Italy

Emirates

180,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-14.

Rank · Sector

#50

of 172 in Transportation and Energy

Rank · Italy

#64

of 555

Rank · All fines

#391

of 3,085

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-14
Controller / Processor: Emirates
Sector: Transportation and Energy
Quoted Articles: Art. 5 (1) a), e) GDPR, Art. 12 GDPR, Art. 13 GDPR
Type of violation: Insufficient fulfilment of information obligations

Summary

The Italian DPA has imposed a fine of EUR 180,000 on Emirates. In its capacity as an airline the controller required a data subject to fill out a questionnaire regarding their health status in relation to the travel of persons with reduced mobility. The data subject stated that they had not been informed about the processing of the data provided and had not consented to the processing of said data. Although the authority for the civil aviation sector in Italy found the processing to be lawful, the controller failed to adequately inform data subjects about the processing of their personal data and failed to delete the data once the processing purpose had been met.

Open original source Links to the regulator's original publication or another source.