Italian DPA fines Emirates €180,000 for health data infringements
The enforcement highlights GDPR obligations for clear information and proportionate retention of health data in the aviation sector.
ADTP Regulatory Watch· October 9, 2026· Italian Data Protection Authority
ImpactHigh 66
Type💰 Fine
Statusdecidedcase outcome
JurisdictionEU-IT
What happened
The Italian Data Protection Authority imposed an administrative fine of EUR 180,000 on Emirates for violations of GDPR transparency and retention requirements concerning passengers' health data. Emirates was ordered to clarify which passengers must complete the MEDIF form, specify necessary fields, and reduce the seven‑year data retention period. The decision was issued on 14 May 2026.
Penalty
administrative fine of EUR 180 000
Why it matters for trust and compliance
Its status is decided. The case has an outcome that others may cite.
The enforcement highlights GDPR obligations for clear information and proportionate retention of health data in the aviation sector.
Penalty: administrative fine of EUR 180 000.
It relates to GDPR. The regulations library explains what that law requires.
Who is affected
controllerEmirates
Recommended actions
Check that privacy notices describe the practices this addresses.
Revisit retention schedules and data minimisation for the data involved.
Confirm handling of sensitive data categories meets the stricter rules.