se relate to any individual. The purpose of the processing is not
to attribute certain characteristics to an individual or to disseminate information about
such persons. The effect of the treatment is typically minimal for individuals.
It is also worth adding that most aircraft have complicated ownership constellations
with different owners, partners, users, holders and pilots, which can make it very
complex to link an aircraft to a particular individual. Moreover, the link with a particular
individual is even weaker regarding complaints 2 and 3, as these aircraft are owned by
companies, one of which is an American company.
Flightradar does not handle, save or display any names or address details of privately-
owned aircraft. The company only shows the registration number of the aircraft on their
website.
Flightradar is aware that information about objects and places in certain contexts may
be considered personal data. In the case of objects and places that have a distinctly
personal character, this can often be presumed. For example, this applies to
information such as IP addresses or about a private home. However, not all data on
objects and locations can reasonably be considered personal data, even if such data
can be linked to a natural person using certain other information. All information about,
hotel rooms cannot be considered personal data just because other information makes
it possible to identify who has stayed in a particular hotel room or who owns the hotel,
for example. Where the object or place is of a more collective nature, the presumption
must be the opposite, that is to say, that the data do not relate to a natural person. The
presumption may be disproven in an individual case if the content, purpose or effect of
the data processed are such that they may be considered to be related to a natural
person. Information about a particular hotel room can be considered as personal data
when it appears in a booking system.
2 ‘Identification number’ and ‘registration number’ are synonymous with each other. From here onwards ‘registration
number’ only is used for reference.
3 https://etjanster-luftfart.transportstyrelsen.se/en-se/sokluftfartyg
IMY Case no: DI-2021-3397 6(23)
Date: 2025-06-30
Aircraft (and ships) have a clear public character compared to cars, for example. Most
aircraft are owned by companies. The possibilities to find out if an aircraft is owned by
a private individual differs from country to country. There is no open record of which
pilots have flown a particular aircraft.
The international regulation of air traffic is focused on public access and transparency.
Anyone who owns or flies a plane has, as a consequence, entered into a public
context to some extent. It is therefore reasonable to presume that data relating to
aircraft, which are processed without a particular focus on attributing characteristics to
natural persons, do not constitute personal data. It is not reasonable to require
Flightradar to investigate on its own whether, in some exceptional cases, there is a
more private connection between an aircraft and a natural person who is the owner or
pilot (cf. Article 11 GDPR).
It could possibly be argued that, in an individual case, certain details of an aircraft
change in nature when the company is informed that there is a more personal
connection between the details of the aircraft and a natural person. However, it has
doubts as to such an interpretation based on the information contained in the service
and the way in which it is organised.
Description of the procedure for collecting and publishing the data
A good overview of how Flightradar's service works can be found on the company's
website.4 Flightradar obtains the registration number of a particular aircraft by
collecting the aircraft's so-called 24bit HEX code and its call sign, which in most cases
corresponds to the aircraft's registration number. In some cases, the call sign may
differ from the aircraft registration number due to air traffic control regulations.
Most modern aircraft are equipped with an Automatic Dependent Surveillance-
Broadcast (ADS-B) transponder that sends out a signal. The signal is open to
everyone. The idea is that this information should be public (i.e. not encrypted) in order
to allow other aircraft and stakeholders to keep track of air traffic. An ADS-B
transponder continuously sends out said information above.
The company captures these signals using more than 30,000 signal receivers around
the world, which in turn upload data to the company's network. The company also
receives data from various government organizations as well as from satellite
networks.
Description of the types of data processed
IMY has asked Flightradar to provide all types of data on aircraft processed in the
service during the relevant period, such as aircraft registration numbers as well as their
movement patterns and location – departures, destination, routes, speed and altitude.
The company states that it processes data that the aircraft themselves send out. This
data consists of an ICAO 24 Bit-address, position, latitude, longitude, altitude, speed,
direction and Squawk code. From this data, the company sometimes extrapolates the
airport of departure, the airport of arrival, the country of registration and the registration
number.
4 https://www.flightradar24.com/how-it-works.
IMY Case no: DI-2021-3397 7(23)
Date: 2025-06-30
Flightradar cannot precisely specify the number of aircraft registration numbers with
the above-mentioned data processed in the relevant period. The most relevant figure
is that at the time of Flightradar’s initial statement, the company had about 282,000
active planes in its database.
Purpose of data collection and publication
The purpose of the collection and publication of the above-mentioned data is to
provide a very popular service used by individuals, companies, organisations and
public authorities. Each month the service has 30 million users. Private individuals use
the service to e.g. keep track of loved ones who are flying or to know when the plane
they are about to take will land. In addition, many aviation enthusiasts spend a large
amount of time browsing Flightradar's website.
Many of the largest companies in the aviation industry use the service for research and
development. After virtually every major aviation accident around the world, Flightradar
receives requests from various accident investigation authorities (or court of inquiries)
to send the data that Flightradar has. This data is requested in order to help assess
what went wrong. Flightradar is also the service that the media and news agencies
around the world turn to when they need accurate flight data. Since flight MH370 went
missing in 2014, data from Flightradar’s service played a crucial role in the rapid
transmission of accurate information in about 100 aviation accidents worldwide. One of
CNN's aviation experts has stated that media coverage of aviation accidents can be
divided into two categories – before and after Flightradar24. Flightradar has played a
crucial role in obtaining accurate and objective data before authorities can obtain the
data. Many equivalents of the Swedish central bank use Flightradar's data as an
indication of economic activity.
Data from Flightradar has been used as evidence in numerous criminal investigations
around the world, most often related to drug smuggling. In May 2021, Flightradar
provided data to the Ukrainian police, via the Swedish police, in the criminal
investigation against Iran regarding the shooting down of flight PS752 in Tehran in
January 2020. Authorities in New Zealand have also used data from Flightradar to
locate a plane crash and rescue a survivor.
The Swedish Accident Investigation Authority (Statens haverikommission) was helped
by data from Flightradar regarding a crash in Örebro on 8 July 2021. The aircraft was
of a smaller model without a black box, which means that very limited information was
available. However, Flightradar had nine data points from the flight, which the
company sent to Statens haverikommission upon their request. The datapoints were
crucial to the investigation. Flightradar has worked a long time with the counterparts of
Statens haverikommission around the world, but want to highlight this case as an
example of the usefulness of the data the company collects.
