Sanction RGPD Italian Data Protection Authority (Garante) — Società triveneta di chirurgia : 2 k€ (2021)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Società triveneta di chirurgia
- Montant de l'amende
- 2 k€
- Date de la décision
- 15 avril 2021
- Fondement juridique
- Art. 5 (1) a), c), Art. 6, Art. 9
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Italian DPA (Garante) has imposed a fine of EUR 2,000 on Società triveneta di chirurgia. A physician had shown slides of a clinical case at a congress, which were subsequently published on the controller's website. The slides contained personal data of a patient, such as the patient's initials, age, gender, a detailed history of the pathology suffered by the patient, details of admissions from 1980 to 2016 and the surgical procedures performed during this period, indicating the date of admission and surgery, the surgical department that performed the procedures, the days spent in hospital, numerous diagnostic images, and 22 photographs showing the patient during the surgeries. At no time had the data subject consented to such processing of his personal data.