Italian DPA fines Emirates EUR 180,000 over passenger health data
The Italian DPA fined Emirates EUR 180,000 for failing to provide clear information about processing of health data via MEDIF forms and for excessive retention. Emirates must comply within 30 days.
- Framework
- GDPR
- Who it concerns
- Emirates
What changed?
Each point with the sentence from the source that says it.
Emirates failed to provide sufficiently clear, complete and transparent information about the processing.
However, Emirates failed to provide sufficiently clear, complete and transparent information about the processing.
The Italian DPA also found that the seven-year retention period applied to MEDIF data was excessive in relation to the purposes of assessing fitness to fly and providing assistance during the journey.
The Italian DPA also found that the seven-year retention period applied to MEDIF data was excessive in relation to the purposes of assessing fitness to fly and providing assistance during the journey.
The Italian DPA imposed an administrative fine of EUR 180 000 on Emirates for infringements of Articles 5(1)(a), 5(1)(e), 12 and 13 GDPR.
The Italian DPA imposed an administrative fine of EUR 180 000 on Emirates for infringements of Articles 5(1)(a), 5(1)(e), 12 and 13 GDPR.
The Italian DPA also ordered Emirates, within 30 days, to bring the processing into compliance.
The Italian DPA also ordered Emirates, within 30 days, to bring the processing into compliance.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Privacy Notice
Review privacy notices to ensure they clearly identify categories of passengers required to complete MEDIF forms and specify which sections and fields are necessary.
- Data Retention and Erasure Policy
Review retention periods for MEDIF data to ensure they are not excessive in relation to the purposes of assessing fitness to fly and providing assistance.