Handling of requests from data subjects
Flightradar has not kept any statistics on how many requests for access or erasure nor
objections to the processing it has received during the relevant period.
However, Flightradar estimates that it has not received any requests for access. The
data that the company processes is to a large extent already public on Flightradar's
website and shows all the information that the company has. Regarding requests for
erasure and objections to the processing, the company has received between 10 and
IMY Case no: DI-2021-3397 8(23)
Date: 2025-06-30
20 such requests. In those situations, the company has requested a copy of the
registration certificate to ensure that the request comes from the owner of the aircraft.
Flightradar has received a response from about half of them. Flightradar considers that
it is worth noting how small this number is proportionally to the total number of active
planes on Flightradar’s website.
In cases where the company has received a response containing registration
certificates for privately-owned aircraft, the company has blocked the aircraft so that it
does not appear on Flightradar's website. The company has not requested payment
for this. However, the company has previously offered an express service where
someone could request to have a plane blocked within 24 hours via a payment of 500
euros. Flightradar does not have any knowledge of a private person ever using this
service, only that it was ever used by companies.
It is not possible for the company to erase data relating to an aircraft with the result
that the data is no longer be processed from a technical standpoint. Aircraft
continuously emit signals intended for general reception (i.e. having no specific
recipient in mind) that Flightradar must catch and decipher before the company can
determine what to do with it. When Flightradar blocks an airplane, the company flags a
specific aircraft in its database so that the aircraft in question cannot be identified by its
registration number. When a blocked aircraft is airborne and displayed on Flightradar’s
website, only general information about the aircraft model, such as ‘Cessna 172’ or
‘Piper PA28’ is displayed. It is also not possible to find historical flights when searching
by aircraft registration number. Once an aircraft has been flagged in Flightradar’s
blocking database, it will be blocked until further notice.
Legal basis
Flightradar considers that registration numbers do not constitute personal data and
that Flightradar therefore does not process personal data. In the event that IMY makes
a different assessment, Flightradar wishes to explain their view on the legal basis for
the processing.
The collection and publication of data on aircraft may take place on the basis of a
legitimate interest pursuant to Article 6(1)(f) of the GDPR. The legitimate interest of
Flightradar is to provide a service that makes it possible to gain knowledge about the
global air traffic. As stated above, the service has a variety of positive uses and is very
popular. Air traffic information is a societal matter.
The data processing is necessary for the provision of the service. In particular, it
should be noted that the service does not contain any information directly attributable
to natural persons. The positive effects of the service clearly outweigh any negative
effects that the service may cause to individuals. Account must be taken to the public
and collective nature of the data, as well as of the fact that the company offers the
possibility of removing aircraft with a clear personal connection from the service. It
should also be taken into account that the number of aircraft owned by private
individuals is limited.
The complaints
Regarding complaint 1, the complainant contacted Flightradar on 7 March 2021.
Flightradar offered to block the aircraft and, in accordance with Flightradar’s blocking
management procedure, requested a copy of the aircraft registration certificate. The
IMY Case no: DI-2021-3397 9(23)
Date: 2025-06-30
complainant did not reply with a registration certificate. Since Flightradar did not
receive the registration certificate, Flightradar does not know whether the complainant
is the actual owner of the aircraft. Flightradar would therefore have been at risk of
blocking an aircraft belonging to someone else if the complainant’s request had been
fulfilled without Flightradar having been provided the registration certificate, which is
why the request was left unfulfilled.
Regarding complaint 2, the complainant contacted Flightradar in 2021. In accordance
with Flightradar’s blocking management procedure, Flightradar requested a copy of
the registration certificate for the aircraft. The registration certificate was never shared
by the complainant. It can be noted however, according to the US Department of
Transportation, that the aircraft in this complaint is registered in the US and owned by
a US trustee. This means that the owner of the aircraft in question is not a private
individual. As explained above, since the complaint concerns an aircraft owned by a
legal person, there is no link between the aircraft and the complainant. Therefore, the
GDPR does not apply to the processing of data relating to the aircraft owned by the
US trust. For this reason, Flightradar also objects to the fact that the aircraft
registration number makes it possible to see the complainant’s movement patterns and
location data.
Regarding complaint 3, Flightradar requested the registration certificate for the aircraft
when the complainant contacted Flightradar. The complainant refused to submit the
registration certificate. Flightradar nevertheless chose to fulfil the complainant’s
request by blocking an aircraft based on an identification code (‘HEX code’) provided
by the complainant. However, the identification code provided by the complainant was
an old and incorrect HEX code that applied when the helicopter was used by a
previous owner and registered in the UK. In connection with the transfer of aircraft
between countries, the aircraft in question are assigned a new HEX code. The aircraft
in the complaint has had its HEX code reprogrammed in connection with the transfer
and registration in Denmark, but not until one year after the transfer, which is why the
aircraft was once again visible on Flightradar's website after some time had passed. If
Flightradar had received the Danish registration certificate from the complainant,
Flightradar would have been able to verify that the information provided by the
complainant was consistent and this inaccuracy could have been avoided. It also
demonstrates the need for Flightradar to be provided with a copy of the registration
certificate in order to be able to block the right aircraft. Flightradar also wants to clarify
that the aircraft in the complaint is owned by a company and there is therefore no link
between the aircraft and the complainant personally. The GDPR does not apply to the
processing of this registration number either.
Regarding complaint 4, Flightradar has not been able to verify that the complainant
has ever contacted Flightradar and has therefore not been able to comply with their
request.
In a statement dated 25 March 2025, Flightradar further states that the aircraft in
complaint 1 and 3 are on the blocking list of the Federal Aviation Administration
(FAA).5 As a consequence, the visibility of the aircraft are now also blocked by
Flightradar on its website.
