Emirates – €180,000 Fine (Italy, 2026)

Emirates (the controller) is an airline company. In 2025, a data subject brought a complaint to the DPA regarding the controller’s processing activities of data subjects with disabilities or reduced mobility. The controller required persons with reduced mobility to complete a form to provide them with the transport services. This form processed names, contact details, health information, and medical certificates when needed. The controller presented the form without referring to the privacy notice and without obtaining data subjects’ consent. According to the data subject, the controller requested them to fill in the form despite them not needing the assistance. The controller required the data subject to provide their health data without explaining how it would be processed or obtaining consent for it. The controller argued that it requested this information as a preventative measure to ensure it can provide assistance to all data subjects that need it, in accordance with its obligations under EU law.The controller referred to Regulation 1107/2006 concerning the rights of disabled persons and persons with reduced mobility when travelling by air (https://eur-lex.europa.eu/eli/reg/2006/1107/oj/eng) The form was a standardised tool to collect the data necessary to determine whether a data subject needed assistance. In terms of data protection, the controller claimed it provided clear and accessible information. In addition, the processing was lawful under performance of a contract and to comply with legal obligations related to safety. The controller processed health data lawfully under substantial public interest. Finally, the controller made the form accessible to a limited number of parties, and retained the data for a period of 7 years to meet legal and defence requirements. The DPA first found that the controller did not violate Articles 5(1)(a), (b), (c), 6(1) and 9 GDPR. The DPA consulted the national authority responsible for monitoring compliance with the rights of passengers with disabilities (the Civil Aviation Authority, or ENAC). According to ENAC, the processing through the form was compliant with Article 5 GDPR, as it is strictly necessary to provide transportation services safely for passengers with disabilities or reduced mobility. Therefore, the DPA considered that the controller had a valid legal basis to process the data. However, the DPA found a violation of Articles 5(1)(a), 12 and 13 GDPR, as the controller had not complied with its transparency obligations. According to the DPA, the information provided in the form and privacy policy was vague, and did not inform data subjects of aspects such as the legal bases for processing and the retention periods. The DPA also found a violation of Article 5(1)(e) GDPR, as the controller did not comply with the principle of storage limitation. The DPA considered the retention periods for health data excessive, as they were based on hypothetical and highly unlikely future disputes. The DPA fined the controller €180,000. In addition, the DPA ordered the controller to review the categories of data subjects required to complete the form, provide complete information, and clarify which sections of the form can be left blank by data subjects (as the data is not necessary for the controller’s purposes). Finally, the DPA ordered the controller to reevaluate its data retention period.