Italy fines Emirates over passenger health data handling violations

Wednesday 17 - 10:02

Italy’s data protection authority has imposed a €180,000 fine on Emirates airline over the alleged improper handling of passengers’ health-related data, marking another enforcement action in Europe’s tightening privacy regulatory environment.

According to the Italian regulator, the case originated from a passenger complaint claiming that she was required to complete a medical form despite not falling into any category that would normally necessitate such documentation. The authority subsequently examined the airline’s data processing practices for passengers with reduced mobility.

While the regulator concluded that collecting certain health data can be justified for operational and safety reasons, it identified multiple violations related to transparency and data retention. Officials stated that Emirates did not provide sufficiently clear or complete privacy information to passengers, either through its website or via airport staff responsible for assistance services.

The investigation also found that the airline retained sensitive medical data for up to seven years. The authority described this retention period as excessive and disproportionate, emphasizing that personal health information should be stored only for as long as strictly necessary.

The ruling highlights the strict application of European data protection standards, particularly regarding sensitive categories of personal data such as health information. Under EU privacy rules, including the General Data Protection Regulation (GDPR), companies are required to ensure transparency, data minimization, and limited storage periods when processing personal data.

Emirates has not yet publicly responded to the decision.

The case underscores the increasing scrutiny faced by international airlines operating in Europe, where regulators have intensified oversight of how passenger data is collected, processed, and stored. Authorities across the European Union have consistently warned that violations involving sensitive data can result in significant financial penalties and reputational damage.

As digital systems and personalized travel services become more widespread, regulators are expected to continue focusing on ensuring that passenger rights to privacy are fully respected across the aviation sector.