Sanction RGPD Italian Data Protection Authority (Garante) — Azienda sanitaria unica regionale Marche : 14 k€ (2022)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Azienda sanitaria unica regionale Marche
- Montant de l'amende
- 14 k€
- Date de la décision
- 13 janvier 2022
- Fondement juridique
- Art. 5 (1) f), Art. 32, Art. 35
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Italian DPA has imposed a fine of EUR 14,000 on Azienda sanitaria unica regionale Marche. The DPA launched an investigation against the health department following media reports of deficiencies in the system used to collect and manage Covid 19 screening data. The health department used an app that generated QR codes for people who were tested for Covid-19. The QR code was generated based on a progressive criterion rather than on a random basis. Thus, each person was assigned a number. Because of this, it would have been possible for unauthorized persons to change a digit and gain access to another person's profile and thus personal data. The DPA found that the health authority failed to implement adequate technical and organizational measures to ensure a level of security appropriate to the risk to the data subjects.