Italian Data Protection Authority fines Emirates €180,000 over inadequate health-data transparency

What happened

• The Italian Data Protection Authority fined Emirates €180,000 after finding the airline failed to provide clear information about its MEDIF health‑data form and kept the data for seven years, which was deemed excessive.
• The investigation began after a passenger complained about being required to complete the form despite not meeting the criteria.
• The DPA concluded the data collection could be lawful for safety reasons but cited violations of GDPR Articles 5(1)(a), 5(1)(e), 12 and 13.
• Emirates must clarify which passengers must complete the form, specify necessary fields, set appropriate retention periods and delete data beyond that period within 30 days.

Why it matters

Airlines handling passenger health information must ensure privacy notices clearly explain who must fill the form, why, and how long the data will be kept, and must align retention periods with the actual purpose.

Business impact

Non‑compliant carriers will need to redesign health‑data questionnaires and implement new data‑deletion workflows, potentially increasing operational costs.

What to check

1. 1

   Identify required passenger categoriesHigh priority

   Define and publish which passengers must complete the MEDIF form.

2. 2

   Clarify form fields and purposesHigh priority

   Update the MEDIF form and accompanying notices to specify necessary data, legal basis and purpose.

3. 3

   Set appropriate retention periodsHigh priority

   Limit storage of MEDIF data to the minimum time needed for fitness‑to‑fly assessments.

4. 4

   Delete excess dataHigh priority

   Remove any MEDIF records retained beyond the newly defined retention period.