Sign in

Italian DPA fines Emirates EUR 180,000 for insufficient transparency on passengers' health data processing

Original title: Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data

Info Other, enforcement EU

The Italian Data Protection Authority fined Emirates EUR 180,000 for infringements under GDPR Articles 12 and 13 relating to the processing of passengers' health data collected via MEDIF (Medical Information for Fitness to Travel or Special Assistance) forms. While the DPA determined that collecting health data was lawful under GDPR Article 6(1) and Article 9 when necessary for safe air transport and passenger assistance, Emirates failed to provide sufficiently clear and transparent information about the processing. Passengers could not easily determine whether they needed to complete the form or find information about purposes, legal bases, and retention periods. Airlines must ensure transparency obligations are fully met when collecting sensitive health data from passengers, including providing clear advance notice and easily accessible information about data processing.

What changed

  • /
  • Emirates received a EUR 180,000 fine for violating GDPR Articles 12 and 13 by failing to provide clear and complete information about health data processing
  • The Italian DPA required Emirates to comply with transparency obligations and provide passengers with sufficiently clear information in advance about whether they need to complete MEDIF forms
  • Airlines must ensure passengers can easily identify purposes, legal bases, and retention periods for health data processing before collection
  • The case clarifies that while collecting health data for passenger safety and assistance is lawful, controllers must provide transparent communication about such processing in accordance with GDPR Articles 12 and 13

Who is affected

Airlines and transport operators collecting health or special assistance information from passengers in the EU; controllers processing health data of passengers with disabilities or reduced mobility

Summary generated by a language model; the official text prevails. Not legal advice.

More changes in GDPR