Full text
67 paragraphsSEE ALSO Newsletter of September 11, 2026 [Web Doc. No. 10293994] Decision of September 3, 2026 Register of Decisions No. 616 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, members; and Attorney Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the “General Data Protection Regulation” (hereinafter the “Regulation”); HAVING REGARD TO the Code on Data Protection (Legislative Decree No. 196 of June 30, 2003), (hereinafter the “Code”); HAVING REGARD TO the “Guidelines on Health Records” adopted by the Data Protection Authority on June 4, 2015 (Decision published in the Official Gazette No. 164 of July 17, 2015, web doc.
No. 4084632); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); HAVING CONSIDERED the documentation on file; HAVING REGARD TO the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the Office of the Data Protection Authority, available at www.gpdp.it, web doc. No. 1098801; Rapporteur: Prof. Ginevra Cerrina Feroni; WHEREAS 1. FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1 Origin of the preliminary investigation The Authority received a complaint from XX alleging multiple violations of the regulations governing the processing of personal data carried out by the Friuli Centrale University Health Authority (ASUFC) through the institutional health record.
applies Art. 15
In particular, the main complaints concerned the following aspects: 1. Access in 2022 to the complainant’s health record by XX to verify whether she had tested positive for COVID-19, for the purpose of scheduling shifts on the ward. In this regard, in the copy—included in the case file—of the complaint filed by ASUFC with the Public Prosecutor’s Office at the Court of Udine, the Authority characterizes this access as “not abusive,” as it was “carried out on the representation of medical management” “for the performance of work duties”; 2. Access to the complainant’s medical records by XX, XX, and XX, who were not treating her. With regard to these instances of access, in the copy of the aforementioned complaint—included in the case file—the Hospital describes such access as “improper and unlawful” because the complainant was not under the care of the aforementioned healthcare professionals and suggests that this constitutes a criminal offense under Art. 615-ter of the Code, specifying that the aforementioned professionals work on “shared computers” located in rooms with a high volume of staff traffic and that, therefore, someone may have taken advantage of a temporary absence of the account holder to access the complainant’s medical records; 3. the ability for healthcare staff to access medical reports from other healthcare facilities (e.g., the CRO in Aviano) through the “SDAWEB” appointment scheduling system (see the undated ASUFC note signed by XX in response to the complainant—on file); 4.
The possibility for healthcare staff to access, via the health record, all reports from the surgical department regardless of whether they are treating the patient (so-called “cross-departmental access”) (see undated ASUFC note signed by XX in response to the complainant—on file); 5. Lack of access log files for the “SDAWEB” booking system (see undated ASUFC note signed by XX in response to the complainant—on file). 1.2 Actions Taken Following the aforementioned complaint, the Office requested information from ASUFC via a note dated March 4, 2026 (Ref. No. 33109), to which a response was provided in a note dated April 1, 2026. In that response, ASUFC specifically represented the following regarding the aforementioned: point 1 that: “The need to know the test results promptly was also dictated by the necessity to protect the health of patients admitted to the various facilities and that of the hospital staff themselves.
(…) knowledge of a negative test result was a prerequisite for access to the ward, and the only tool available to the healthcare system that ensured this rapid verification was, precisely, the test result viewer—health record system. Given the emergency situation and the well-known difficulties it entailed for the organizational management of healthcare facilities, it was not possible at the time to implement other methods for conducting the aforementioned verifications”; “While it is true that, in accordance with the Guidelines, the health record may be accessed by healthcare personnel as part of the patient care process, it is also true that, in an emergency context such as that caused by COVID-19, the use of this same tool—always and in any case on an exceptional basis—for the described verifications could be considered justified by the fact that the purpose pursued through its use was aimed exclusively at directly protecting the health of the healthcare worker and, indirectly, the health of patients”; Point 2 states that: “Access to the file is granted by entering personal credentials, and currently, all the Company’s computers have a policy whereby the screen locks if the keyboard is not touched for more than 30 minutes.
To resume the session, the User must re-enter their username and password. Alternatively, before stepping away, the User can lock the workstation by pressing the CTRL-ALT-DEL keys. The choice of this timeframe results from a balance between the operational needs of healthcare workers and security requirements.” The staff members involved in this specific case work in an emergency department, and “logging out is very often not a priority for staff when they are called away due to a code red or a patient’s sudden deterioration, and sometimes there isn’t even time to do so”; Training courses were conducted for staff on the use of the medical records viewer in 2022 and 2024, and “following Insiel’s provision of the dedicated dashboard, a periodic audit process was also initiated for staff members who accessed the health record after completing the declaration of accountability”; Point 3 states that: “It is not possible to access any medical reports through the SDAWEB scheduling system”; Point 4 states that: the ability of healthcare personnel to access, via the health record, all medical reports from the surgical department regardless of whether they are treating the patient (so-called “cross-departmental access”) “meets organizational needs related to staff rotation within the department, which have necessitated cross-departmental visibility within the surgical department.”
“To the best of our knowledge, the configuration adopted in this manner has never facilitated or encouraged improper access to third party health records, and, in fact, no reports to that effect have ever been received”; point 5 states that: the SADA Web system tracks: “login/logout operations from the system; the identifier of the operator who performed registration or appointment cancellation operations; the identifier of the operator who performed administrative document management operations (invoices, notes, receipts, reimbursements, cash transactions).” Regarding the configuration of the health records in healthcare facilities within the Friuli-Venezia Giulia Region, this Office, in a letter dated November 11, 2025 (Ref. No. 153069), requested information from the aforementioned Region and from Insiel S.p.A.. In an email dated December 18, 2025, the aforementioned Region sent a response in which it did not directly provide substantive information regarding this Office’s request, but merely referred the matter—for a “joint and coordinated response”— to the contents of the note prepared by Insiel S.p.A., as the processor for data owned by the companies of the Regional Health Service (SSR).
In the aforementioned response, Insiel confirmed that the Document Viewer tool is in use within the Regional Social and Health Information System (SISSR) as a common application component and that it is made available to all Health Authorities and IRCCS by the Region. In particular, this response represented that: over the past six months, the Document Viewer has recorded a total of approximately seven million accesses, of which over 82% were made following administrative registration and just under 18% via self-declaration; “The new feature designed to enable controllers to independently configure self-declarations, in line with their own organizational structure and respective care pathways, is nearing completion; the related application development is currently underway, with implementation currently scheduled—barring a change in prioritization of other ongoing projects—by the first half of 2026”; “With regard to the developments in the self-certification form, it will allow for the customization of a precise level of access based on role and specific professional expertise within a given care pathway”; “To date, deep learning solutions for the automatic analysis of access behaviors have not yet been implemented; however, these approaches fall within the scope of the broader regional strategy for the use of AI technologies in healthcare, in accordance with Law No. 132 of September 23, 2025, on artificial intelligence.”
With specific reference to the degree of autonomy that healthcare organizations have regarding changes to be made to the health record, INSIEL has specified that “The Document Viewer application is part of the portfolio of solutions offered by the Regional Social and Healthcare Information System (SISSR), made available by the Friuli Venezia Giulia Region, through INSIEL, to all Regional Health System (SSR) agencies and IRCCS institutions. System upgrades and adjustments are reviewed in technical working groups involving the responsible parties and INSIEL, coordinated by the DCS, to assess their consistency, technical and organizational feasibility, and priority, taking into account the resources actually available and the expected benefits for the entire Regional Health Service, with a preference for scalable and uniform solutions. Based on the outcomes of these discussions, INSIEL incorporates the agreed-upon guidelines and translates them into technical implementation measures, ensuring their technological sustainability.
