Seconding the guess that it's so your card doesn't get frozen. If your bank knows you're meant to be in a specific place, they'll know transactions happening there aren't because someone's stolen your card. It would probably be a valid exception to GDPR on those grounds.

In fact, now you mention it, I'm guessing this is why my credit card company never raised any issue with me using the card in London a couple months ago, after buying train tickets to London on the same card. I thought that was odd, given they regularly ask me for 2FA on transactions that aren't unusual, but suddenly being halfway across the country wasn't flagged as being even remotely suspicious.

That said, I think the amount of information being given here does seem excessive. Just letting your bank know the destination and dates ought to be sufficient for security purposes. For data protection, it would be better if the airline said nothing, and your bank waited for you to tell them when and where you're travelling... but how many people would remember to do that?