In this case, the airline would have to get explicit consent for sharing the user's personal data with third parties. So at the very least, it will increase transparency. Post-GDPR, in the event of negligence, organizations like https://noyb.eu/ will become more relevant as mediums for collective action in the form of class action suits.
EDIT: (Addendum) - The user would also have the right to ask the first party (airline) to "require" third parties it has shared personal data with, to delete them. Enforcing this however, will be hard.
