Cybersecurity Policy Report, Italy Fines Airline Over Improper Retention of Passenger Health Data, (Jun 18, 2026)

By Tony Foley

Garante, the Italian data protection authority, announced yesterday that it had fined Dubai-based airline Emirates 180,000 euros ($206,000) for beaches of transparency obligations and data retention limitations under the European Union’s General Data Protection Regulation (GDPR).

The fine was issued following a complaint made by a passenger that Emirates made the provision of assistance for passengers with disabilities conditional upon the completion of the Medical Information for Fitness to Travel (MEDIF) form, which is intended to collect information on a passenger’s health, details of the attending physician, and any accompanying person, despite the fact that the complaining passenger did not belong to one of the categories of passengers required to complete the documentation. The complainant further alleged that the information provided regarding the processing of data collected through the MEDIF form was inadequate.

In its decision, issued last month, Garante found Emirates’ processing of the health data at issue to be legitimate because it was necessary to ensure the safe transportation and assistance of passengers with disabilities or reduced mobility. The agency also concluded, however, that Emirates failed to provide data subjects with sufficiently clear and complete information, either through its website or through its staff members dealing with disabled passengers. In addition, Garante noted that the company maintained the data collected through the MEDIF form for seven years, which the agency said was excessive and disproportionate to the intended purpose of collection, which was limited to the organization and proper execution of the passenger’s trip.

In addition to the fine, Garante ordered Emirates to update it privacy policy, specifying the categories of passengers required to complete the MEDIF form and which sections are mandatory. It also required Emirates to establish retention periods consistent with the purposes of the processing and to delete data retained beyond the period deemed appropriate for these purposes.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR