Emirates fined €180,000 for mishandling sensitive health data, ordered to delete records

Quick summary

Italy’s data protection authority, the Garante per la Protezione dei Dati Personali, has fined Emirates €180,000 (approximately US $208,000) for mishandling sensitive health data collected from passengers with reduced mobility or medical conditions. The investigation, triggered by a passenger complaint in January 2025, found that Emirates violated core GDPR principles by failing to clearly inform passengers why their medical data was being collected and by retaining that data for seven years — a period the Garante deemed excessive and disproportionate.

The collection of health data for flight safety was ruled lawful. What wasn’t: the opacity around it, and the years-long retention of forms passengers had no idea were being kept.

Emirates has been ordered to overhaul how it handles passenger health data in Italy after the Garante found the airline kept medical records for seven years without adequately telling passengers why, who would see them, or how long they’d be stored. The ruling, issued following a complaint from a single passenger who was asked to complete a detailed medical form just to request wheelchair assistance, carries a €180,000 fine and a binding order to delete data older than three years.

The case centers on the MEDIF — Medical Information for Fitness to Travel — form that Emirates requires passengers with health conditions to complete online before flying. The Garante accepted that collecting this data is legitimate for safety reasons. What it rejected was Emirates’ failure to explain the process clearly and its practice of holding onto that sensitive information for years beyond any reasonable operational need.

For travelers flying Emirates on itineraries touching Italy, the immediate practical impact is limited — no flights are affected, no bookings need to change. But the decision has real implications for anyone who has ever submitted health details to an airline and assumed that data quietly disappeared after the flight.

What the Garante actually found — and what Emirates admitted

The investigation began when a passenger complained that Emirates appeared to require every field of the detailed MEDIF form to be completed, even for minor assistance requests such as a wheelchair at the gate. She also alleged the airline failed to present a clear privacy notice before collecting her data and did not seek her consent before processing it.

Garante’s review confirmed the airline’s right to gather medical information for safety and assistance purposes — aviation is a physiologically demanding environment, and in-flight medical emergencies are a genuine operational concern. But the authority found Emirates breached GDPR Articles 12–13 on transparency and Article 5(1)(e) on storage limitation. Privacy information on the airline’s website was unclear, and it was not evident which passengers were actually required to submit the form.

On retention, Emirates initially defended the seven-year period by citing litigation risk. The Garante pushed back — and Emirates itself then acknowledged that most legal claims against airlines on international routes must be filed within two years under the Montreal Convention. The airline has since begun reducing its retention period to three years, and the Garante has ordered deletion of all medical-form data held beyond that threshold.

Regulatory filings confirm the fine stands at €180,000, alongside corrective obligations covering both the information Emirates provides to passengers and its internal data-handling processes. The full ruling is documented in the Garante’s published decision.

Why this ruling reaches beyond one airline and one country

The Garante is not a minor regulator. It has previously imposed a €20 million fine against Clearview AI for unlawful biometric data processing — the Emirates case sits at the lower end of its sanction range, which can reach up to 4% of global annual turnover for serious violations. The authority has investigative powers, can order operational changes, and operates within the GDPR’s cooperation mechanism, meaning other EU data protection authorities can coordinate scrutiny of the same practices across their own jurisdictions.

That cooperation mechanism is the detail that makes this more than an Italian story. If Emirates’ updated privacy notices and revised retention periods — expected to appear on its EU-facing websites in the coming months — are substantive, the Garante’s decision will have driven real, measurable improvement for passengers across the bloc. If the changes are minimal or delayed, expect coordinated pressure from multiple EU authorities simultaneously.

Under GDPR Articles 77–82, passengers who believe their health data was mishandled can lodge complaints directly with their national data protection authority and may seek compensation through national courts for material or non-material damage. This is separate from flight-disruption regimes like EU261 — data protection remedies run on a different legal track entirely.

This case also sits alongside a broader pattern of Emirates navigating European regulatory pressure — the airline recently launched a paid conflict insurance product targeting passengers who fall outside mandatory EU protections, a move that itself drew scrutiny over what airlines owe passengers by default versus what they can charge for.

Steps to protect your health data when requesting airline assistance

Any passenger who has submitted medical or mobility-assistance information to an airline on itineraries touching the EU is now in a stronger position to demand transparency — and this ruling gives that demand regulatory teeth.

• Request the specific privacy notice before submitting any health data. Before completing a MEDIF or similar form with Emirates or any EU-operating carrier, ask via chat, email, or at check-in for the privacy notice that specifically covers medical-assistance data. Keep a copy. If none is provided, that itself is a compliance gap worth noting.
• Ask which fields are genuinely mandatory. The Garante found it unclear which passengers were actually required to complete the full form. If you are requesting minor assistance, ask whether all fields are compulsory or whether a subset suffices for your specific need.
• Exercise your GDPR deletion rights if you’ve previously submitted forms. If you submitted a MEDIF or equivalent to Emirates on flights involving Italy and are concerned about retention, contact Emirates’ data protection officer to request access to your data and, where appropriate, deletion. If the response is unsatisfactory, file a complaint with the Garante or your own national data protection authority.
• Corporate travel managers: review Emirates’ updated documentation. Staff who regularly book assistance for colleagues disclosing health conditions should monitor Emirates’ revised privacy notices — expected in coming months — and verify alignment with company data-protection policies.
• Senior travelers and families booking for elderly relatives: ensure the person concerned understands and agrees to what is being disclosed. Where possible, submit forms directly through secure airline channels rather than via intermediaries who may retain copies.

Watch: Emirates’ publication of revised MEDIF privacy notices and updated retention policies on its Italian and EU-facing websites. Substantive changes within the next few months would confirm the Garante’s order is producing real compliance improvements. Minimal or delayed updates would signal escalating multi-authority scrutiny is likely.

Questions? Answers.