Sanction RGPD Italian Data Protection Authority (Garante) — Azienda Universitaria Friuli Occidentale : 55 k€ (2022)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Azienda Universitaria Friuli Occidentale
- Montant de l'amende
- 55 k€
- Date de la décision
- 15 décembre 2022
- Fondement juridique
- Art. 5 (1) a), Art. 9, Art. 14, Art. 35, Art. 2-sexies Codice della privacy
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Friuli Occidentale. The health authority has created patient profiles using algorithms and personal patient data to indicate the risk of having complications in the event of a Covid 19 infection. This was intended to identify appropriate diagnostic and therapeutic pathways in a timely manner in the event of complications. However, the DPA found that the health authority did not have a valid legal basis to process patients' personal data for profiling. In addition, the DPA found that the health authority had failed to conduct a data protection impact assessment. In calculating the fine, the DPA took into account the aggravating factor that a large number of individuals were affected.