Italy's data protection authority, the Garante, has imposed a fine of EUR 180,000 on Emirates airline over infringements relating to the processing of passengers' health data, as reported by the European Data Protection Board.
The case concerns the airline's handling of health-related information collected from passengers, a category of personal data that attracts heightened protection requirements under data protection law due to its sensitivity.
Details of the specific processing activities, the number of passengers affected, and the precise legal basis for the fine were not set out in the published summary. Organisations awaiting fuller details should consult the forthcoming decision text once available.
This action was taken under data protection law rather than the EU AI Act, but it is a useful reminder for organisations deploying AI systems that process health data, including airlines and other travel operators using automated systems for risk scoring, health screening, or passenger profiling.
As a compliance matter, organisations building or procuring AI systems that touch health data should bear in mind that such systems may fall within the EU AI Act's high-risk categories, depending on their intended purpose, and will in any event remain subject to separate data protection obligations around special category data.
Enforcement actions of this kind illustrate that regulators continue to scrutinise the handling of sensitive personal data even outside the AI Act framework, and that organisations preparing for AI Act compliance should not treat data protection obligations as a separate, lower priority. In practice, aligning data governance across both regimes reduces overall regulatory exposure.