Firstly, you don't technically need any more information than name, ID, travelling intentions and payment details to sell someone a plane ticket. I'm baffled that you think more is required. A company can make a case in Europe for retaining some extra information, but they'd be on a sticky legal wicket if they retained lots of extraneous information. So whatever it is you think should be the case or is the case, legally in the EU and UK you are very wrong and case law backs me up. And yes, I have been both a data controller and made a request under GDPR, so I have actual experience of how it works. So, an example might be income - knowledge of your income might be argued as useful in terms of determining if trying to upsell a business class seat might be useful, however if it was used in Europe to modify your economy ticket price upwards, that would be a violation of law (although not GDPR). It might be just about arguable that information on your height might be relevant to offer you a seat with more leg room, but beyond that, you'd be struggling for justification under the GDPR