Italy: data protection authority fines Emirates EUR 180,000 over passengers' health data

The Italian Data Protection Authority (Garante) has fined the airline Emirates EUR 180,000. The case began with a complaint from a passenger who was asked to complete the MEDIF form (Medical Information for Fitness to Travel or Special Assistance) although, by her account, she did not belong to the groups required to do so.

The authority found that processing health data through this form may be lawful where necessary to ensure safe air transport and provide appropriate assistance to passengers with disabilities or reduced mobility. No infringement was therefore found regarding the lawfulness of collecting such data.

However, the lack of information was sanctioned. Passengers could not easily tell in advance whether their condition required completing the form, nor clearly identify the purposes, legal bases and retention periods. The authority also considered the seven-year retention period excessive.

Emirates must bring the processing into compliance within 30 days. It must clearly identify which passenger categories have to complete the form and which sections are necessary, set appropriate retention periods, and delete data retained beyond that period. In setting the fine, the authority considered, among other factors, the limited number of passengers affected and the absence of any intention to discriminate.