Controllers therefore operate within a framework of harmonized choices regarding data processing methods, as part of the convergence toward a shared regional system.” In relation to the matters set forth in the records, at the Office’s request, a remote meeting was held on March 4, 2026, with representatives from the Friuli Venezia Giulia Region, INSIEL, and another regional health authority,during which it was reaffirmed that responsibility for the processing carried out through the dossier lies with the regional healthcare agencies and the IRCSSs and, consequently, that the prerogatives of the aforementioned entities—in their capacity as controllers—must be effectively respected to ensure full compliance with personal data protection regulations. 2. INITIATION OF PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND SANCTIONING MEASURES AND THE PARTY’S DEFENSE 2.1 Initiation of proceedings (Art. 166, paragraph 5, of the Code) Based on the review of the evidence gathered during the activities described above and the verification of the alleged violations, by a notice dated May 4, 2026 (Ref.
No. 67418), served in accordance with Article 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures provided for in Article 58, para 2, of the Regulation against the controller, inviting the controller to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The alleged violations in question are violations of the basic principles of processing referred to in Articles 5(1)(a), para 1, (b), (c), and (f), Articles 9, 25, and 32 of the Regulation, Article 75 of the Code, and the Guidelines on Health Records dated June 4, 2015. The violation of the aforementioned provisions renders applicable the administrative sanction provided for in Article 83, para 4 and para 5, of the Regulation. 2.2 The Party’s Defense (Article 166, paragraph 6, of the Code) In a brief filed on May 28, 2026, the Company reiterated the arguments already presented in the case file and highlighted, in particular, that: - “The use of the same, albeit, as already mentioned, on an exceptional basis, for the described checks, is considered to be in line with the various Protocols adopted at the national level to combat and contain the spread of the SARS-CoV-2/COVID-19 virus in the workplace (Joint Protocol Regulating Measures to Combat and Contain the Spread of the COVID-19 Virus in the Workplace, dated March 14, 2020; Protocol for the Prevention and Safety of Workers in Healthcare, Social-Healthcare, and Social-Welfare Services Regarding the “COVID-19” Health Emergency dated March 24, 2020), which require that the employer be informed of the worker’s health status, but also in line with the institutional mission of every healthcare organization, namely its care-providing function”; - “Both the national collective bargaining agreement for healthcare personnel and the company regulations governing working hours for healthcare management stipulate that shift schedules must be finalized by the 20th of the preceding month”; - “On the day XX reviewed her medical report, a course of treatment was already underway—that is, she had been admitted for care—as she had scheduled an outpatient appointment for the same specialty”; - Since 2024, a system has been in place to detect any anomalies by examining an Excel file containing the results of queries run on the viewer audit; - “Given the high number of staff on duty, the sharing of workspaces—especially in emergency room areas—and in the absence of conclusive evidence, it is plausible to assume that whoever actually viewed XX’s list of documents “taken over” the PC workstation logged in with the noted credentials just 2 minutes, or 5, or 10 minutes after the colleague who owned the account had left the workstation; therefore, even with a shorter lockout period, access would still have occurred”; - the Company has a “systemic vulnerability” with regard to malicious behavior by employees. 3.
applies Art. 5(1)(a), Art. 9, Art. 18, Art. 25, Art. 32, Art. 58, Art. 75, Art. 83
THE AUTHORITY’S ASSESSMENTS
Based on the factual circumstances highlighted above and the statements made by the Company during the investigation conducted by the Office, for which the declarants are accountable pursuant to Article 168 of the Code, it is deemed appropriate to confirm the violations identified in the notice of violation for the reasons set forth below. As a preliminary matter, it is noted that the processing of personal data must comply with applicable data protection laws and, in particular, with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”) and Legislative Decree No. 196 of June 30, 2003 (Code on Data Protection—hereinafter, the “Code”). With regard to the processing activities in question, the Data Protection Authority has adopted the “Guidelines on Health Records – June 4, 2015” (Decision of June 4, 2015, published in the Official Gazette No. 164 of July 17, 2015, available at www.gpdp.it doc web No. 4084632), which set forth an initial framework of precautions to define specific safeguards and accountability, as well as the necessary and appropriate measures and precautions to protect citizens, in relation to the processing of health data concerning them, which, like the Authority’s other measures, continue to apply even after the full implementation of the Regulation, as they are compatible with it (Art. 22, paragraph 4, Legislative Decree No. 101/2018).
applies Art. 22
Pursuant to the Regulation, where processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health, such processing must be carried out on the basis of Union or Member State law, which must provide for appropriate and specific measures to safeguard the data subject rights and freedoms, in particular professional secrecy (Articles 9, para. 2, subparagraph (i)). Since the declaration of a state of emergency by the Council of Ministers on January 31, 2020, in accordance with the provisions of the European Regulation regarding the pursuit of public interest objectives in the field of public health (Art. 9(2)(i) cited above), of the Regulation), numerous emergency legislative measures have been adopted, which also contain provisions regarding the processing of health data carried out in the context of interventions related to the COVID-19 health emergency—measures that resulted from a delicate balancing of public health needs against those related to data protection.
applies Art. 9(2)(i), Art. 9
In particular, with specific reference to the regulations adopted in our country, pursuant to the aforementioned Art. 9(2)(i) of the Regulation, to address the aforementioned public health emergency, Article 17-bis of Decree-Law No. 18/2020 did not and could not have derogated from the data protection rules—which, it should be noted, are based on a European Regulation—but rather provided for certain simplifications, not applicable to the present case, regarding the processing and disclosure of personal data among different controllers—to be applied only if such processing were indispensable for the purposes of carrying out activities related to the management of the public health emergency and, in any case, in compliance with the principles set forth in Art. 5 of the Regulation and by adopting appropriate measures to protect the data subject rights. The processing of personal data related to the management of the aforementioned public health emergency was therefore required to be carried out in full compliance with the applicable regulations on data protection and, in particular, with the principles and limitations applicable to processing, as set forth in Art. 5 of the Regulation, according to which data must be processed lawfully, fairly, and in a transparent manner with respect to the data subject (“lawfulness, fairness, and transparency”), “collected for specified, explicit, and legitimate purposes” and subsequently processed in a manner that is not incompatible with those purposes and, in any case, “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (principles of purpose limitation and data minimisation) (Art 5, para 1, subparagraphs (a), (b), (c), and (f) of the Regulation).
applies Art. 9(2)(i), Art. 5, Art. 17
No provision adopted during the pandemic—not even the protocols established at the national level to combat and contain the spread of the SARS-CoV-2/COVID-19, or the national collective bargaining agreement for healthcare workers cited by the Company in its documents, has provided for measures derogating from the aforementioned principles, the specific regulations applicable to health records, or those relating to data processing carried out within the context of the employment relationship, as discussed below. With specific reference to the use of the health record during the pandemic, please also note the measures dated November 10, 2022 (web doc. no. 9819792) and October 12, 2023 (web doc. no. 9954220). In the first of these, a healthcare agency was sanctioned for having modified the rules governing access to health records during the emergency period, thereby thereby, all healthcare personnel to consult the health records of any patient who had been treated by the agency, regardless of whether the person accessing the records was involved in the data subject’s care pathway or whether the data subject had given consent to the processing of data contained in the records.