5 See information about FAA's Limiting Aircraft Data Displayed (LADD) Program at https://www.faa.gov/pilots/ladd
IMY Case no: DI-2021-3397 10(23)
Date: 2025-06-30
Justification of the decision
Scope of the investigation
IMY has examined whether the aircraft registration numbers in the complaints, which
are processed by Flightradar, constitute personal data within the meaning of Article
4(1) of the GDPR. IMY concludes that registration numbers may constitute personal
data under certain conditions. If the registration number is to be regarded as personal
data, this also means that certain other positional data related to the registration
numbers are also personal data, namely the position, latitude, longitude, altitude and
direction of the aircraft.
IMY has then examined whether Flightradar has a legal basis to process personal data
under Article 6(1)(f) of the GDPR, specifically aircraft registration numbers and
associated location data on Flightradar’s website.
In light of the complainants’ requests that they do not wish their aircraft to be displayed
on Flightradar, IMY also examined the company’s approach to the handling of
requests for erasure under Article 17 of the GDPR, including the measures the
company took in the context of that handling, in particular regarding identification of the
complainants pursuant to Article 12(6) of the GDPR.
The supervisory case is limited in time to the relevant period, specifically 25 May 2018-
22 June 2021. IMY notes that the processing in the present case is ongoing, however.
Aircraft data may constitute personal data
The first question IMY intends to answer is whether certain data relating to aircraft that
Flightradar processes constitute personal data within the meaning of Article 4(1) of the
GDPR, for this supervisory case primarily aircraft registration numbers.
Applicable provisions
According to Article 2 of the GDPR, the regulation applies to the processing of
personal data wholly or partly by automated means and to the processing other than
by automated means of personal data which form part of a filing system or are
intended to form part of a filing system.
Article 4(1) of the GDPR defines ‘personal data’ as any information relating to an
identified or identifiable natural person (‘data subject’); an identifiable natural person is
one who can be identified, directly or indirectly, in particular by reference to an
identifier such as a name, an identification number, location data, an online identifier or
to one or more factors specific to the physical, physiological, genetic, mental,
economic, cultural or social identity of that natural person.
It follows from the term ‘any information’ in Article 4(1) of the GDPR that the concept of
‘personal data’ must be given a broad meaning. The concept of ‘personal data’ may
include all information, both objective and subjective, provided that it ‘relates’ to a
particular person. The data relate to a specific person if they are linked to that person
by reason of their content, purpose or effect.6 The use of the term ‘indirectly’ in the
6 See CJEU, judgment of 20 December 2017, Case C-434/16, Nowak (ECLI:EU:C:2017:994), paras. 34-35.
IMY Case no: DI-2021-3397 11(23)
Date: 2025-06-30
article means that it is not necessary that the data subject is directly identifiable by
certain types of information in order for that information to constitute personal data.7
Recital 26 of the GDPR states that account should be taken of any means reasonably
likely to be used, either by the controller or by another person, to identify the natural
person, directly or indirectly, in order to determine whether a natural person is
identifiable. An example of a method in this regard is ‘singling out’, used either by the
controller or by another person, to directly or indirectly identify a natural person. To
ascertain whether certain means are reasonably likely to be used to identify the natural
person, account should be taken of all objective factors, such as the costs of and the
amount of time required for identification, taking into consideration the available
technology at the time of the processing and technological developments. The wording
of recital 26 suggests, by referring to all the means reasonably likely to be used by the
controller or another person, that it is not necessary for a single person to hold all the
information necessary to identify the data subject.8
Furthermore, so-called ‘online identifiers’ – such as IP addresses or information stored
in cookies – can be used to identify a data subject, in particular when those identifiers
are combined with other similar types of information. Recital 30 of the GDPR states
that natural persons may be associated with online identifiers provided by their
devices, applications, tools and protocols, such as internet protocol addresses, cookie
identifiers or other identifiers such as radio frequency identification tags. This may
leave traces which, in particular when combined with unique identifiers and other
information received by the servers, may be used to create profiles of the natural
persons and identify them.
The Court of Justice of the European Union (CJEU) has held in the judgments
M.I.C.M. and Breyer, that dynamic IP addresses constitute personal data for
whomever processes them, if that actor also has the legal means to identify the users
by using additional information available to a third party.9 However, the dynamic IP
address is not personal data if the de facto identification of the individual is prohibited
by law or if the natural person is impossible to identify in practice, e.g. because it
would require unreasonable resources in terms of time, costs and manpower to
identify the person, resulting in a risk of identification that is negligible in practice.10
CJEU has in its judgment in Gesamtverband Autoteile-Handel held that vehicle
identification numbers (VIN) are personal data for whomever may have reasonable
means at their disposal to enable a link between a VIN and a specific person, for
example through the registration certificate for a vehicle. The VIN-number becomes
personal data for an independent operator (e.g. a workshop or dealer) who has access
to the registration certificate of the vehicle and consequently also becomes ‘indirect’
personal data for the vehicle manufacturer.11 This applies even if the VIN does not in
itself constitute personal data for the vehicle manufacturer. However, the VIN-number
does not constitute personal data when the VIN-number is assigned to a vehicle that
does not belong to a natural person.12
7 See CJEU, judgment of 19 October 2016, Case C-582/14, Breyer (ECLI:EU:C:2016:779), para. 41.
8 See CJEU, judgment of 19 October 2016, Case C-582/14, Breyer (ECLI:EU:C:2016:779), para. 43.
9 See CJEU, judgment of 17 June 2021, Case C-597/19, M.I.C.M. (EU:C:2021:492), paras. 102-104 and CJEU,
judgment of 19 October 2016, Case C-582/14, Breyer (ECLI:EU:C:2016:779), para. 49.
10 See CJEU, judgment of 19 October 2016, Case C-582/14, Breyer (ECLI:EU:C:2016:779), para. 46.
11 See CJEU, judgement of 9 November 2023, Gesamtverband Autoteile-Handel, Case C‐319/22
(ECLI:EU:C:2023:837), paras. 46-50.
12 See CJEU, judgement of 9 November 2023, Gesamtverband Autoteile-Handel, Case C‐319/22
(ECLI:EU:C:2023:837), para. 49.
IMY Case no: DI-2021-3397 12(23)
Date: 2025-06-30
The EDPB’s Guidelines 3/2019 for the processing of personal data through video
devices state that the GDPR does not apply to the processing of data that has no
reference to a person, e.g. where a person cannot be directly or indirectly identified.
