Such information would be classified as 'Personally Identifying Information' under the Data Protection Act 1998.
It is your legal right not to have this data communicated to another party unless it meets one of the conditions under Schedule 3 of the Act (which the Telegraph article would suggest it would). Specifically, I imagine they would use the following condition:
7. - (1) The processing is necessary-
(a) for the administration of justice,
(b) for the exercise of any functions conferred on any person by or under an enactment, or
(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.
The ticket vendor should have made you aware of the fact that they intended to pass on this information to an outside organisation (and this would likely be in the small print, of course).
You would be entitled to issue a "Section 10 notice" to the airline, giving them 21 days to cease processing your data on the grounds that such processing would cause you "substantial damage or distress which is unwarranted". You might attempt to argue potential for identity fraud is a major concern.
I don't give much for your chances of them agreeing that it does cause you distress, regretably.