In the second case, similar to the present case, another health authority was fined for using the health record for the purpose of organizing hospital shifts. On that occasion, the Authority noted that, given the optional nature of the health record and the incompleteness of the information it contains (see the right to have data redacted), it cannot be used for purposes related to the management of the data controller’s organizational and administrative needs, even in cases where, as in the present case, the data controller acts in both the capacity of employer and as the healthcare authority treating the data subject (see also Decision of May 26, 2022, web doc. no. 9791909). It should also be noted that, generally speaking, an employer may process employees’ personal data (Art. 4(1) of the Regulation), including data relating to “special categories of personal data,” in the management of the employment relationship, provided that the processing is necessary “to comply with a legal obligation to which the controller is subject” (Articles 6(1)(c), 9(2)(b), and 4; 88 of the Regulation) or when it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6, para. 1, subpar. e), 2 and 3, and Art. 9, para. 2, subparagraph g), of the Regulation; Arts. 2-ter and 2-sexies of the Code, as in the version prior to the amendments made by Decree-Law No. 139 of October 8, 2021).
applies Art. 4(1), Art. 6(1)(c), Art. 9(2)(b), Art. 2, Art. 4, Art. 6, Art. 9
More specifically, the processing of data concerning employees’ health may be lawfully carried out only when it is “necessary for the purposes of fulfilling the obligations and exercising the specific rights of the controller or the data subject in the field of employment law, social security, and social protection, to the extent that it is authorized by Union or Member State law or by a collective agreement pursuant to Member State law, subject to appropriate safeguards for the fundamental rights and data subject rights” (Art. 9, paras. 2(b) and 4 of the Regulation; see also Art. 88 of the Regulation and Recitals 51–53). In this context, it should be noted that, consistent with what has been clarified since the “Guidelines on the Processing of Employees’ Personal Data for the Purpose of Managing Employment Relationships in the Public Sector” (Provision No. 23 of June 14, 2007, doc. No. 1417809)—whose principles are still considered valid—the employer may process personal data concerning employees’ health, in compliance with data protection principles and applicable sector-specific provisions, only for the purposes and under the conditions provided for by law or upon specific recommendation by the occupational physician, who is the only person legally authorized to perform health surveillance tasks, in compliance with the specific limits and requirements established by the regulations governing health and safety in the workplace (Legislative Decree No. 81 of April 9, 2008).
This separation of roles is, moreover, confirmed by the structure of the Regulation, which treats processing necessary for “occupational medicine” purposes as a separate category (Art. 9, para. 2, subpara. h), and Art. 3 of the Regulation)—a scope that encompasses the role of the competent physician as provided for by national law—as distinct from those implemented by the employer to fulfill its obligations “under labor law,” including those established by the regulations on “occupational health and safety” (see the combined provisions of Articles 9(2)(b) and 88 of the Regulation; on the role of the employer and the occupational physician, also in light of the emergency regulatory framework, guidance document dated May 14, 2021, web doc. no. 9585367). Even in the exceptional emergency situation, given the challenges arising from the representative need to protect workplace safety and the related processing of personal data, employers were required to operate within the scope and limits set forth by the applicable regulations, which constitute the legal basis for such processing, avoiding the implementation of measures not provided for by law—including the specific provisions introduced during the emergency period and in workplace safety protocols—which could have adverse effects on data subjects in the workplace and professional context.
applies Art. 9(2)(b), Art. 3, Art. 9, Art. 88
In this context, in the absence of express statutory provisions, employers were therefore not permitted to collect and process—either directly from the data subjects or, as in the present case, from other sources—personal data, including data concerning the worker’s health status (see: these principles have been reaffirmed in numerous measures adopted during the pandemic, starting with the FAQs on “Data Processing in the Public and Private Workplace Context During the Health Emergency,” Web Doc. No. 9337010, and more recently in Decision No. 195 of May 26, 2022, Web Doc. No. 9788986, albeit in relation to cases different from the one at hand). It should therefore be noted that no emergency provision has provided for the possibility of accessing such information through the health record, which, as already noted, is an optional and, by its very nature, incomplete information tool that may be used exclusively for the purpose of treating the data subject.
In this regard, the arguments presented in the defense briefs regarding the fact that, at the time of accessing the data subject’s health record, “a course of treatment was underway—that is, she had been admitted for care—since she had scheduled an outpatient appointment for the same specialty” are irrelevant, since the access was not carried out for treatment purposes but, as expressly acknowledged by the Health Authority, for the management of work shifts. From another perspective, it is important to note that in the aforementioned Guidelines, the Data Protection Authority, in order to prevent the risk of unauthorized individuals accessing information processed through the health record or of authorized individuals disclosing health data to third parties, has specifically recommended that the controller pay particular attention to defining authorization profiles and training authorized personnel, as access to the health record must be limited solely to healthcare personnel involved in the patient’s care, and technical authentication methods for the health record must be adopted that reflect the specific access scenarios for this tool characteristic of each healthcare facility.
To this end, in the aforementioned Guidelines, the Data Protection Authority instructed controllers to monitor the circumstances in which relevant healthcare personnel may need to consult the health record for the purpose of treating the data subject and, based on this assessment, to identify the various access authorization profiles. This guidance is fully consistent with the principle of “data protection by design” (Art. 25, para. 1, of the Regulation), according to which the controller must also implement appropriate technical and organizational measures to implement the principles of data protection (Art. 5 of the Regulation) and incorporate into the processing the necessary safeguards to meet the requirements of the Regulation and protect the rights and freedoms of data subjects. Similarly, the Data Protection Authority has repeatedly emphasized the importance of the controller specifying the scope of access to the information contained in the health record, particularly in cases where access is granted to staff performing administrative functions related to the data subject’s care.
In such cases, in fact, the data controller, in accordance with the aforementioned principle of data minimisation, must establish limitations on the “scope of access” to the record by the staff assigned to these functions, allowing them to access only the data essential for performing the tasks assigned to them (e.g., staff responsible for scheduling diagnostic tests or specialist appointments may consult only the data essential for making such appointments). With regard to the case in question, it should be noted that the data controller must ensure data protection through appropriate technical and organizational measures to prevent unauthorized or unlawful processing (the principle of “integrity and confidentiality”)” (Art. 5, para. 1, subpars. (a) and (f) of the Regulation). In this regard, the Regulation requires the controller to implement “appropriate technical and organizational measures to ensure a level of security appropriate to the risk,” taking into account, among other things, “the nature, scope, context, and processing purposes, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons” (Article 32 of the Regulation).
Among the principles applicable to processing set forth in Art. 5 of the Regulation, the principle of accountability is also worth highlighting here, according to which “the controller must comply with and be able to demonstrate compliance with the principles and obligations set forth in the Regulation” (Articles 5(2) and 24 of the Regulation). Linked to this is the aforementioned duty incumbent upon the controller, namely to ensure that the rights and regulations concerning data protection for data subjects’ personal data are safeguarded and applied from the design stage and by default (privacy by design and by default, Art. 25 of the Regulation). In this regard, a representative of this Authority has noted that in the aforementioned Guidelines, this Authority has held that “the controller must implement systems to control access, including access to the database, and to detect any anomalies that could constitute unlawful processing, through the use of anomaly indicators (so-called alerts) useful for guiding subsequent audit activities.
The controller must therefore establish specific alerts that identify anomalous or risky behavior related to operations performed by data processors (e.g., regarding the number of accesses, their type, or the time frame in which they occur)” (point 7, subparagraph b). With specific reference to the automatic locking of a computer due to inactivity, the aforementioned principles require the data controller to establish an appropriate inactivity period, after which the computer automatically locks; this must be done in light of the nature, subject matter, context, and processing purpose, as well as the risk—of varying likelihood and severity—to the rights and freedoms of natural persons. It is therefore necessary to establish, by design, an assessment of the inactivity period for triggering the automatic lockout that takes into account the specific needs associated with the company’s various operational areas, with the aim of minimizing latency time without compromising the effectiveness of the care pathway (see ruling of May 9, 2024, web doc. 10027595).
Nor is the argument put forward by the Company in its defense briefs acceptable, namely that, given the high number of staff on duty and the sharing of workspaces—especially in emergency room areas—“it could plausibly be assumed that whoever actually viewed XX’s list of documents ‘taken over’ the PC workstation logged in with the noted credentials after only 2 minutes, or 5, or 10, from the time the colleague who owned the account had left the workstation, and, therefore, even with a shorter lockout period, access would have occurred anyway.” This assertion does not appear admissible, as the implementation of an automatic lockout feature tailored to the specific needs of the company’s various operational areas would have reduced the risk of unauthorized access—that is, it would have constituted an appropriate technical measure to ensure a level of security commensurate with the risk, as required by the Regulation.