The guidelines include an example of an integrated video camera in a car whose
purpose is to provide parking assistance. If the camera is designed or adjusted in such
a way that it does not collect any information about natural persons (such as
registration plates or information that can identify passers-by), the GDPR does not
apply. If registration plates are filmed the GDPR applies, however, provided that a
natural person can be identified.13
IMY:s assessment
As detailed in the case file, Flightradar obtains the registration number for a particular
aircraft by collecting the aircraft's so-called ICAO 24-bit hex code and call sign. The
call sign corresponds to the aircraft registration number in most cases. The company
also collects information about the aircraft's position, latitude, longitude, altitude,
speed, direction and its so-called squawk code. Sometimes Flightradar extrapolates
the departure airport, arrival airport, country of registration and registration number
from the abovementioned data. In this regard, IMY notes that the registration number
consists of a country code and subsequent number combination that is unique within
the nation it is registered in. Registration numbers are therefore unique to each
individual aircraft. IMY notes that aircrafts’ registration numbers and their location data
such as position, latitude, longitude, altitude and direction, are published on
Flightradar’s website.
Flightradar has stated that it does not consider aircraft registration numbers to be
personal data. Flightradar inter alia motivates this by the fact that there are no public
registers to search for owners of private aircraft and that it therefore is not possible to
make a connection between a registration number and a specific person. In addition to
this, the aircraft in complaints 2 and 3 are owned by companies. Flightradar considers
in these cases that that there is no clear personal connection between the registration
number and a private individual and that the information therefore does not constitute
personal data.
IMY concludes that aircraft registration numbers may constitute personal data under
certain conditions, however. It is not necessary that aircraft registration numbers
directly enable the identification of natural persons for the registration numbers to be
personal data. Possibilities to identify natural persons with the registration number
indirectly may also mean that they constitute personal data. In this regard, IMY notes
that the statements of the CJEU in M.I.C.M. and Breyer apply to all types of indirect
personal data. According to this case law, the controller does not by itself need to have
all the necessary information to identify a data subject, but the data they have may
nevertheless constitute personal data if the means of identification of a specific
individual are available from other sources, for example where a third party has
complementary information or means that enables the identification of a data subject.14
13 See EDPB Guidelines 3/2019 on the processing of personal data by video devices (adopted on 29 January 2020),
paras. 8-9.
14 See CJEU, judgment of 17 June 2021, Case C-597/19, M.I.C.M. (EU:C:2021:492), paras. 102-104 and CJEU,
judgment of 19 October 2016, Case C-582/14, Breyer (ECLI:EU:C:2016:779), para. 49.
IMY Case no: DI-2021-3397 13(23)
Date: 2025-06-30
In this regard, account must also be taken to the ‘singling-out’ method of
identification.15
IMY notes that the regulatory framework in question sets out a flexible approach to the
types of data that can identify data subjects and therefore constitute personal data.
The limits of what does not constitute personal data in this regard is when the risk of
identification is negligible, i.e. ‘if the identification of the person concerned is prohibited
by law or impossible in practice’ or requires ‘means that cannot reasonably be used’
for identification.16
The registration numbers of the complainants’ aircraft that Flightradar publishes
therefore constitutes personal data as long as there are means of identifying each
respective complainant. Even if Flightradar itself is not able to identify information with
the information it processes, there may be information held by third parties that
enables such identification.17 IMY therefore finds that aircraft registration numbers may
constitute personal data and in such a case constitutes indirect personal data. The fact
that the data is indirect presumes that Flightradar or a third party is able to identify
individuals with the data published on Flightradar, albeit only in combination with data
from other sources or through other means.
Regarding complaints 1 and 4, IMY notes that the information on private ownership of
an aircraft with a specific registration number is available in national aircraft registers.18
For Sweden, Denmark and Germany, such registers are kept by the Swedish
Transport Agency (Transportsstyrelsen), the Danish Transport Agency
(Trafikstyrelsen) and the German Luftfahrt-Bundesamt.19 The occurrence of these
aircraft registers is enough to determine that aircraft registration numbers are personal
data, because there is information in the national aircraft registers that, together with
the information published on Flightradar, can be used to identify individual data
subjects. For example, registration numbers can be used by a third party to research
who owns an aircraft by searching the corresponding national aircraft registers. Data
relating to the complainants’ aircraft on Flightradar’s website for the purposes of
complaints 1 and 4 are therefore personal data insofar the complainants’ personal
data, e.g. their name, appear in a national aircraft register.
IMY also considers that registration numbers regarding complaints 2 and 3 could
constitute personal data, even if a registration listing or certificate shows that an
aircraft is registered to a company. On the one hand, it is unlikely that the information
can be linked to a private individual only with the information contained in the national
aircraft register since it’s registered to a company. On the other hand, it is possible that
an aircraft is used exclusively by only one person at a company. Both complainants
have stated in their complaints that the aircraft are used only by them. In addition to
15 See recital 26 of the GDPR, which includes the term ‘singling-out’. The notion of ‘singling-out’ is not present in
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals
with regard to the processing of personal data and on the free movement of such data (‘the Data Protection
Directive’), which was in force at the time of the judgment of the CJEU in the Breyer case.
16 See recital 26 of the GDPR and CJEU, judgment of 19 October 2016, Case C-582/14, Breyer
(ECLI:EU:C:2016:779).
17 CJEU, judgement of 9 November 2023, Gesamtverband Autoteile-Handel, Case C‐319/22 (ECLI:EU:C:2023:837),
paras. 46-50.
18 Each civil aircraft must be registered in a national register, cf. Article 3(c) of the Convention on International Civil
Aviation. Sweden, Denmark, the United States and Germany are parties to and bound by the Convention.
19 See https://www.transportstyrelsen.se/en/Aviation/Aircraft-and-Aircraft Authority/Aircraft Register/,
https://www.trafikstyrelsen.dk/arbejdsomraader/aviation/Ansoegninger-individuelle/Flyejer/Aviationoejsregister and
https://www.lba.de/EN/Airworthiness/AircraftRegistration/AircraftRegistration_node.html
IMY Case no: DI-2021-3397 14(23)
Date: 2025-06-30
this, complaint 3 states that it is a well-known fact that only the complainant uses the
aircraft in his role as the CEO of a company.
