- in European Union
- within Strategy, International Law and Tax topic(s)
Italian DPA Fines Emirates Over Passenger Health Data Practices
The Italian Data Protection Authority (“Garante”) imposed a €180,000 fine on Emirates following its investigation into the airline’s processing of passengers’ health data through its Medical Information for Fitness to Travel (“MEDIF”) process. While the authority confirmed that processing health data for the purpose of providing safe travel and special assistance was lawful and did not require consent, it found that Emirates failed to provide passengers with clear and comprehensive privacy information regarding the processing activities. Additionally, the airline retained health data collected through MEDIF forms for seven years, which the authority considered excessive and disproportionate in light of the purpose of processing. The decision highlights that even where the processing of special category data is lawful, organizations must still comply with the GDPR’s transparency and storage limitation principles.
CNIL Calls for Vigilance on Smart Glasses
The French Data Protection Authority (“CNIL”) has warned that the increasing use of AI-powered smart glasses raises significant privacy, ethical, and societal concerns. Unlike smartphones, smart glasses can discreetly capture images, audio, and other personal data, making it difficult for individuals to know when they are being recorded. The CNIL cautions that widespread adoption could normalize continuous surveillance and lead to self-censorship in public spaces. While the use of smart glasses remains subject to the GDPR, the authority emphasized that existing legal requirements alone may not be sufficient to address the broader societal risks. The CNIL has therefore announced an action plan to monitor technological developments, contribute to regulatory discussions, and raise public awareness of the privacy implications of smart glasses.
UK proposes social media ban for under-16s and wider online safety restrictions
The UK Government has announced plans to ban children under the age of 16 from accessing major social media platforms, including TikTok, Instagram, Facebook, Snapchat, YouTube and X, as part of a broader initiative to enhance children’s online safety. The proposal also introduces additional restrictions on gaming platforms, livestreaming services, and AI chatbots, limiting features such as communication with strangers and access to AI chatbots capable of explicit conversations. The measures would require robust age verification, with enforcement overseen by Ofcom, and non-compliant companies could face significant penalties. The proposed restrictions are expected to be presented to Parliament later this year, with implementation targeted for Spring 2027.
Canada Introduces Bill C-36 to Modernise Privacy Framework
Canada introduced Bill C-36 on 18 June 2026, a comprehensive reform of its privacy framework addressing emerging risks associated with artificial intelligence, automated decision making, and digital technologies. The proposed legislation recognises privacy as a fundamental right, strengthens protections for children’s data, introduces enhanced deletion and transparency rights, and establishes a new independent regulator with significant enforcement powers. The reform represents one of Canada’s most significant privacy law developments in decades.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