In this regard, the Company’s aforementioned “systemic vulnerability” to malicious behavior by employees should have prompted the controller to adopt all technical and organizational measures aimed at reducing the risk of unauthorized access, including measures with a deterrent purpose. Regarding the implementation, starting in 2024, of a system for detecting potential anomalies by examining Excel files containing the results of queries run on the viewer audit, it is noted that the Company has not adopted a system for the automatic detection of any anomalies that could constitute unlawful processing, nor has it implemented anomaly indicators (so-called “alerts”) designed to identify anomalous or high-risk behavior related to operations performed by authorized processors (e.g., number of accesses, type, or time frame of such accesses), which would be useful for guiding subsequent audit actions; instead, the Company has limited itself to conducting only retrospective checks in the event of a complaint by data subjects.
The documentation on file shows that this Company had not even adopted a system for conducting random checks of access to patient records. In particular, it could have conducted random checks during the pandemic to verify whether the measures adopted had resulted in access to patient records by staff who were not treating the patient. Such a measure would undoubtedly have served as a deterrent against attempts at unauthorized access by healthcare personnel. Taking into account the supplementary measures to the medical report viewing system indicated by Insiel S.p.A. and the statements made by the Friuli-Venezia Giulia Region at the meeting on March 4, 2026, as well as the fact that a report was filed with the Public Prosecutor’s Office regarding some of the facts under examination, based on the evidence gathered and the documentation in the case file, it has been established that the configuration of the health record carried out by the Health Authority, as demonstrated by the facts under review, was conducted in violation of the basic principles of data processing set forth in Articles 5(1)(a), (b), (c), and (f), 9, 25, and 32 of the Regulation and Art 75 of the Code, as well as the aforementioned Guidelines of the Data Protection Authority.
applies Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(f), Art. 9, Art. 25, Art. 32
The violation of the aforementioned provisions renders applicable the administrative sanction provided for in Art 83, para 4, subparagraph (a), and para 5, subparagraph (a), of the Regulation. 4. CONCLUSIONS. In light of these considerations, the allegations set forth in the notice initiating the proceedings pursuant to Art. 166 of the Code are confirmed, as the statements made during the investigation and the defenses raised are insufficient to rebut the findings made by the Office and, moreover, none of the cases provided for in Art. 11 of Regulation No. 1/2019 apply. Therefore, the Authority finds that the conduct of the Friuli Centrale University Health Authority (ASUFC) was unlawful, for having configured the institutional health record system in such a way as to: allow access to XX’s health record for purposes other than treatment—namely, to verify her COVID-19 status—for the purpose of scheduling shifts on the ward; failing to implement automatic controls on access to the health record; setting a single inactivity time limit of 30 minutes for all company devices, after which the computer is locked, without taking into account the specific needs associated with the different operational areas of the company, with the aim of minimizing latency time without compromising the effectiveness of the care process; in violation of Articles 5(1)(a), (b), (c), and (f), 9, 25, and 32 of the Regulation and Article 75 of the Code, as well as the aforementioned Guidelines of the Data Protection Authority. 5.
applies Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(f), Art. 9, Art. 11, Art. 25, Art. 32, Art. 75
CORRECTIVE MEASURES Art 58(2) of the Regulation grants the Data Protection Authority a series of corrective powers—both prescriptive and punitive—to be exercised in the event that unlawful processing of personal data is ascertained. Among these powers, Article 58(2)(d) of the Regulation provides for the power to “order the controller or processor to bring the processing into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time limit.” In light of the assessments referred to above, taking into account the statements made in the case records and given that the pandemic period has ended, it is deemed necessary to order the Company, pursuant to the aforementioned Art. 58(2)(d) of the Regulation, to report, within (60) sixty days of notification of this order, the measures adopted to: restrict access to the medical records exclusively to the pursuit of treatment purposes, excluding access by personnel acting in their capacity as the data subject’s employer; introduce the use of automatic anomaly indicators (so-called “alerts”) and automatic computer lockout systems for inactivity that take into account the specific needs related to the Company’s various operational areas, with the aim of minimizing latency time without compromising the effectiveness of the care pathway.
applies Art. 58(2)(d)
That being said, recital 3 of the decision adopted by the Authority on July 3, 2026, against another healthcare company in the Friuli-Venezia Giulia Region, states that information was requested from the Region itself and from Insiel regarding the status of the measures implemented for the “Visore referti” system, the Authority reserves the right to adopt further corrective measures pursuant to Article 58, para 2, of the Regulation. 6. INJUNCTION ORDER Pursuant to Article 58, para 2, subparagraph (i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction order (see Articles 18 of Law No. 689 of November 24, 1981, and 16(1) of the Data Protection Authority’s Regulation No. 1/2019). 6.1 Assessment of the Conduct and Determination of the Applicable Penalty Given that the violation of the aforementioned provisions resulted from a single act of conduct, Article 83(3) of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation.
applies Art. 83(3), Art. 18, Art. 58, Art. 83
In the present case, the most serious violations are subject to the penalty provided for in Art. 83(5). 6.2 Determination of the administrative fine (Art. 83(2) of the Regulation) The amount of the administrative fine must be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Given that the processing involved health data of a female employee of the Company during the pandemic period, carried out “on the representation of medical management” and based on the configuration choices for both regional and company-level health records, the overall level of severity is considered moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, given that the controller is a university health care system, it is considered that, for the purposes of quantifying the fine, the following circumstances must be taken into account: the use of the health record to determine hospital shifts was carried out with the representation of the hospital’s medical administration; the Authority has repeatedly intervened regarding the proper configuration of the health record to prevent unauthorized access, including through measures adopted against organizations belonging to the same region; the Authority became aware of the case in question through a complaint; In light of the aforementioned factors, evaluated as a whole, and in accordance with the principles of effectiveness, proportionality, and deterrence set forth in Art. 83, para 1, of the Regulation, it is hereby determined that the amount of the monetary penalty shall be 24,000 (twenty-four thousand) euros for the violation of Articles 5, para 1, subparagraphs a), (b), (c), and (f), Articles 9, 25, and 32 of the Regulation, Article 75 of the Code, and the Guidelines on Health Records dated June 4, 2015.
applies Art. 83(2), Art. 83(5), Art. 5, Art. 9, Art. 25, Art. 32, Art. 75, Art. 83
In conclusion, it is considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the ancillary sanction of publishing this section of the decision—containing the injunction—on the Data Protection Authority’s website must be imposed, given the impact that the settings in the company’s health records may have had on a considerable number of patients. FOR THESE REASONS pursuant to Articles 57 and 83 of the Regulation, the conduct of the Friuli Centrale University Health Authority (ASUFC), with registered office at Via Pozzuolo 330 – 33100 Udine, VAT No./Tax ID 02985660303, is hereby declared unlawful for violating Articles 5(1)(a), para 1, (b), (c), and (f), Articles 9, 25, and 32 of the Regulation, and Article 75 of the Code, as well as the aforementioned Guidelines of the Data Protection Authority, as set forth in the reasoning; Pursuant to Article 58, para 2, subparagraph d) of the Regulation, ASUFC is hereby required to comply, within (60) sixty days from the date of notification of this decision, with the requirements set forth in para 5 of this decision; Pursuant to Article 58, para 1, subparagraph (a), and Article 157 of the Code, ASUFC is hereby ordered to notify the Authority, within (90) ninety days from the date of notification of this order, the steps taken to implement the measures imposed in para 5; IT IS ORDERED Pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the ASUFC pay the sum of 24,000 (twenty-four thousand) euros as an administrative fine for the violation(s) indicated in the grounds.
applies Art. 5(1)(a), Art. 58(2)(i), Art. 9, Art. 16, Art. 25, Art. 32, Art. 57, Art. 58, Art. 75, Art. 83
IT IS ORDERED that the ASUFC, in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, pay the sum of 24,000 (twenty-four thousand) euros, in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the imposed penalty, within the deadline set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, for filing an appeal as indicated below; IT IS HEREBY ORDERED pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violation(s) and the measures adopted in accordance with Article 58, para 2, of the Regulation in the Authority’s internal register provided for by Article 57, para 1, subparagraph (u), of the Regulation.
applies Art. 10, Art. 16, Art. 17, Art. 27, Art. 37, Art. 57, Art. 58
Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an objection to this decision may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10, on pain of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori SEE ALSO Newsletter of September 11, 2026 [Web Doc. No. 10293994] Decision of September 3, 2026 Register of Decisions No. 616 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, members; and Attorney Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the “General Data Protection Regulation” (hereinafter the “Regulation”); HAVING REGARD TO the Code on Data Protection (Legislative Decree No. 196 of June 30, 2003) (hereinafter the “Code”); HAVING REGARD TO the “Guidelines on Health Records” adopted by the Data Protection Authority on June 4, 2015 (Decision published in the Official Gazette No. 164 of July 17, 2015, web doc.