IMY also notes that it may in some cases be notorious fact that a specific aircraft is
used only by certain persons, e.g. in the case of very famous persons. It therefore
cannot be completely excluded that the registration number of an aircraft registered to
a company cannot be linked to a natural person, in which case the registration number
would constitute personal data. The aircraft registration numbers in complaints 2 and 3
therefore constitute personal data if they relate to a natural person and the risk of
identification is not negligible.20 IMY also notes that if Flightradar is unable to
demonstrate that the risk of identification is negligible on a case-by-case basis, it
should be aware that the registration number of company-owned aircraft may
constitute personal data.21
In addition to this, the EDPB considers that the GDPR is applicable when video
recordings of car registration plates are made, if the recording makes it possible to
identify natural persons.22 The recording and publication of aircraft registration
numbers and location data by Flightradar is similar to the example provided by the
EDPB. Flightradar’s statement that commercial air traffic is more widespread than
private air traffic, if it is accurate, does not in itself have any significance for the
outcome of the assessment of whether aircraft registration numbers can be regarded
as personal data. What is significant in ascertaining whether an aircraft registration
number constitutes personal data is if the data in question can be used to identify
natural persons.
IMY concludes that registration numbers belonging to aircraft can, in certain cases, be
used to identify natural persons. IMY notes that aircraft location data therefore also
can constitute personal data, i.e. aircraft position, latitude, longitude, altitude and
direction, in such cases.
Summarizing conclusion
IMY finds that there are national authorities that have information that, together with
the information that Flightradar collects and publishes on their website, can be used to
identify the owner of an aircraft by viewing the aircraft register of the country the
aircraft is registered. If e.g. the names of the complainants regarding complaints 1 and
4 appear on those lists of registers, the registration numbers of the aircraft in question
constitute their personal data.
Complainants 2 and 3 each claim that they are the only pilots of the respective aircraft,
which Flightradar have pointed out are registered to companies. As far as what is
apparent from the file, Flightradar have not disputed that the complainants are the only
pilots. Flightradar’s only intervention is that the aircraft are registered to companies.
The registration numbers of those aircraft can therefore constitute the complainants’
personal data if they can be used to identify the complainants, that is to say, if the
complainants are in any way able to prove that they are the only pilots of the
respective aircraft.
20 CJEU, judgment of 19 October 2016, Case C-582/14, Breyer (ECLI:EU:C:2016:779).
21 CJEU, judgment of 17 June 2021, Case C-597/19, M.I.C.M. (EU:C:2021:492), paras. 102-104 and CJEU, judgment
of 19 October 2016, Case C-582/14, Breyer (ECLI:EU:C:2016:779), para. 47.
22 See EDPB Guidelines 3/2019 on processing of personal data through video devices (adopted on 29 January 2020),
paras. 8-9.
IMY Case no: DI-2021-3397 15(23)
Date: 2025-06-30
In conclusion, IMY finds that Flightradar processes personal data relating to
complainants 1 and 4 by collecting, compiling and publishing on Flightradar’s website,
the aircraft registration number of the complainants as well as location data such as
position, latitude, longitude, altitude and direction, assuming the complainants are
identifiable through the respective national aircraft registers. Flightradar may also
process personal data in the same way regarding complainants 2 and 3, if they are
identifiable by the registration numbers of the respective aircraft.
These circumstances also mean that the GDPR applies for the processing of personal
data on Flightradar's website.
Flightradar has a legal basis for processing in article 6(1)(f)
The second question that IMY has to consider is whether Flightradar has a legal basis
for its processing of personal data. Flightradar has stated that it bases the processing
on Article 6(1)(f) of the GDPR (legitimate interest) in the present case, if IMY were to
consider that aircraft registration numbers constitute personal data.
Applicable provisions
The lawfulness of the processing of personal data requires that at least one of the
conditions set out in Articles 6(1)(a)-(f) of the GDPR are met.
In order to process personal data on the basis of legitimate interest under Article
6(1)(f) of the GDPR, a controller must meet three conditions. The controller or a third
party has a (i) legitimate interest, the processing is (ii) necessary for the purposes of
the legitimate interest, and (iii) the interests or fundamental rights and freedoms of the
data subject do not override the controller’s or third party’s legitimate interest.23
According to the EDPB, the notion of legitimate interest should be interpreted
broadly.24 An interest can be considered legitimate as long as it is real, clearly
delimited and the controller can process the data in a way that is compatible with data
protection legislation as well as other legislation.25
The notion of ‘necessity’ has an independent legal meaning in EU law, meaning that
‘necessity’ must be interpreted in a way that strives to achieve the objectives of data
protection law.26 In this context, the CJEU has held that exceptions and limitations to
the protection of personal data must be limited to what is strictly necessary.27
Furthermore, there must be a clear link between the processing of the personal data
and the legitimate interest.28 Processing may be necessary if it contributes to gains in
23 CJEU, judgment of 4 May 2017, Case C-13/16, Rīgas satiksme (EU:C:2017:336), para. 28 and EDPB Guidelines
1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public consultation on 8 October
2024), para. 17.
24 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), para. 16.
25 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), paras. 16-17. In that regard, it should be noted that an economic interest may
constitute a legitimate interest, cf. CJEU, judgement of 4 October 2024, Case C-621/2, Tennisbond (EU:C:2024:857).
26 See CJEU, judgement of 16 December 2008, Case C 524/06, Heinz Huber v Germany (EU:C:2008:724), para. 52.
See also EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), para. 28 et seq.
27 CJEU, judgment of 4 May 2017, Case C-13/16, Rīgas satiksme (EU:C:2017:336), para. 30. See also EDPB
Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public consultation on 8
October 2024), para. 29.
28 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), para. 19.
