Sanction RGPD Italian Data Protection Authority (Garante) — Fondazione Policlinico Tor Vergata di Roma : 15 k€ (2021)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Fondazione Policlinico Tor Vergata di Roma
- Montant de l'amende
- 15 k€
- Date de la décision
- 21 avril 2021
- Fondement juridique
- Art. 5 (1) a), f), Art. 13, Art. 25, Art. 32
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Italian DPA (Garante) has imposed a fine of EUR 15,000 on Fondazione Policlinico Tor Vergata di Roma. In February 2020, a data subject filed a complaint with Garante alleging a breach of data protection laws in relation to the booking services for medical specialists offered by the controller. In order to book a relevant appointment on the booking portal, visitors had to fill out an online form in which various personal data was requested. As the DPA found, the controller had not implemented adequate technical and organizational measures to ensure the protection of data processing. In addition, the controller did not comply with its information obligations pursuant to Art. 13 GDPR, as it had not properly informed the data subjects about the processing of their personal data at the time of the data collection.