No. 4084632); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); HAVING REGARD TO the documentation on file; HAVING REGARD TO the observations submitted by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the Office of the Data Protection Authority, available at www.gpdp.it, web doc. No. 1098801; Rapporteur: Prof. Ginevra Cerrina Feroni; WHEREAS 1. FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1 Origin of the preliminary investigation The Authority received a complaint from XX alleging multiple violations of the regulations governing the processing of personal data carried out by the Friuli Centrale University Health Authority (ASUFC) through the institutional health record.
applies Art. 15
In particular, the main complaints concerned the following aspects: 1. Access in 2022 to the complainant’s health record by XX to verify her COVID-19 status, for the purpose of scheduling shifts on the ward. In this regard, in the copy—included in the case file—of the complaint filed by ASUFC with the Public Prosecutor’s Office at the Court of Udine, the Authority characterizes this access as “not abusive,” as it was “carried out on the representation of medical management” “for the performance of work duties”; 2. Access to the complainant’s medical records by XX, XX, and XX, who were not treating her. With regard to these instances of access, in the copy of the aforementioned complaint—included in the case file—the Hospital describes such access as “improper and unlawful” because the complainant was not under the care of the aforementioned healthcare professionals and suggests that this may constitute a criminal offense under Art. 615-ter of the Code, specifying that the aforementioned professionals work on “shared computers” located in rooms with a high volume of staff traffic and that, therefore, someone may have taken advantage of a temporary absence of the account holder to access the complainant’s medical records; 3. the ability for healthcare staff to access medical reports from other healthcare facilities (e.g., the CRO in Aviano) through the “SDAWEB” scheduling system (see the undated ASUFC note signed by XX in response to the complainant—on file); 4.
The possibility for healthcare staff to access, via the health record, all reports from the surgical department regardless of whether they are treating the patient (so-called “cross-departmental access”) (see undated ASUFC note signed by XX in response to the complainant—on file); 5. Lack of access log files for the “SDAWEB” booking system (see undated ASUFC note signed by XX in response to the complainant—on file). 1.2 Actions Taken Following the aforementioned complaint, the Office requested information from ASUFC via a note dated March 4, 2026 (Ref. No. 33109), to which a response was provided in a note dated April 1, 2026. In that response, ASUFC stated, in particular, regarding the aforementioned: point 1, that: “the need to know the test results promptly was also dictated by the necessity to protect the health of patients admitted to the various facilities and that of the hospital staff themselves.
(…) knowledge of a negative swab test result was a prerequisite for access to the ward, and the only tool available to the healthcare system that guaranteed this rapid verification was, precisely, the test result viewer—the health record. Given the emergency situation and the well-known difficulties it entailed for the organizational management of healthcare facilities, it was not possible at the time to implement other methods for conducting the aforementioned verifications”; “While it is true that, in accordance with the Guidelines, the health records may be accessed by healthcare personnel as part of the patient care process, it is also true that, in an emergency context such as that caused by COVID-19, the use of this same tool—always and in any case on an exceptional basis—for the described verifications could be considered justified by the fact that the purpose pursued through its use was aimed exclusively at directly protecting the health of the healthcare worker and, indirectly, the health of patients”; Point 2 states that: “Access to the records is granted by entering personal credentials, and currently, all the Company’s computers have a policy whereby the screen locks if the keyboard is not touched for more than 30 minutes.
To resume the session, the User must re-enter their username and password. Alternatively, before stepping away, the User can lock the workstation by pressing the CTRL-ALT-DEL keys. The choice of this timeframe results from a balance between the operational needs of healthcare workers and security requirements.” The staff members involved in the case in question work in an emergency department, and “logging out is very often not a priority for staff when they are called away due to a code red or a patient’s sudden deterioration, and sometimes there isn’t even time to do so”; Training courses on the use of the medical records viewer were conducted for staff in 2022 and 2024, and “following Insiel’s provision of the dedicated dashboard, a periodic audit was also initiated for staff members who accessed the health record after completing the declaration of accountability”; Point 3 states that: “It is not possible to access any medical reports through the SDAWEB scheduling system”; Point 4 states that: the ability of healthcare personnel to access, via the health record, all medical reports from the surgical department regardless of whether they are treating the patient (so-called “cross-departmental access”) “meets organizational needs related to staff rotation within the department, which have necessitated cross-departmental visibility within the surgical department.”
“To the best of our knowledge, the configuration adopted in this manner has never facilitated or encouraged improper access to third party health records, and, in fact, no reports to that effect have ever been received”; point 5 states that: the SADA Web system tracks: “login/logout operations from the system; the identifier of the operator who performed the operations to schedule or cancel an appointment; the identifier of the operator who performed administrative document management operations (invoices, notes, receipts, reimbursements, cash transactions).” Regarding the configuration of health records in healthcare facilities within the Friuli-Venezia Giulia Region, this Office, in a letter dated November 11, 2025 (Ref. No. 153069), requested information from the aforementioned Region and from Insiel S.p.A. In an email dated December 18, 2025, the aforementioned Region sent a response in which it did not directly provide substantive information regarding this Office’s request, but merely referred, for a “joint and coordinated response,” to the information contained in the note provided by Insiel S.p.A., which acts as the processor for the data owned by the companies of the Regional Health Service (SSR).
In the aforementioned response, Insiel confirmed that the Document Viewer tool is in use within the Regional Social and Health Information System (SISSR) as a common application component and that it is made available to all Health Authorities and IRCCS by the Region. In particular, the response stated that: over the past six months, the Document Viewer has recorded a total of approximately seven million accesses, of which over 82% were made following administrative registration and just under 18% via self-declaration; “The new feature designed to enable controllers to independently configure self-declarations, in line with their own organizational structure and respective care pathways, is nearing completion; the related application development is currently underway, with implementation currently scheduled—barring a change in prioritization of other ongoing projects—by the first half of 2026”; “With regard to the updates to the self-certification form, it will allow for the customization of a precise level of access based on role and specific professional expertise within a given care pathway”; “To date, deep learning solutions for the automatic analysis of access behavior have not yet been implemented; however, these approaches fall within the scope of the broader regional strategy for the use of AI technologies in healthcare, in accordance with Law No. 132 of September 23, 2025, on artificial intelligence.”
With specific reference to the degree of autonomy that healthcare agencies have regarding changes to be made to the health record, INSIEL specified that “The Document Viewer application is part of the portfolio of solutions for the Regional Social and Healthcare Information System (SISSR), made available by the Friuli Venezia Giulia Region, through INSIEL, to all Regional Health Authority (SSR) agencies and IRCCS institutions. System upgrades and adjustments are reviewed in technical working groups involving the responsible parties and INSIEL, coordinated by the DCS, to assess their consistency, technical and organizational feasibility, and priority, taking into account the resources actually available and the expected benefits for the entire Regional Health Service, with a preference for scalable and uniform solutions. Based on the outcomes of these discussions, INSIEL incorporates the agreed-upon guidelines and translates them into technical implementation measures, ensuring their technological sustainability.