IMY Case no: DI-2021-3397 16(23)
Date: 2025-06-30
efficiency.29 The requirement of ‘necessity’ must also be examined in conjunction with
the principle of data minimization under Article 5(1)(c) of the GDPR.30 According to this
principle, personal data must be adequate, relevant and not excessive in relation to the
purposes for which they are processed. Recital 39 of the GDPR further states that
personal data should only be processed if the purpose of the processing cannot
reasonably be achieved by other means. The EDPB notes that it, in practice, is easier
for a controller to demonstrate that processing is necessary on the basis of its own
legitimate interest than the legitimate interest of a third party, as the latter is more
difficult to foresee for data subjects.31
Finally, any legitimate interest pursued by the controller must be weighed against all
the relevant interests or fundamental rights and freedoms of the data subjects in a
balancing test.32 The use of the expression ‘interests or fundamental rights and
freedoms’ in the provision confers greater protection on data subjects in such a way
that not only their fundamental rights and freedoms should be considered, but also the
‘interests’ of data subjects.33
In the balancing test, the controller shall consider both positive and negative
consequences of the personal data processing for the data subject. Account must be
taken to factors such as the nature of the data, the way in which the data are
processed, the reasonable expectations of the data subject and the positions of the
controller and the data subject.34 After carrying out an analysis and weighing the two
sides against each other, a provisional ‘balance’ can be established.35
IMY:s assessment
The first question that IMY has to consider is whether Flightradar has a legitimate
interest in collecting and publishing registration numbers and associated location data
of aircraft, which constitute personal data, on its website.
Flightradar has stated that it has a legitimate interest in providing a service that makes
it possible to monitor and gain knowledge of the global air traffic. According to
Flightradar, the service has a number of positive uses. Some examples that
Flightradar present pertain to criminal investigations and alleviating the investigation of
aircraft accidents. IMY has found no reason to question that Flightradar is used in such
ways. The reasoning put forward by Flightradar in this regard is understood by IMY in
such a way that data, including personal data, is partly collected for and disclosed to
the benefit of third parties.
IMY notes that the collection and publication of the complainants’ personal data in the
present case is not directly contrary to the GDPR or any other legislation. In addition to
this, the documentation in the case shows that the information published on
29 See CJEU, judgement of 16 December 2008, Case C 524/06, Heinz Huber v Germany (EU:C:2008:724), para. 62.
30 See CJEU, judgment of 11 December 2019, Case C-708/18, Asociaţia de Proprietari bloc M5A-ScaraA
(ECLI:EU:C:2019:1064), para. 48. See also EDPB Guidelines 1/2024 on the processing of personal data under Article
6(1)(f) GDPR (adopted for public consultation on 8 October 2024), para. 29.
31 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), para. 30.
32 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), paras. 31 et seq.
33 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), paras. 32, 35-36.
34 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), para. 32.
35 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), para. 33.
IMY Case no: DI-2021-3397 17(23)
Date: 2025-06-30
Flightradar's website is used, inter alia, for research and development by the aviation
industry, in media reporting and by national authorities in investigations regarding
accidents and criminal activity36. As such, Flightradar acts not only in a presumable
self-interest, but also to some extent in a public interest, which may be considered to
weigh relatively heavy in the assessment of whether Flightradar’s interest is
legitimate.37
In the light of the above and that the notion of legitimate interest should be interpreted
broadly, IMY considers that Flightradar’s interest in providing the service for the benefit
of third parties’ interest to monitor and gain knowledge of the global air traffic is
legitimate.
The second question that IMY has to consider is whether the processing of personal
data by Flightradar is necessary for the pursued legitimate interest of third parties.
IMY notes initially that Flightradar publishes large numbers of registration numbers for
over thirty million monthly users, both regarding private and commercial aircraft.
Registration numbers may constitute personal data in both scenarios, but the
investigation has not shown that registration numbers of aircraft in a general sense
always provide real and effective means of identifying data subjects. As far as can be
gathered from the investigation, Flightradar also has no possibility of initially
determining which aircraft potentially may refer back to natural persons at the time of
collection. On the one hand, IMY notes that Flightradar is able to de-identify aircraft
and that it would be possible for them not to display registration numbers or other
identifying information at all. On the other hand, a general de-identification of aircraft
would mean that the legitimate interest in following and gaining knowledge of global
aircraft traffic would not be possible, i.e. without the possibility to track aircraft. It would
be possible to follow the global air traffic, but it would not be possible to gain any
closer knowledge in the absence of other information about specific aircraft. IMY
therefore considers that it would not be possible for third parties to follow and gain
knowledge of global air traffic without the possibility to identify aircraft.
IMY therefore considers that the collection and publication of registration numbers on
Flightradar's website is necessary in order for the company to pursue the legitimate
interests set out above. IMY hereby also finds that the processing is adequate,
relevant and not excessive in relation to the purposes for which the data are processed
and therefore complies with the principle of data minimization.
The third question that IMY has to consider is whether the legitimate interest in
publishing registration numbers and location data outweighs the interests or
fundamental rights of the data subjects.
As detailed above, IMY considers that the legitimate interest in carrying out the
processing weighs quite heavily, especially considering the described benefits that the
processing has brought so far. In balancing the interests and rights and freedoms of
data subjects, IMY notes that aircraft registration numbers are publicly available data
for anyone that possesses the equipment to collect them. In addition to this,
36 IMY notes in this regard that a controller that primarily pursues an economic interest in processing of personal data
cannot, as a general rule, rely on a legitimate interest in processing personal data for the purposes of preventing,
detecting or prosecuting criminal offences, when this is unrelated to its commercial activities, cf. recital 50 of the
GDPR and see CJEU, judgment of 4 July 2023, Case C-252/21, Meta v. Bundeskartellamt (ECLI:EU:C:2023:537),
paras. 119 et seq.
37 See EDPB Guidelines 1/2024 on the processing of personal data under Article 6(1)(f) GDPR (adopted for public
consultation on 8 October 2024), para. 20.
IMY Case no: DI-2021-3397 18(23)
Date: 2025-06-30
registration numbers constitute indirect personal data, which must be combined with
other data kept by third parties in order to identify individual data subjects. The data
subjects are therefore not easily identifiable. The category of data subjects concerned
in this case, i.e. likely adults holding a pilot’s license, should also have a reasonable
expectation that different actors have an interest in identifying and locating their
aircraft, for example for air traffic safety reasons. IMYs overall assessment is that the
processing by Flightradar entails only a low likelihood of negative consequences for
the interests or fundamental rights and freedoms of data subjects.
