Gaps in the management of health information of passengers with disabilities. This is what was found, following an investigation, by the Data Protection Authority, which imposed a fine of 180,000 euros on Emirates.
Insufficient transparency and data retention times deemed excessive are mentioned in the measure issued by the Italian Authority. The case, originating from a complaint by a female traveler, has put the spotlight on the MEDIF form used by the airline to assess fitness to fly.
THE CASE AND THE MEDIF FORM
The story begins with a report concerning the collection of sensitive data through the form called Medical Information for Fitness to Travel or Special Assistance (MEDIF).
According to what emerged, the airline made the actual provision of the service conditional on the completion of this document without providing adequate information or obtaining explicit consent. Specifically, the complainant reported having to provide “numerous health-related details for which I had no prior information on the processing methods.”
Emirates defended its actions explaining that the form is an international standard necessary to ensure the safety of air transport and to prevent medical emergencies at high altitude. The National Civil Aviation Authority also confirmed that acquiring health status details is a tool that helps avoid risks such as unscheduled landings.
DEFICIENCIES IN TRANSPARENCY
However, the Authority found that the methods by which passengers were informed did not comply with the principles of fairness and clarity provided by the European Regulation. Within the page dedicated to filling out the form, it simply stated that the data were used to assess whether the passenger could “fly safely and to what extent we can provide assistance during the journey.”
According to the Guarantor, the data subject was not given the possibility “to know in advance whether, due to their illness or personal condition, they would actually be subjected to such processing of personal data.” Although the company later added links to the general information notice, the explanations remained partial regarding the legal bases and specific purposes of the operation.
THE ISSUE OF DATA RETENTION
Another critical point concerned the length of time for which health information was stored in the company’s systems.
Emirates stated that it keeps the MEDIF forms for seven years following the trip, justifying this choice with the need to defend itself in potential legal disputes and to comply with the regulatory obligations of the United Arab Emirates.
However, the Authority challenged this duration, considering it disproportionate to the purpose of verifying fitness to fly, which usually ends with the completion of the transport. The measure emphasizes how retention for a period longer than necessary conflicts with the regulations, especially because the risk of legal disputes many years after the trip is “entirely abstract and unlikely.”
FINE AND CORRECTIVE MEASURES
In addition to the payment of the monetary fine, the Guarantor ordered the company to align its procedures with privacy rules within 30 days of notification.
Emirates will now have to identify shorter retention periods and proceed with the deletion of all data exceeding the newly established limit. The company was also ordered to conduct a review of all categories of subjects required to complete the form to clarify who is actually obliged to provide such details for safety reasons.
Despite the company’s defense, which highlighted that the processing concerns only 0.01% of total passengers, the violations were judged significant due to their nature and duration.
