Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data
Italian DPA fines Emirates EUR 180,000 for GDPR infringements regarding passenger health data.
The Italian Data Protection Authority (DPA) has fined Emirates EUR 180,000 for violating GDPR principles related to the processing of passenger health data. The investigation, triggered by a passenger complaint, found that while collecting health data via a MEDIF form could be lawful for assistance, Emirates failed to provide clear and transparent information. Additionally, a seven-year data retention period was deemed excessive.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Emirates?
Get an email when a new story names Emirates, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEmirates violated GDPR by failing to provide clear and transparent information to passengers when collecting sensitive health data through MEDIF forms, and by retaining that data for an excessive seven-year period. Transparency and data minimisation are foundational GDPR principles — individuals must know how their data is used, and organisations must not hold it longer than necessary. This case demonstrates that even when data collection may be lawful in purpose, the manner of collection and retention practices can independently constitute violations. A single passenger complaint was enough to trigger a regulatory investigation, illustrating how exposed organisations are when their data governance processes are inadequate.