IMY therefore considers that the interests or fundamental rights of the data subjects do
not override the legitimate interest in carrying out the processing.
In summary, IMY considers that Flightradar has a legal basis in Article 6(1)(f) of the
GDPR for collecting and publishing aircraft registration numbers as well as location
data such as position, latitude, longitude, altitude and direction (which constitute
personal data) on their website.
Requests by data subjects to exercise their rights
Applicable provisions
According to Article 12(2) of the GDPR, the controller shall facilitate the exercise of the
data subject’s rights under, inter alia, Articles 15 and 17.
According to Article 12(6) of the GDPR, where the controller has reasonable doubts
concerning the identity of the natural person making the request referred to in Articles
15 to 21, the controller may request the provision of additional information necessary
to confirm the identity of the data subject.
According to Article 15 of the GDPR, the data subject shall have the right to obtain
from the controller confirmation as to whether or not personal data concerning him or
her are being processed, and, where that is the case, access to the personal data and
the information referred to in that article.
According to Article 17(1)(c) of the GDPR, the data subject has a right to erasure of
personal data concerning him or her if he or she objects to the processing pursuant to
Article 21(1) and there are no overriding legitimate grounds for the processing by the
controller.
According to Article 21(1) of the GDPR, the data subject shall have the right to object,
on grounds relating to his or her particular situation, at any time to processing of
personal data concerning him or her which is based on inter alia Article 6(1)(f) of the
GDPR, including profiling based on those provisions. The controller shall no longer
process their personal data unless the controller demonstrates compelling legitimate
grounds for the processing which override the interests, rights and freedoms of the
data subject, or for the establishment, exercise or defence of legal claims.
IMY:s assessment
Flightradar has stated that it has provided for the removal of information on aircraft on
Flightradar’s website in certain cases. From the documentation in the case, mainly
regarding complaint 3, it seems that Flightradar requires that a holder of a particular
IMY Case no: DI-2021-3397 19(23)
Date: 2025-06-30
aircraft must be able to demonstrate private ownership of an aircraft by showing the
aircraft's registration certificate before it accommodates blocking of the aircraft.
Flightradar has stated that, regarding complaint 1, the complainant has not submitted a
registration certificate and is therefore unable to get their request fulfilled. Furthermore,
the complainants in complaints 2 and 3 have been unable to show that they own the
aircraft, because the aircraft are registered to companies. The complainant in
complaint 4 has not been in contact with the company and has not made a request.
IMY has assessed that Flightradar processes personal data in some cases. IMY notes
that under Article 12(6) GDPR, a data subject must identify himself or herself before a
data controller can comply with a request for erasure under Article 17. In the present
cases, however, it is not necessary for the aircraft to be a privately owned in order for
the data relating to the aircraft to be regarded as personal data. Information about an
aircraft may in certain cases still be attributed to a specific person even if it is
registered to a company, for example in cases where the aircraft is used exclusively by
a single person. In such a case, a registration certificate proving the ownership, joint
ownership or possession of a particular aircraft cannot reasonably be a requirement for
the fulfillment of an erasure request. It is possible that the registration number can be
attributed to a particular person in some other way and not solely by a personal aircraft
registration certificate.
If the data subject is able to identify himself or herself, he or she then has the right,
with regard to the processing of his or her personal data, to object to the processing by
the company on the basis of Article 6(1)(f) of the GDPR pursuant to Article 21(1) of the
GDPR, after which the controller may continue to process the data only if it can justify
it with reference to compelling legitimate grounds.
IMY notes that, as a rule, the complainants should be considered to have identified
themselves if they have been able to produce certificates of registration proving that
the aircraft is registered to them personally. In any other case, Flightradar is required
to consider all other circumstances that may indicate that the complainants have
identified themselves and to handle their requests accordingly. It is only where there
are reasonable grounds to doubt the identity of the data subject that the controller may
request additional information pursuant to Article 12(6) of the GDPR. This may in
practice mean that, in certain cases, Flightradar is justified to require a data subject to
present a personal registration certificate. However, the company should also consider
other information relating to the identity of the complainant that is provided to the
company by the complainant.
Regarding complaint 3, IMY notes that the complainant has stated that the aircraft is
used only by him in his capacity as CEO of a company. It is commonly known that he
is the only pilot of this aircraft in Denmark. The complainant has contacted Flightradar
through his professional e-mail and has also submitted documentation showing that he
is the CEO of that particular company. IMY has found no reason to question the
information provided by the complainant. Under these circumstances, IMY considers
that the complainant has identified himself and that it is therefore clear that the
registration number and the location data of that aircraft constitute the complainant’s
personal data.
Flightradar has stated that it had previously blocked this complainant’s aircraft on the
basis of a HEX code submitted by the complainant, which was subsequently replaced
by another HEX code. This resulted in the aircraft reappearing on Flightradar’s
IMY Case no: DI-2021-3397 20(23)
Date: 2025-06-30
website. Flightradar believes that this demonstrates that the company needs to be
provided with a copy of a registration certificate in order to be able to block the right
aircraft.
IMY takes the view that Flightradar cannot be held responsible for the aircraft’s
reappearance when the submitted HEX code was no longer correct, although the HEX
code related to the correct aircraft at that time. IMY observes that this also
demonstrates that Flightradar in fact does have means to block aircraft without
requiring a registration certificate. The complainant’s submission of a registration
certificate should therefore not be a prerequisite for complying with a request for
erasure, if the complainant can identify himself by other means, which IMY believes
that the complainant has done now as well as in the past.
Regarding complaints 1 and 2, IMY notes that the contents in the file are not such that
make it possible to determine whether the complainants have identified themselves.
Flightradar should, however, consider any information with which it has been provided
and how it may indicate that the complainants have identified themselves, even if an
aircraft is registered to a company like in complaint 2.38 It is not sufficient for
Flightradar to refuse the complainant’s request simply by stating that the aircraft is
owned by a company. Flightradar should consider all the circumstances or evidence
provided to them by the complainants, in order to determine whether the complainants
have identified themselves in the handling and facilitation of their requests.
