Emirates Fined €180K for Failing to Inform Passengers and Over-Retaining Health Data
Emirates collected sensitive health data from passengers with limited mobility but failed to provide adequate transparency about how that data would be used, violating GDPR's core principle of informed consent and clear privacy notices. Additionally, the airline retained this special-category health data far beyond what was necessary for its stated purpose, breaching the GDPR data minimisation and storage limitation principles. This case highlights that even when the legal basis for processing sensitive data is sound, organisations must still meet transparency and retention obligations. Regulators are increasingly scrutinising not just whether data collection is lawful, but whether individuals are meaningfully informed and whether data is deleted on schedule. Failing these obligations exposes organisations to significant fines and reputational damage.
Tactical Insight
Immediate actions
- Audit all forms and data collection points that gather special-category data (health, biometric, etc.) to verify that privacy notices are complete, plain-language, and accessible.
- Review current data retention schedules for special-category data and immediately purge any records held beyond the defined retention period.
Policy & Governance improvements
- Establish and enforce documented retention policies that specify maximum hold periods for each data category, with automated deletion or anonymisation triggers.
- Conduct a Data Protection Impact Assessment (DPIA) for every process involving health or other special-category data to ensure transparency obligations are fully mapped.
- Assign a Data Protection Officer (DPO) or equivalent role with clear accountability for monitoring GDPR Article 13/14 transparency requirements.
Detection & Compliance monitoring
- Implement periodic internal audits (at least annually) to verify that privacy notices remain accurate and reflect current processing activities.
- Deploy data inventory and classification tools to track where special-category data is stored, for how long, and who has access, generating alerts when retention thresholds are breached.