The Danish Data Protection Authority approved the use of legitimate interest to justify the systematic digitization of customers' boarding passes in duty-free shops, relying notably on the immediate anonymization of unnecessary data.

Facts and context

The Danish Data Protection Authority (Datatilsynet) published on September 29, 2026, a closure decision without sanction against Gebr. Heinemann Retail concerning the digitization of boarding passes in duty-free shops at Copenhagen airport.

The case originated from an initiative audit conducted by the authority in 2025, focused on digital tracking in public spaces.

Reasons for the decision

The authority analyzed the compliance of the practice regarding the obligation to have a legal basis for processing.

• Obligation to have a lawful legal basis (Article 6 of the GDPR): The data controller justified the digitization of boarding passes by its legitimate interest in reliably determining and documenting whether a sale was eligible for exemption from taxes and customs duties, in accordance with the customs administration's authorization. Although the scanning of the Aztec code involved collecting data not strictly necessary for this purpose (full name and seat number), this information was immediately anonymized in the system after reading. Only relevant data (departure and destination airports, flight number) were retained. The authority validated this approach, considering that the company's interest in quickly ensuring the tax status of sales and avoiding direct and significant financial losses was not overridden by the rights and freedoms of customers. To reach this conclusion, it relied on the nature of the data collected, the technical measures implemented to reduce risks (notably immediate anonymization), and the absence of a less intrusive alternative to achieve the objective with the same efficiency, in accordance with the principles of Article 29 Working Party Opinion 6/2014 on additional safeguards. The authority also referred to Recital 47 of the GDPR, emphasizing that customers could reasonably expect such processing in this context.

Authority's decision

Consequently, the authority closed its investigation without finding any infringement or imposing any sanction against Gebr. Heinemann Retail ApS.

Lessons learned

This decision reminds that:

• Legitimate interest can constitute a valid legal basis for data collection, even if it seems intrusive, provided its necessity is rigorously demonstrated and the impact on data subjects is actively minimized by robust technical measures.
• Immediate anonymization of personal data not necessary for the pursued purpose is a decisive risk mitigation measure in balancing interests.
• Demonstrating the absence of a less intrusive and equally effective alternative is a central element to justify the necessity of processing under legitimate interest.