Italian DPA fines Emirates €180,000 for health data infringements

What happened

The Italian Data Protection Authority imposed an administrative fine of EUR 180,000 on Emirates for violations of GDPR transparency and retention requirements concerning passengers' health data. Emirates was ordered to clarify which passengers must complete the MEDIF form, specify necessary fields, and reduce the seven‑year data retention period. The decision was issued on 14 May 2026.

Penalty

administrative fine of EUR 180 000

Why it matters for trust and compliance

• Its status is decided. The case has an outcome that others may cite.
• The enforcement highlights GDPR obligations for clear information and proportionate retention of health data in the aviation sector.
• Takes effect May 14, 2026.
• Penalty: administrative fine of EUR 180 000.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Revisit retention schedules and data minimisation for the data involved.
3. Confirm handling of sensitive data categories meets the stricter rules.