If Flightradar is unable to identify the complainants, it is then entitled to request
additional information about the identity of the complainants, for example the
registration certificate of the aircraft. However, the company cannot routinely request a
registration certificate as a prerequisite in order to a request for erasure, if such a
registration certificate is not necessary to identify a natural person.
In light of the above, IMY finds that Flightradar processed personal data in breach of
Articles 12(2) and 12(6) of the GDPR by having a routine to request personal
registration certificates and thereby not facilitating the exercise of the complainants’
right to erasure regarding complaints 1-3, and regarding specifically complaint 3,
requesting additional information to confirm the identity of the complainant without
demonstrating reasonable grounds to doubt the complainant’s identity.
However, the investigation does not show that Flightradar processed personal data in
breach of Article 17 of the GDPR, since it deleted data relating to the aircraft in
complaint 3 at an earlier stage and did not subsequently have any influence over the
change in HEX code which led to the reappearance of the aircraft on its website.
IMY finds no reason to question the information provided by Flightradar that the
complainant in complaint 4 did not make a request for erasure to the company. The
complainant does not allege this, but merely states that the data relating to the aircraft
was previously blocked through mediation by another data protection authority. IMY
has not examined whether there is a possible infringement of Article 17 of the GDPR in
relation to this complaint.
38 IMY has found that an aircraft registration number can constitute personal data even if it is registered to a company.
IMY Case no: DI-2021-3397 21(23)
Date: 2025-06-30
Furthermore, IMY finds no reason to question Flightradar’s statement that the aircraft
in complaints 1 and 3 are blocked on Flightradar’s website because they appear on the
FAA’s blocking list.
Choice of intervention
Applicable provisions
IMY has a number of corrective powers available under Article 58(2)(a) to (j) of the
GDPR, including reprimands, orders and fines, in case a controller has infringed the
GDPR. IMY shall impose fines, in addition to or instead of, other remedial measures
referred to in Article 58(2) GDPR, depending on the circumstances of each case.
According to recital 148 of the GDPR, in the case of a minor infringement, IMY may
issue a reprimand under Article 58(2)(b) instead of imposing a fine.
IMY:s assessment
IMY has found that Flightradar has failed in its obligations under Article 12 of the
GDPR in handling requests for erasure.
Flightradar has been mistaken in taking the view that their processing of aircraft
registration numbers does not at fall within the scope of the GDPR. In response to the
requests concerning the exercise of the right to erasure, the company has routinely
required a personal registration certificate as a prerequisite to handle each
complainant’s request and therefore not facilitated the exercise of the complainants’
right to erasure pursuant to Article 12(2), with regard to complaints 1-3.
When it comes to complaint 3, Flightradar has made the assessment that the aircraft
was registered to a company and therefore took the view that the registration number
was not personal data, which also meant that the company disregarded evidence that
the aircraft’s registration number could be linked to the complainant in such a way that
the complainant could be identified even without a personal registration certificate.
Flightradar therefore requested additional information from the complainant despite the
fact that it was not necessary.
However, despite Flightradar’s view that the GDPR was not applicable, the company
took certain measures in order to handle the complainants’ requests. Even if not all
measures were motivated and the complainants’ requests therefore were not fully
handled in accordance with the rules of the GDPR, the inadequacies in Flightradar’s
handling of the requests are of a less serious nature than if the complainants’ requests
had been left entirely unanswered. IMY notes that, despite the fact that Flightradar
were wrong to routinely request registration certificates, and in that the registration
number in complaint 3 was not the complainant’s personal data and thereby had not
identified himself, Flightradar nonetheless took measures to block the visibility of
aircraft.
IMY therefore finds that the infringement of Article 12(2) and (6) is a minor
infringement and that it is therefore not appropriate to impose a fine on Flightradar in
this regard. Flightradar should instead be subject to a reprimand under Article 58(2)(b)
of the GDPR.
IMY Case no: DI-2021-3397 22(23)
Date: 2025-06-30
IMY notes that the aircraft in complaint 1 and 3 are now blocked on the Flightradar
website due to their inclusion on FAA:s blocking list. Nevertheless, IMY considers it
important that Flightradar ensures that the complainants’ requests for erasure are
handled in accordance with the GDPR, which inter alia includes that the complainants
can no longer be identified with the information that is published on Flightradar’s
website, provided that the conditions for handling the request for erasure are otherwise
met, such as with complaint 3.
IMY considers that it is important that the company re-examines the complainant's
request in complaint 2 in accordance with the rules laid down in the GDPR, even if it is
not clear from the case documentation whether the complainant’s identified himself.
Flightradar should not routinely rely on personal registration certificates when such a
registration certificate is not necessary for a data subject to identify himself or herself.
Regarding complaint 1, which similarly to complaint 3 is blocked due to appearing on
FAA:s blocking list, the company should investigate and ensure that the information
that continues to be published on Flightradar’s website no longer enables the
identification of the complainant, insofar as the conditions for fulfilling the
complainant’s request for erasure are otherwise met.
IMY therefore orders Flightradar, pursuant to Article 58(2)(c) of the GDPR, to comply
with the complainant’s request for erasure in complaint 3 by ceasing the processing
which entails the publication of data relating to the complainant’s aircraft on
Flightradar’s website, with the result that the complainant can no longer be identified
with the information that is published on Flightradar’s website, in accordance with the
rules laid down in Article 17 of the GDPR.
IMY also orders Flightradar, pursuant to Article 58(2)(d) of the GDPR, to take the
required measures to ensure that the complainants’ requests for erasure in complaints
1 and 2 are handled in accordance with the rules laid down in Articles 12 and 17 of the
GDPR.
__________________________
This decision was taken by Head of Unit after a presentation by the
Legal Advisor
Annex
1. The complainants’ personal data
IMY Case no: DI-2021-3397 23(23)
Date: 2025-06-30
How to appeal
If you wish to appeal IMY:s decision, please write to IMY. Please indicate in your letter
the decision you are appealing and the amendment that you are requesting. The
appeal must reach IMY no later than three weeks from the date on which you received
the decision. If the appeal has been received in due time, IMY forwards it to the
Administrative Court in Stockholm for trial.
You can send the appeal by email to IMY if the appeal does not contain any sensitive
personal data or information that may be subject to confidentiality. IMY:s contact
details are set out in the first page of the decision.