THE HESSIAN COMMISSIONER
FOR DATA PROTECTION AND FREEDOM OF INFORMATION
September 02, 2025
# Final Decision
| IMI Article 56 entry | 628357 |
| --- | --- |
| IMI Case Register entry | 724407 |
| IMI Draft Decision | 805096 |
| National file number | 90.24.46:0320 |
| Controller | |
| Date of complaint | 15 April 2024 |
With regard to the abovementioned case and pursuant to Article 60(3) of the General Data Protection Regulation (GDPR), the Hessian Commissioner for Data Protection and Freedom of Information (hereinafter: DE-Hessen DPA) has issued the following final decision:
# Summary of the complaint
The Spain based complainant lodged a complaint with the Spanish DPA on 15 April 2024 which indicated the following:
When confirming a flight booking by email, the complainant noticed that her name was displayed incorrectly. Specifically, the complaint was that her second surname was erroneously shown as her main surname.
# Investigation by the DE-Hessen DPA
The DE-Hessen DPA found that the incorrect presentation of the name, specifically the reduction to the second surname in the email confirmation, was due to a technical error in the booking system. However, according to the full name had been properly processed, logged and saved internally. The display error related exclusively to certain output segments and had no impact on the integrity or protection of the processed data.
Furthermore, all personal data had been processed and stored in compliance with the applicable data protection and IT security standards. According to the controller, the complainant had not experienced any restrictions in her travel or booking processes as a result of the incorrect display.
Page 1 of 2
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 2 of 2
## Decision by the DE-Hessen DPA
Taking the facts into consideration, the DE-Hessen DPA considers the complaint investigated to the extent appropriate and resolved.
According to technical and organizational measures were immediately introduced to prevent similar incidents in the future. In particular, the source of the error is currently being analysed by the IT team. The investigation relates to automated change processes in the booking system. If necessary, appropriate software adjustments will be made to ensure the correct and complete presentation of personal data in all output channels on a permanent basis.
The above-mentioned decision was already included in the draft decision of July 16, 2025. According to the draft decision the measures outlined appeared to be appropriate and sufficient from a data protection perspective. For this reason, the DPA Hesse does not consider any further regulatory measures to be necessary. As none of the Supervisory Authorities concerned raised any objections to the Draft Decision, the HBDI submits this Final Decision and closes the file.
The DE-Hessen DPA
Page 2 of 2
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de