THE HESSIAN COMMISSIONER
FOR DATA PROTECTION AND FREEDOM OF INFORMATION
October 31, 2025
# Justification of the Draft Decision
| IMI Article 56 entry | 717140 |
| --- | --- |
| IMI Case Register entry | 808709 |
| IMI Draft Decision | 808797 |
| IMI Revised Draft Decision | 827270 |
| National file number | 90.24.46:0324 |
| Controller | |
| Date of complaint | 01 August 2024 |
With regard to the above-mentioned case and pursuant to Article 60(3) of the General Data Protection Regulation (GDPR), the Hessian Commissioner for Data Protection and Freedom of Information (hereinafter: DE-Hessen DPA) has issued the following draft decision:
# Summary of the complaint
The complaint was lodged by a Spain-based complainant on 1 August 2024. Following the booking of a flight ticket, the complainant requested a name change for her minor son. The airline, declined the request.
# Investigation by the DE-Hessen DPA
The DPA Hesse found that according to , name changes are generally granted as a goodwill gesture only within 24 hours of booking, and only under specific conditions. These include minor spelling errors (up to two letters), nickname corrections that substitute the official first name, name changes resulting from legal proceedings (e.g., marriage, divorce, gender reassignment, or new passport/ID), the reversal of first and last names, or the addition of an extra name.
In this case, however, the complainant requested a full change of the child's last name, which exceeded the scope of the airline's defined goodwill policy. None of the other acceptable reasons for a name correction applied.
Page 1 of 3
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de
Justification of the Draft Decision – IMI Case 717140
Page 2 of 3
According to [REDACTED] internal guidelines – which are based on security and fraud prevention consideration – such a substantial change is only possible by reissuing the ticket, which may be done free of charge only within the airline’s 24-hour cancellation and rebooking period. This grace period ends at 23:59 on the day following the booking, in line with industry standards.
The complainant had made the booking on 8 May 2024 but did not contact [REDACTED] customer service until 24 June 2024 – 38 days later – at which point the free rebooking period had already expired. [REDACTED] therefore stated that a name change would only have been possible by issuing a new ticket with the correct name.
### Proposed action by the DE-Hessen DPA
Taking the facts into consideration, the DE-Hessen DPA considered the complaint to have been investigated to the extend necessary and resolved accordingly.
On the basis of the information provided, no further action appeared to be required.
### Objections
According to the Finnish Data Protection Authority, the draft decision should determine whether [REDACTED] had a justified reason for not correcting the passenger’s second surname on a plane ticket. It was also argued that the draft decision did not establish whether [REDACTED] had complied with their obligations under Article 16 of the GDPR.
Furthermore, the Finnish Data Protection Authority considers that the airline’s policy of not allowing ticket details to be changed does not constitute a justified reason for disregarding the rights of the data subject. Consequently, the previous draft decision would not reference any legal basis—neither under the GDPR nor under the law of a Member State—for disregarding the data subject’s request. It was requested that this point be clarified.
Page 2 of 3
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de
Justification of the Draft Decision – IMI Case 717140
Page 3 of 3
## Final decision
The right to rectification under Article 16 GDPR is primarily intended to allow the correction of inaccurate data processed by the controller.
In this case, however, there is no evidence to suggest that the inaccuracy of the data is due to misconduct on the part of the controller. According to the information available, the incorrect name was provided by the complainant herself during the booking process.
Since the controller has therefore processed accurate data, there is no right to rectification under Article 16 of the GDPR. Rather, this is a contractual matter between the passenger and the airline, which does not fall within the scope of the General Data Protection Regulation.
Taking the facts into consideration, the DE-Hessen DPA considers the complaint investigated to the extent appropriate and resolved.
The DE-Hessen DPA
Page 3 of 3
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de