Emirates Fined EUR 180,000 over Health Data Notices and Retention

On 9 October 2026, the European Data Protection Board (EDPB) published an English summary of the case concerning Emirates’ processing of passengers’ health data. In its decision of 14 May, the Italian data protection authority found that Emirates had failed to adequately inform passengers about the processing of their health data and had retained the data for too long. The authority fined the company EUR 180,000 and ordered corrective measures.

The case arose from a passenger’s complaint. She stated that Emirates had required her to complete a Medical Information Form (MEDIF), although she believed that she did not fall within the categories of passengers required to do so. She also complained that the airline had not adequately explained how it would process the data she provided. Emirates uses the form to collect information about passengers’ health, as well as information about their doctors and accompanying persons, to assess fitness to fly or arrange special assistance.

During the investigation, the Italian data protection authority consulted the Italian Civil Aviation Authority (ENAC) on the processing of the health data. The data protection authority accepted that Emirates could process the health data necessary to ensure flight safety and provide appropriate assistance to passengers with disabilities or reduced mobility. It therefore did not find the data collection itself unlawful. However, the authority also had to examine whether the company had adequately explained the processing to passengers and retained the data only for as long as necessary. It ultimately found that Emirates had infringed Articles 5(1)(a) and (e), 12 and 13 GDPR in these two respects.

1. Information about processing through the MEDIF form

In its defence, Emirates stated that it provided a general privacy notice in its website footer and channels for contacting its privacy office. It therefore considered that it had fully met its information obligations.

The authority found, however, that the MEDIF page merely explained in general terms that the company would use the form to assess whether passengers could fly safely and what assistance they needed. The company’s general privacy notice likewise stated only broadly that it needed to collect health information in certain circumstances. Because the company did not clearly explain when MEDIF was required, passengers could not determine in advance whether their health condition would require them to complete the form.

After the investigation began, Emirates added a link to its general privacy notice on the MEDIF page. The authority nevertheless considered that passengers still had difficulty identifying the purposes and legal bases for processing, while the notice did not specify retention periods. The addition of the link was therefore insufficient to meet the information requirements.

To enable passengers to understand when MEDIF was required, the authority ordered Emirates to assess, under the relevant aviation rules, which categories of passengers actually needed to complete the form and to explain this in the relevant information notices and on the form’s webpage. The authority also required the company to specify, for the different passenger categories, which sections had to be completed and which fields could be left blank. The company needed to explain why particular passengers had to provide the relevant information; merely listing “health data” as a category in its general privacy notice was insufficient.

2. The seven-year retention period for health data

Emirates continued to retain MEDIF forms for seven years after the journey ended. The company explained that aviation safety and audit requirements necessitated long-term retention of the records. It also argued that passengers might submit complaints or compensation claims years after travelling, requiring the company to keep documentation to defend its rights if a dispute arose.

The authority considered that, because the company collected health data to assess passengers’ fitness to fly, retention should be linked to the conduct and successful completion of the journey. For journeys that had generated no complaint or other issue, the authority viewed the possibility of litigation years later as abstract and unlikely. Relying on that possibility alone did not adequately explain why Emirates needed to retain health data for seven years after the journey.

On these grounds, the authority found that Emirates had breached the storage limitation principle. It ordered the company to reassess appropriate retention periods in light of the specific processing purposes and delete data retained beyond the new limits. The authority did not prescribe a uniform retention period in its decision; it required the company to assess and justify the appropriate duration itself.

For businesses that need to retain such records, this finding means that, when using limitation periods to inform retention schedules, they also need to explain the specific relationship between the data and potential disputes. For example, a company needs to explain what the records could establish and whether defending a dispute actually requires keeping the entire set of health records. Limitation periods can help a company assess when disputes may arise, but they cannot, on their own, establish a need to retain all data throughout that period.

References

EDPB case summary: https://www.edpb.europa.eu/news/italian-dpa-fines-emirates-eur-180-000-for-infringements-concerning-passengers-health-data_en; Italian data protection authority decision, sections 4.1, 4.2 and 6: https://garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10259296.