Controllers therefore operate within a framework of harmonized choices regarding processing methods, as part of the convergence toward a shared regional system.” In relation to the matters set forth in the records, at the Office’s request, a remote meeting was held on March 4, 2026, with representatives of the Friuli Venezia Giulia Region, INSIEL, and another regional health authority,during which it was reaffirmed that responsibility for the processing carried out through the dossier lies with the regional healthcare agencies and the IRCSS and, consequently, that the prerogatives of the aforementioned entities—in their capacity as controllers—must be effectively respected to ensure full compliance with personal data protection regulations. 2. INITIATION OF PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND SANCTIONING MEASURES AND THE PARTY’S DEFENSE 2.1 Initiation of proceedings (Art. 166, paragraph 5, of the Code) Based on the review of the evidence gathered during the activities described above and the determination of the alleged violations, by notice dated May 4, 2026 (Ref.
No. 67418), served pursuant to Article 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures referred to in Article 58, para 2, of the Regulation against the controller, inviting the controller to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The alleged violations in question are breaches of the basic principles of processing referred to in Articles 5(1)(a), para 1, (b), (c), and (f), Articles 9, 25, and 32 of the Regulation, Article 75 of the Code, and the Guidelines on Health Records dated June 4, 2015. The violation of the aforementioned provisions renders applicable the administrative sanction provided for in Art. 83, para. 4 and para. 5, of the Regulation. 2.2 Defenses of the Party (Art. 166, para. 6, of the Code) In a brief filed on May 28, 2026, the Company reiterated the arguments already presented in the case file and highlighted, in particular, that: - “The use of the same, albeit, as already mentioned, on an exceptional basis, for the inspections described, is considered to be in line with the various Protocols adopted at the national level to combat and contain the spread of the SARS-CoV-2/COVID-19 virus in the workplace (Joint Protocol Regulating Measures to Combat and Contain the Spread of the COVID-19 Virus in the Workplace, dated March 14, 2020; Protocol for the Prevention and Safety of Workers in Healthcare, Social-Healthcare, and Social-Welfare Services Regarding the “COVID-19” Health Emergency dated March 24, 2020), which require that the employer be informed of the worker’s health status, but also in line with the institutional mission of every healthcare organization, namely its care-providing function”; - “Both the national collective bargaining agreement for healthcare personnel and the company’s regulations governing the work schedules of healthcare management stipulate that shift schedules must be finalized by the 20th of the preceding month”; - “On the day XX reviewed her medical report, a course of treatment was already underway—that is, she had been admitted for care—as she had scheduled an outpatient appointment for the same specialty”; - Since 2024, a system has been in place to detect any anomalies by examining an Excel file containing the results of queries run on the viewer audit; - “Given the high number of staff on duty, the sharing of workspaces—especially in emergency room areas—and in the absence of conclusive evidence, it is plausible to assume that whoever actually viewed XX’s list of documents “taken over” the PC workstation logged in with the aforementioned credentials after just 2 minutes, or 5, or 10, from the time the colleague who owned the account had left the workstation; therefore, even with a shorter lockout period, access would still have occurred”; - the Company has a “systemic vulnerability” with regard to malicious behavior by employees. 3.
applies Art. 5(1)(a), Art. 9, Art. 18, Art. 25, Art. 32, Art. 58, Art. 75, Art. 83
THE AUTHORITY’S ASSESSMENTS
Based on the factual circumstances outlined above and the statements made by the Company during the preliminary investigation conducted by the Office—for which the declarants are liable pursuant to Art. 168 of the Code— it is deemed appropriate to confirm the violations identified in the notice of violation for the reasons set forth below. As a preliminary matter, it is noted that the processing of personal data must comply with applicable data protection laws and, in particular, with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”) and Legislative Decree No. 196 of June 30, 2003 (Code on Data Protection—hereinafter, the “Code”). With regard to the processing in question, the Data Protection Authority has adopted the “Guidelines on Health Records – June 4, 2015” (Decision of June 4, 2015, published in the Official Gazette No. 164 of July 17, 2015, available at www.gpdp.it doc web No. 4084632), which set forth an initial framework of precautions aimed at defining specific safeguards and accountability, as well as the necessary and appropriate measures and safeguards to protect citizens, in relation to the processing of health data concerning them, which, like the Authority’s other measures, continue to apply even after the full implementation of the Regulation, as they are compatible with it (Article 22, paragraph 4, Legislative Decree No. 101/2018).
applies Art. 22
Pursuant to the Regulation, where processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health, such processing must be carried out on the basis of Union or Member State law, which must provide for appropriate and specific measures to safeguard the data subject rights and freedoms, in particular professional secrecy (Articles 9, para. 2, subparagraph (i)). Since the declaration of a state of emergency by the Council of Ministers on January 31, 2020, in accordance with the provisions of the European Regulation regarding the pursuit of public interest objectives in the field of public health (Art. 9(2)(i) cited above), of the Regulation), numerous emergency legislative measures have been adopted. These measures contain provisions regarding the processing of health data carried out in the context of interventions related to the COVID-19 health emergency, which resulted from a delicate balancing of public health needs against those related to data protection.
applies Art. 9(2)(i), Art. 9
In particular, with specific reference to the regulations adopted in our country, pursuant to the aforementioned Art 9, para 2, subparagraph (i) of the Regulation, to address the aforementioned public health emergency, Article 17-bis of Decree-Law No. 18/2020 did not and could not have derogated from the data protection regulations—which, it should be noted, are based on a European Regulation—but rather provided for certain simplifications, not applicable to the case at hand, regarding the processing and transfer of personal data among different controllers—to be applied only if such processing were indispensable for the purposes of carrying out activities related to the management of the public health emergency and, in any case, in compliance with the principles set forth in Art. 5 of the Regulation and by adopting appropriate measures to protect the data subject rights. The processing of personal data related to the management of the aforementioned public health emergency was therefore required to be carried out in full compliance with the applicable regulations on data protection and, in particular, with the principles and limitations applicable to processing, as set forth in Art 5 of the Regulation, according to which data must be processed lawfully, fairly, and transparently in relation to the data subject (“lawfulness, fairness, and transparency”), “collected for specified, explicit, and legitimate purposes” and subsequently processed in a manner that is not incompatible with those purposes and, in any case, “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (principles of purpose limitation and data minimisation) (Art 5, para 1, subparagraphs (a), (b), (c), and (f) of the Regulation).
No provision adopted during the pandemic—not even the protocols established at the national level to combat and contain the spread of the SARS-CoV-2/COVID-19, or the national collective bargaining agreement for healthcare workers cited by the Company in its documents, has provided for measures derogating from the aforementioned principles, from the specific regulations applicable to the health record, or from those regarding data processing carried out within the context of the employment relationship as referred to below. With specific reference to the use of health records during the pandemic, reference is also made to the measures of November 10, 2022 (web doc. no. 9819792) and October 12, 2023 (web doc. no. 9954220). In the first of these, a healthcare agency was sanctioned for having modified the rules governing access to health records during the emergency period, thereby thereby, all healthcare personnel to consult the health records of any patient who had been treated by the authority, regardless of whether the person accessing the records was involved in the data subject’s care pathway or whether the data subject had given consent to the processing of data contained in the health record.
