GDPR breach? KM Malta shares customer data with old Air Malta

Air Malta, the airline set to stop operating on 30 March, processes supposedly unrelated personal information and booking data of KM Malta customers.

KM Malta bookings become visible on airmalta.com if KM Malta customers log in to their existing Air Malta user accounts after using the same email address for purchasing tickets from the supposedly ‘new’ airline on its separate website.

These bookings also became visible in certain instances when KM Malta customers entered their booking references for flights from 31 March on airmalta.com.

“I wanted to find out whether KM Malta actually acts like the new entity itself and the Maltese government claim it is”, one client told this news outlet.

“Entering any existing KM Malta booking reference into the Air Malta portal will result in the full booking information being displayed there,” they explained.

An exercise carried out by NEWZ.mt has confirmed this observation.

“It’s becoming clear that the airlines are not only using the same IT infrastructure – they are using the same database and there is no clean separation of personal data whatsoever”, another customer said.

This may constitute a violation of the GDPR, as KM Malta Airlines’ privacy policy does not cover data handover to Air Malta or data pooling with the old airline, and customers cannot be asked for blanket consent to data sharing with third parties.

Neither KM Malta Airlines nor Air Malta have responded to questions sent by NEWZ.mt on how customer’s consent to such data handover is being obtained.

The European Commission expected Malta to set up an entirely new national airline after refusing approval for further state aid for Air Malta.

Delays and apparent illegalities surrounding the launch of the government’s new airline have made headlines in the past months.

This article was updated on 31 January to help you better understand how KM Malta customer data became visible on airmalta.com.