Sign in

Info Other, enforcement EU

Italian DPA fines Emirates EUR 180,000 for transparency violations in health data processing

Original title: Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data

Published
Source: edpb.europa.eu
Effective
Not stated
Deadline
Not stated
Framework: GDPR
Regulation (EU) 2016/679 (as corrected 2018) source
in 14 days
Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source

Why it matters

The Italian DPA fined Emirates EUR 180,000 for infringements of GDPR Articles 5, 12, and 13 in processing passengers' health data through MEDIF forms for fitness-to-fly assessment. While the data collection itself was found lawful, Emirates failed to provide clear information about which passengers must complete the form, the purposes, legal bases, and retention periods. The company must now clarify eligibility criteria, establish appropriate retention periods instead of the previous seven-year period, and delete excess data within 30 days.

What changed

  • Italian DPA ruled that the seven-year retention period for MEDIF health data was excessive and must be replaced with appropriate retention periods aligned with the purposes of fitness-to-fly assessment and in-flight assistance
  • Emirates must clearly identify which categories of passengers are required to complete MEDIF forms and specify which form sections and fields are mandatory
  • Emirates failed to provide sufficiently clear, complete, and transparent information to passengers about the processing of health data, including purposes, legal bases, and retention periods
  • Fine of EUR 180,000 imposed for violations of Articles 5(1)(a), 5(1)(e), 12, and 13 GDPR, with a compliance order requiring remediation within 30 days

Who is affected

Airlines processing passenger health data in the EU; Emirates specifically; passengers with disabilities or reduced mobility requiring fitness-to-fly assessment

What to do

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.

More changes in GDPR