In the second case, similar to the present case, another health authority was sanctioned for using the health record for the purpose of organizing hospital shift schedules. On that occasion, the Authority noted that, given the optional nature of the health record and the incompleteness of the information it contains (see the right to have data redacted), it cannot be used for purposes related to the management of the data controller’s organizational and administrative needs, even in cases where, as in the present case, the data controller acts in both the capacity of employer and as the healthcare authority treating the data subject (see also Decision of May 26, 2022, web doc. no. 9791909). It should also be noted that, generally speaking, an employer may process the personal data of employees (Art. 4, para. 1, of the Regulation), including data relating to “special categories,” in the management of the employment relationship, provided that the processing is necessary “for compliance with a legal obligation to which the controller is subject” (Articles 6(1)(c), 9(2)(b), and 9(4); 88 of the Regulation) or when it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6, para. 1, subpar. e), 2 and 3, and Art. 9, para. 2, subpar. g), of the Regulation; Arts. 2-ter and 2-sexies of the Code, in the version prior to the amendments made by Decree-Law No. 139 of October 8, 2021).
applies Art. 6(1)(c), Art. 9(2)(b), Art. 9(4), Art. 2, Art. 4, Art. 6, Art. 9
More specifically, the processing of data concerning employees’ health may be lawfully carried out only when it is “necessary for the purposes of complying with the obligations and exercising the specific rights of the controller or the data subject in the field of labor law, social security, and social protection, to the extent that it is authorized by Union or Member State law or by a collective agreement pursuant to Member State law, subject to appropriate safeguards for the fundamental rights and data subject rights” (Art. 9, paras. 2(b) and 4 of the Regulation; see also Art. 88 of the Regulation and Recitals 51–53). In this context, it should be noted that, consistent with what has been clarified since the “Guidelines on the Processing of Employees’ Personal Data for the Purpose of Managing Employment Relationships in the Public Sector” (Provision No. 23 of June 14, 2007, doc. No. 1417809)—whose principles are still considered valid—the employer may process personal data concerning employees’ health, in compliance with data protection principles and applicable sector-specific provisions, only for the purposes and under the conditions provided for by law or upon specific recommendation by the occupational physician, who is the only person authorized by law to perform occupational health surveillance tasks, in accordance with the specific limits and requirements established by the regulations governing health and safety in the workplace (Legislative Decree No. 81 of April 9, 2008).
This separation of roles is, moreover, confirmed by the structure of the Regulation, which treats processing necessary for “occupational medicine” purposes as a separate category (Art. 9, para. 2, subpar. h), and Art. 3 of the Regulation), a scope that encompasses the role of the competent physician as provided for by national law, as distinct from those processing operations carried out by the employer to fulfill its obligations “under labor law,” including those established by the regulations on “occupational health and safety” (see the combined provisions of Articles 9(2)(b) and 88 of the Regulation; on the role of the employer and the occupational physician, also in light of the emergency regulatory framework, guidance document dated May 14, 2021, web doc. No. 9585367). Even in the exceptional emergency situation, taking into account the issues arising from the representative need to protect workplace safety and the related processing of personal data, employers were required to operate within the scope and limits set forth by the applicable regulations, which constitute the legal basis for such processing, avoiding the implementation of measures not provided for by law—including the specific provisions introduced during the emergency period and in workplace safety protocols—which could have detrimental effects on data subjects in the workplace and professional context.
applies Art. 9(2)(b), Art. 3, Art. 9, Art. 88
In this context, in the absence of express statutory provisions, employers were therefore not permitted to collect and process personal data—including data relating to an employee’s health—either directly from the data subjects or, as in the present case, from other sources (see: these principles have been reaffirmed in numerous measures adopted during the pandemic, starting with the FAQs on “Data Processing in the Public and Private Workplace Context During the Health Emergency,” Web Doc. No. 9337010, and more recently in Decision No. 195 of May 26, 2022, Web Doc. No. 9788986, albeit in relation to cases different from the one at hand). It should therefore be noted that no emergency provision has provided for the possibility of accessing such information through the health record, which, as already noted, is an optional and, by its very nature, incomplete informational tool that may be used exclusively for the purpose of treating the data subject.
In this regard, the arguments set forth in the defense briefs regarding the fact that, at the time of accessing the data subject’s health record, “a course of treatment was underway—that is, she had been admitted for care—since she had scheduled an outpatient appointment for the same specialty” are irrelevant, since the access was not carried out for treatment purposes but, as expressly acknowledged by the Health Authority, for the management of work shifts. From another perspective, it is important to note that in the aforementioned Guidelines, the Data Protection Authority, in order to prevent the risk of unauthorized individuals accessing information processed through the health record or of authorized individuals disclosing health data to third parties, has specifically recommended that the controller pay particular attention to defining authorization profiles and training authorized individuals, as access to the health record must be limited solely to healthcare personnel involved in the patient’s care, and technical authentication methods for the health record must be adopted that reflect the specific access scenarios for this tool at each healthcare facility.
To this end, in the aforementioned Guidelines, the Data Protection Authority instructed controllers to monitor the circumstances in which relevant healthcare personnel may need to consult the health record for the purpose of treating the data subject and, based on this assessment, to identify the various access authorization profiles. This guidance is fully consistent with the principle of “data protection by design” (Art. 25(1) of the Regulation), according to which the controller must also implement appropriate technical and organizational measures to implement the principles of data protection (Article 5 of the Regulation) and incorporate into the processing the necessary safeguards to meet the requirements of the Regulation and protect the rights and freedoms of data subjects. Similarly, the Data Protection Authority has repeatedly emphasized the importance of the controller specifying the scope of access to the information contained in the health record, particularly in cases where access is granted to staff performing administrative functions related to the care of the data subject.
applies Art. 25(1), Art. 5
In such cases, in fact, the data controller, in accordance with the aforementioned principle of data minimisation, must establish limitations on the “scope of access” to the record by staff assigned to these functions, allowing them to access only the data essential for performing the tasks assigned to them (e.g., staff responsible for scheduling diagnostic tests or specialist appointments may consult only the data strictly necessary for making such appointments). With regard to the case in question, it should be noted that the data controller must ensure data protection through appropriate technical and organizational measures to prevent unauthorized or unlawful processing (the principle of “integrity and confidentiality”)” (Art. 5, para. 1, subsections (a) and (f) of the Regulation). In this regard, the Regulation requires the controller to implement “appropriate technical and organizational measures to ensure a level of security appropriate to the risk,” taking into account, among other things, “the nature, scope, context, and processing purpose, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons” (Article 32 of the Regulation).
Among the principles applicable to processing set forth in Article 5 of the Regulation, the principle of accountability is also worth highlighting here, according to which “the controller must comply with and be able to demonstrate compliance with the principles and obligations set forth in the Regulation” (Articles 5(2) and 24 of the Regulation). Linked to this is the aforementioned duty incumbent upon the controller, namely to ensure that the rights and regulations concerning data protection for data subjects’ personal data are safeguarded and applied from the design stage and by default (privacy by design and by default, Art. 25 of the Regulation). In this regard, a representative of this Authority has noted that in the aforementioned Guidelines, this Authority has held that “the controller must implement systems to control access, including to the database, and to detect any anomalies that could constitute unlawful processing, through the use of anomaly indicators (so-called alerts) useful for guiding subsequent audit activities.
The controller must therefore establish specific alerts that identify anomalous or high-risk behavior related to operations performed by data processors (e.g., regarding the number of accesses made, their type, or the time frame in which they occurred)” (point 7, subparagraph b). With specific reference to the automatic locking of a computer due to inactivity, the aforementioned principles require the data controller to establish an appropriate inactivity period, after which the computer automatically locks; this must be done in light of the nature, subject matter, context, and processing purpose, as well as the risk—of varying likelihood and severity—to the rights and freedoms of natural persons. It is therefore necessary to establish, by design, an assessment of the inactivity period for triggering the automatic lockout that takes into account the specific needs associated with the company’s various operational areas, with the aim of minimizing latency time without compromising the effectiveness of the care pathway (see ruling of May 9, 2024, web doc. 10027595).
Nor does the argument put forward by the Company in its defense briefs appear to be valid, namely that, given the large number of staff on duty and the sharing of workspaces—especially in emergency room areas—“it could plausibly be assumed that whoever actually viewed XX’s list of documents ‘taken over’ the PC workstation logged in with the noted credentials after only 2 minutes, or 5, or 10, from the time the colleague who owned the account had left the workstation, and, therefore, even with a shorter lockout period, access would have occurred anyway.” This assertion does not appear admissible, as the implementation of an automatic lockout feature tailored to the specific needs of the company’s various operational areas would have reduced the risk of unauthorized access—that is, it would have constituted an appropriate technical measure to ensure a level of security commensurate with the risk, as required by the Regulation.
