[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faOscB-9MomzQ3hKQfFVgZzoU-NeYSib17r1y-DhQ3k8":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"c5ce0139-508f-4601-b7c6-8b32635dedc3","Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data","italian-dpa-fines-emirates-eur-180-000-for-infringements-concerning-passengers-h-79e18b","Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data ikerinar Fri, 09\u002F10\u002F2026 - 09:26","The Italian Data Protection Authority (DPA) has fined Emirates EUR 180,000 for violating GDPR principles related to the processing of passenger health data. The investigation, triggered by a passenger complaint, found that while collecting health data via a MEDIF form could be lawful for assistance, Emirates failed to provide clear and transparent information. Additionally, a seven-year data retention period was deemed excessive.","Italian DPA fines Emirates EUR 180,000 for GDPR infringements regarding passenger health data.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-emirates-eur-180-000-for-infringements-concerning-passengers-health-data_en",null,"2026-10-09T07:26:37+00:00","2026-10-09T08:00:22.539231+00:00",7,[17],{"name":18,"type":19},"Emirates","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":12,"name":22,"slug":23},"Privacy Fines","privacy-fines",[25,30,35,40],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":41},{"id":20,"icon":12,"name":22,"slug":23},[],[18],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":61},"emirates-fined-180k-for-mishandling-passenger-health-data-under-gdpr","Emirates Fined €180K for Mishandling Passenger Health Data Under GDPR","Emirates violated GDPR by failing to provide clear and transparent information to passengers when collecting sensitive health data through MEDIF forms, and by retaining that data for an excessive seven-year period. Transparency and data minimisation are foundational GDPR principles — individuals must know how their data is used, and organisations must not hold it longer than necessary. This case demonstrates that even when data collection may be lawful in purpose, the manner of collection and retention practices can independently constitute violations. A single passenger complaint was enough to trigger a regulatory investigation, illustrating how exposed organisations are when their data governance processes are inadequate.",[52,53,54,55,56,57,58,59,60],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(e) – Storage limitation","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 13 & 14 – Information to be provided to data subjects","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.PO-P1 – Policies for data processing","NIST SP 800-53 IP-1 – Consent and Privacy Notice","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{}]