Sanction RGPD Italian Data Protection Authority (Garante) — Azienda Ospedaliero Universitaria Integrata di Verona (Hospital) : 30 k€ (2020)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Azienda Ospedaliero Universitaria Integrata di Verona (Hospital)
- Montant de l'amende
- 30 k€
- Date de la décision
- 23 janvier 2020
- Fondement juridique
- Art. 5 (1) f), Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The fine was preceded by access to health data by unauthorised persons, allowing a trainee and a radiologist to gain access to the health data of their colleagues. The investigations revealed that the technical and organisational measures taken by the hospital to protect health data had proved to be insufficient to ensure adequate protection of patients' personal data, resulting in unlawful data processing. According to the data protection authority, the breach could have been avoided if the hospital had simply followed the guidelines for health records issued by the data protection authority in 2015, which stipulate that access to health records must be restricted only to health personnel involved in patient care.