Information on the collection of personal data (Articles 12 and 13 European General Data Protection Regulation (GDPR))


Enforcement of air passenger rights according to Regulations (EC) No 261/2004, No 1107/2006, No1008/2008 and No2111/2005 and implementation of administrative offence procedures in the case of violations identified in relation to the above Regulations against airlines, airport management bodies or travel companies concerned on the basis of the detailed information provided in the complaints.

1. Name and contact details of the controller

38144 Braunschweig

2. Contact details of the Data Protection Officer

Data Protection Officer Mrs Hackenberg
38144 Braunschweig

3. Purpose and legal basis of the data processing

3.1 Your data is collected for the following purpose:

The processing of your personal data provided in the context of a complaint is performed to exercise the function assigned to the Luftfahrt-Bundesamt as the national complaints and enforcement body for the above-mentioned Regulations.

The Luftfahrt-Bundesamt shall conduct administrative offence procedures against airlines, airport management bodies or travel companies concerned on the basis of the information provided in your report. The information provided in your report will be used as evidence in the implemented administrative offence procedures; you yourself shall be a witness in this context.

The aim of the procedure conducted by Luftfahrt-Bundesamt is to avoid future violations against the above-mentioned Regulations and to improve the implementation of the Regulations in the company concerned.

Relevant information in the context of the procedure we conduct includes, in particular, the surname, first name and address of the air passenger affected by the violation against the above-mentioned Regulations as well as the booking and flight data of the flight that is the subject of the dispute. If it is not possible to sufficiently clarify the necessary facts of the case due to missing or incomplete information, we will refrain from issuing a sanction and will end the processing of the complaint you have submitted. The personal data you have provided will then not be forwarded to third parties and will be deleted after the expiry of the period mentioned under Section 6.

3.2 The legal basis on which your data is collected:

  • Article 6(1)(e) GDPR
  • Regulation (EC) No 261/2004 (in particular Article 16)
  • Regulation (EC) No 1107/2006 (in particular Articles 14 to 16)
  • Regulation (EC) No 1008/2008 (in particular Articles 24 and 26)
  • Regulation (EC) No 2111/2005 (in particular Article 13)
  • Administrative Offences Act (OWiG) and Criminal Procedure Code (StPO) (in particular § 158 para. StPO in conjunction with § 46 para.1 OWiG and § 66 para.1 No. 4 OWiG

4. Recipients or categories of recipients of personal data

Your personal data will be forwarded to the airline, airport management body or travel company concerned in the context of clarifying the facts of the case and, after instigation of an administrative office procedure, in the context of the hearing.

If the case is subject to the competence of the complaints and enforcement body of another EU Member State (NEB) (NEB Regulation (EG) No 261/2004 und NEB Regulation (EG) No 1107/2006), your data will be forwarded to this authority for further processing.

If an administrative office procedure conducted by us results in an effective appeal by the company concerned and the fine notice issued from here is upheld following a legal review, the procedure shall be handed over and in relation thereto your personal data will be transferred via the public prosecutor’s office to the competent district court.

5. Transmission of personal data to a third country

Personal data will be transferred exclusively in connection with the tasks assigned to us as the national complaints and enforcement body to companies involved from Member States or indeed from third countries and, where applicable, other national complaints and enforcement bodies (NEB) (NEB Regualtion (EC) No. 261/2004 and NEB Regulation (EC) No. 1107/2006).

6. Periods stipulated for the deletion of the different data categories

In the procedure your data will be deleted with the following time periods:

  • in the case of the imposition of a fine, two years after legal effect
  • n all other cases, one year after final processing

The above-mentioned periods shall begin at the end of the respective calendar year.

7. Rights of data subjects according to the GDPR

7.1 Right to information

According to the General Data Protection Regulation (GDPR) the data subject can also request in particular information as to whether, and - if yes -what data the Luftfahrt-Bundesamt processes in relation to him/her, where it has obtained this data from, who it transfers this data to, how long it is stored and whether he/she can request the correction, erasure or a restriction to the processing of this data. .

7.2 Right of rectification

If personal data processed by the Luftfahrt-Bundesamt is incorrect or incomplete, the data subject can request the immediate rectification or completion of this data.

7.3 Right of erasure

The Luftfahrt-Bundesamt must erase personal data pertaining to the data subject immediately if the data is no longer required for the task fulfilment or the data subject has revoked his/her consent and there is no other legal basis for the processing, or the data is processed unlawfully.

7.4 Right to restriction of processing

If the processing has been restricted the Luftfahrt-Bundesamt may in principle only process personal data with the consent of the data subject. The data subject can request such a restriction if: he/she has disputed the accuracy of the data and subsequently for a reasonable time period in which the controller verifies whether this is true; if the processing is unlawful, but the data subject has requested a restriction of use rather than a deletion; if the Luftfahrt-Bundesamt itself no longer requires the data, but the data subject does in order to exercise his/her rights.

7.5 Right to data portability

If the data processing is performed automatically and is based on a consent or a contract, the data subject has the right to receive the personal data concerned that he/she has provided Luftfahrt-Bundesamt in a structured, common and machine-readable format.

7.6 Right of objection

Insofar as the data processing by the Luftfahrt-Bundesamt is subject to the EU General Data Protection Regulation (that is all processing areas of the Bundesamt up to the conduct of administrative offence procedures), the data subject has the right, for reasons that arise from his/her particular situation, to object to the processing of personal data pertaining to him/her.

7.7 Right of revocation with respect to consent

If the data processing is based on a consent, the data subject has the right to revoke the consent at any time with effect for the future. A declared revocation does not affect the lawfulness of the processing performed up until the notice of revocation.

8. Rights of data subjects in administrative offence procedures

If personal data is processed in the context of an administrative offence procedure the data subject has the following rights:

  • Right to request information on the personal data being held in relation to you (§ 57 BDSG, Federal Data Protection Act)
  • Right of rectification, erasure, restriction of processing(§ 58 BDSG). Objection to the processing if the statutory criteria for this are fulfilled
  • Right to complain to the state representative for data protection and freedom of information (§ 60 BDSG)

You can assert your rights as a data subject vis-á-vis the Luftfahrt-Bundesamt to email address E-Mail or to the address stated in Section 1 above.

Note: Please note that communication with the LBA by email or fax is unencrypted. For reasons of data protection law, we therefore recommend that you use the post for inquiries that contain personal data.

9. Right to complain to a supervisory authority

The data subject also has the right according to Article 77 GDPR and/or § 60 BDSG 60 BDSG to raise a complaint with the state representative for data protection and freedom of information (BfDI) as the supervisory authority responsible for the Luftfahrt-Bundesamt, if he/she believes that the processing of his/her personal data is not being performed in accordance with the data protection regulations. The contact details of the BfDI are:

State representative for data protection and freedom of information (BfDI)
Husarenstraße 30
53117 Bonn

10. Automated decision-making/Profiling

Automatic decision-making, including profiling, within the meaning of Article 22 GDPR does not take place.

11. Provision of personal data

The provision of personal data is necessary for the instigation of an administrative offence procedure. Without the provision of personal data the allegations raised in the complaint cannot be pursued.

Use of cookies

Cookies help us to provide our services. By using our website you agree that we can use cookies. Read more about our Privacy Policy and visit the following link: Privacy Policy