THE HESSIAN COMMISSIONER
FOR DATA PROTECTION AND FREEDOM OF INFORMATION
September 02, 2025
# Final Decision
| IMI Article 56 entry | 636688 |
| --- | --- |
| IMI Case Register entry | 724406 |
| IMI Draft Decision | 808493 |
| National file number | 90.24.46:0321 |
| Controller | |
| Date of complaint | 23 February 2024 |
With regard to the abovementioned case and pursuant to Article 60(3) of the General Data Protection Regulation (GDPR), the Hessian Commissioner for Data Protection and Freedom of Information (hereinafter: DE-Hessen DPA) has issued the following final decision:
# Summary of the complaint
The Spain based complainant lodged a complaint with the Spanish DPA on 10 May 2024 which indicated the following:
Subject of the complaint was an incorrect booking entry, made by the complainant, who failed to enter the correct first name of his eleven-year-old-daughter in the "eDreams" booking portal.
informed the complainant, that the incorrect first name could have been corrected free charge at any time via the online travel agency eDreams. However, a free cancellation of the trip was no longer possible, as the 24-hour cancellation period following the booking on 13 February 2024 had already expired by the time the complainant contacted eDreams on 22 February 2024.
# Investigation by the DE-Hessen DPA
After consultation with the the DE-Hesse DPA determined that, in the case of a booking made through an online travel agency, eDreams alone is to be regarded as the controller within the meaning of Article 4 (7) GDPR with respect to the collection and processing of personal data.
A corresponding passenger name record (PNR) in the global distribution system (GDS) is only created after the booking is completed via Booking. Furthermore, the ticket was issued under travel agency's IATA number.
stated that it only becomes aware of the booking once it is transmitted via GDS and that it is not permitted to make changes to the transmitted data, as this
Page 1 of 2
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 2 of 2
would constitute an inadmissible interference with the contractual responsibilities of the travel agency. Therefore, any corrections must be made exclusively via the online travel agency through which the booking was made.
Finally, [REDACTED] confirmed that, according to their internal guidelines, the requested name correction would have been possible within the framework of internal guidelines and standard industry practice. However, no corresponding request was forwarded to them by eDreams via the designated agency support channel.
### **Decision by the DE-Hessen DPA**
As already stated in the draft decision of July 25, 2025, based on the provided statement and the responsibilities outlined in the booking and data processing procedure, no further measures are necessary. As none of the Supervisory Authorities concerned raised any objections to the Draft Decision, the HBDI submits this Final Decision and closes the file.
The DE-Hessen DPA
Page 2 of 2
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de