Garante per la protezione dei dati personali (Italy) - 347/2026
Italian DPA fines Emirates €180,000 for GDPR violations related to passenger assistance forms.
The Italian Garante per la protezione dei dati personali has fined Emirates €180,000 for violating GDPR. The airline failed to adequately inform passengers with reduced mobility about the processing of their health data via the MEDIF form and retained the data for an excessive period of 7 years. While the processing of health data was deemed lawful under specific conditions, the lack of transparency and excessive retention periods constituted a breach of GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Emirates?
Get an email when a new story names Emirates, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEmirates failed to adequately inform passengers with reduced mobility about how their sensitive health data collected via the MEDIF form was being processed, violating GDPR's transparency requirements under Article 13/14. Compounding this, the airline retained health data for 7 years without a lawful justification for that retention period, breaching the data minimisation and storage limitation principles. This case highlights that even when the underlying data processing is lawful, failures in transparency and retention governance can independently trigger significant regulatory penalties. Organisations handling special category data (such as health information) face heightened obligations and must ensure both clear communication to data subjects and strict enforcement of data lifecycle policies.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.