Sanction RGPD Italian Data Protection Authority (Garante) — Azienda Ospedaliera Universitaria Careggi : 6 k€ (2021)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Azienda Ospedaliera Universitaria Careggi
- Montant de l'amende
- 6 k€
- Date de la décision
- 25 février 2021
- Fondement juridique
- Art. 5, Art. 9
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Italian DPA (Garante) has imposed a fine of EUR 6,000 on Azienda Ospedaliera Universitaria Careggi for a breach of Art. 5 GDPR and Art. 9 GDPR. Azienda Ospedaliera Universitaria Careggi had notified the DPA of a data breach under Art. 33 GDPR regarding the transfer of health data to the wrong person. Medical documents of a patient had been sent by mail both to the affected patient and to another patient. The controller states that the incident occurred due to an error in the printing process. The ward where the affected patient was treated was only equipped with two printers, and one doctor had unknowingly also taken a colleague's print job (the affected patient's documents) when taking out his print job (the documents of the wrong recipient).