Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data

What happened

The Italian Data Protection Authority fined Emirates €180,000 after finding the airline failed to provide clear information about its MEDIF health‑data form and kept the data for seven years, which was deemed excessive. The investigation began after a passenger complained about being required to complete the form despite not meeting the criteria. The DPA concluded the data collection could be lawful for safety reasons but cited violations of GDPR Articles 5(1)(a), 5(1)(e), 12 and 13. Emirates must clarify which passengers must complete the form, specify necessary fields, set appropriate retention periods and delete data beyond that period within 30 days.

Why it matters

Airlines handling passenger health information must ensure privacy notices clearly explain who must fill the form, why, and how long the data will be kept, and must align retention periods with the actual purpose.

Business impact

Non‑compliant carriers will need to redesign health‑data questionnaires and implement new data‑deletion workflows, potentially increasing operational costs.

Checklist

• Identify required passenger categoriesHigh priority

  Define and publish which passengers must complete the MEDIF form.

• Clarify form fields and purposesHigh priority

  Update the MEDIF form and accompanying notices to specify necessary data, legal basis and purpose.

• Set appropriate retention periodsHigh priority

  Limit storage of MEDIF data to the minimum time needed for fitness‑to‑fly assessments.

• Delete excess dataHigh priority

  Remove any MEDIF records retained beyond the newly defined retention period.

Who reported it

Discussion