Sanction RGPD Italian Data Protection Authority (Garante) — Azienda Ospedaliero Universitaria di Parma : 10 k€ (2021)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Azienda Ospedaliero Universitaria di Parma
- Montant de l'amende
- 10 k€
- Date de la décision
- 27 janvier 2021
- Fondement juridique
- Art. 5 (1) f), Art. 9
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Italian DPA (Garante) fined Azienda Ospedaliero Universitaria di Parma EUR 50,000. The controller, a hospital, had reported two data breaches to the Italian DPA in which patient data was mistakenly disclosed to third parties. In the first incident, parents found the report of a microbiological examination of another patient in the file of their minor child. The report revealed the data subject´s name, tax number, address, birth date and various health data. In the second incident, the heir of a patient received the health report of another patient, which contained the name and birth date as well as data on the health status of the data subject.