In this regard, the very “systemic vulnerability” of the Company to malicious employee behavior should have prompted the controller to adopt all technical and organizational measures aimed at reducing the risk of unauthorized access, including measures with the purpose of acting as a deterrent. Regarding the launch, as of 2024, of a system for detecting potential anomalies by examining Excel files containing the results of queries run on the viewer audit, it is noted that the Company has not adopted a system for the automatic detection of any anomalies that could constitute unlawful processing, nor has it used anomaly indicators (so-called “alerts”) designed to identify anomalous or high-risk behavior related to operations performed by individuals authorized to process data (e.g., number of accesses, type, or time frame of such accesses), which are useful for guiding subsequent audit actions, and has limited itself to conducting only retrospective checks in the event of a dispute raised by data subjects.
The documentation in the case file shows that this Company had not even adopted a system for conducting random checks on access to patient records. In particular, it could have conducted random checks during the pandemic period to verify whether the measures adopted had resulted in access to the medical records by staff who were not treating the patient. Such a measure would undoubtedly have had a deterrent effect against attempts at unauthorized access by healthcare personnel. Taking into account the supplementary measures to the medical report viewing system indicated by Insiel S.p.A. and the statements made by the Friuli-Venezia Giulia Region at the meeting on March 4, 2026, as well as the fact that a report was filed with the Public Prosecutor’s Office regarding some of the facts under examination, based on the evidence gathered and the documentation on file, it has been established that the configuration of the health record carried out by the Health Authority, as demonstrated by the facts under review, was conducted in violation of the basic principles of data processing set forth in Articles 5(1)(a), (b), (c), and (f), 9, 25, and 32 of the Regulation and Article 75 of the Code, as well as the aforementioned Guidelines of the Data Protection Authority.
applies Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(f), Art. 9, Art. 25, Art. 32, Art. 75
The violation of the aforementioned provisions renders applicable the administrative sanction provided for in Art 83(4)(a) and (5)(a) of the Regulation. 4. CONCLUSIONS. In light of these considerations, the allegations set forth in the notice initiating the proceedings pursuant to Art. 166 of the Code are confirmed, as the statements made during the preliminary investigation and the defenses raised are insufficient to rebut the findings made by the Office, and, furthermore, none of the cases provided for in Art. 11 of Regulation No. 1/2019 apply. Therefore, the Authority finds that the conduct of the Friuli Centrale University Health Authority (ASUFC) was unlawful, for having configured the institutional health record in such a way as to: allow access to XX’s health record for purposes other than medical care—namely, to verify her COVID-19 status—in order to schedule shifts on the ward; failing to implement automatic controls on access to the health records; setting a single 30-minute inactivity time limit for all company devices, after which the device is locked, without taking into account the specific needs associated with the different operational areas of the company; with the aim of minimizing latency time without compromising the effectiveness of the care process; in violation of Articles 5(1)(a), (b), (c), and (f), 9, 25, and 32 of the Regulation and Article 75 of the Code, as well as the aforementioned Guidelines of the Data Protection Authority. 5.
applies Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(f), Art. 9, Art. 11, Art. 25, Art. 32, Art. 75
CORRECTIVE MEASURES Art 58(2) of the Regulation grants the Data Protection Authority a series of corrective powers—both prescriptive and punitive—to be exercised in the event that unlawful processing of personal data is ascertained. Among these powers, Article 58(2)(d) of the Regulation provides for the power to “order the controller or processor to bring processing into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time limit.” In light of the assessments referred to above, taking into account the statements made in the case files, and given that the pandemic period has ended, it is deemed necessary to order the Company, pursuant to the aforementioned Art. 58(2)(d) of the Regulation, to report, within (60) sixty days of notification of this order, the measures adopted to: restrict access to the medical records exclusively to the pursuit of treatment purposes, excluding access by personnel acting in their capacity as the data subject’s employer; introduce the use of automatic anomaly indicators (so-called “alerts”) and automatic PC lockout systems due to inactivity that take into account the specific needs related to the Company’s various operational areas, with the aim of minimizing latency time without compromising the effectiveness of the care pathway.
applies Art. 58(2)(d)
That being said, in Recital 3 of the decision adopted on July 3, 2026, by the Authority against another healthcare company in the Friuli-Venezia Giulia Region, information was requested from the Region itself and from Insiel regarding the status of the measures ordered for the “Visore referti” system— the Authority reserves the right to adopt further corrective measures pursuant to Article 58, para 2, of the Regulation. 6. INJUNCTION ORDER Pursuant to Article 58, para 2, subparagraph (i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction order (see Articles 18 of Law No. 689 of November 24, 1981, and 16(1) of the Data Protection Authority’s Regulation No. 1/2019). 6.1 Assessment of the Conduct and Determination of the Applicable Penalty Given that the violation of the aforementioned provisions occurred as a result of a single act, Article 83(3) of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation.
applies Art. 83(3), Art. 18, Art. 58, Art. 83
In the present case, the most serious violations are subject to the penalty provided for in Art. 83(5). 6.2 Determination of the administrative fine (Art. 83(2) of the Regulation) The amount of the administrative fine must be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83, para. 2, of the Regulation. Given that the processing involved health data of a female employee of the Company during the pandemic period, carried out “at the representation of medical management” and based on the regional and company-specific guidelines for maintaining health records, the overall level of severity is considered moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, given that the controller is a university health care institution, it is considered that, for the purposes of quantifying the fine, the following circumstances must be taken into account: the use of the health record to determine hospital shifts was carried out with the representation of the institution’s medical administration; the Authority has repeatedly intervened regarding the proper configuration of the health record to prevent unauthorized access, including through measures adopted against healthcare organizations within the same region; the Authority became aware of the case in question through a complaint; In light of the aforementioned factors, evaluated as a whole, and in accordance with the principles of effectiveness, proportionality, and deterrence set forth in Art. 83, para 1, of the Regulation, it is hereby determined that the amount of the monetary penalty shall be 24,000 (twenty-four thousand) euros for the violation of Articles 5, para 1, letters a), (b), (c), and (f), Articles 9, 25, and 32 of the Regulation, Article 75 of the Code, and the Guidelines on Health Records dated June 4, 2015.
applies Art. 83(2), Art. 83(5), Art. 5, Art. 9, Art. 25, Art. 32, Art. 75, Art. 83
In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the additional sanction of publishing this section of the decision containing the injunction on the Data Protection Authority’s website must be applied, given the impact that the settings in the corporate health records may have had on a considerable number of patients. FOR THESE REASONS pursuant to Articles 57 and 83 of the Regulation, the conduct of the Friuli Centrale University Health Authority (ASUFC), with registered office at Via Pozzuolo 330 – 33100 Udine, VAT No./Tax ID 02985660303, is hereby declared unlawful for violating Articles 5(1)(a), para 1, (b), (c), and (f), Articles 9, 25, and 32 of the Regulation, and Article 75 of the Code, as well as the aforementioned Guidelines of the Data Protection Authority, as set forth in the reasoning; Pursuant to Article 58, para 2, subparagraph d) of the Regulation, ASUFC is hereby ordered to comply, within (60) sixty days from the date of notification of this order, with the requirements set forth in para 5 of this order; Pursuant to Article 58(1)(a) and Article 157 of the Code, ASUFC is hereby ordered to notify the Authority, within (90) ninety days from the date of notification of this decision, the actions taken to implement the measures imposed in para 5; IT IS ORDERED pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that ASUFC pay the sum of 24,000 (twenty-four thousand) euros as an administrative fine for the violation(s) indicated in the grounds.
applies Art. 5(1)(a), Art. 58(1)(a), Art. 58(2)(i), Art. 9, Art. 16, Art. 25, Art. 32, Art. 57, Art. 58, Art. 75, Art. 83
IT IS ORDERED that ASUFC, in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, pay the sum of 24,000 (twenty-four thousand) euros, in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is hereby noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the imposed penalty within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; IT IS HEREBY ORDERED pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violation(s) and the measures adopted in accordance with Article 58, para 2, of the Regulation in the Authority’s internal register provided for by Article 57, para 1, subparagraph (u), of the Regulation.
applies Art. 10, Art. 16, Art. 17, Art. 27, Art. 37, Art. 57, Art. 58
Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10, under penalty of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori