Enforcement·Italian Data Protection Authority (Garante)EN
Export
Bologna University Hospital IRCCS: Insufficient legal basis for data processing
The Italian Data Protection Authority (Garante) fined Bologna University Hospital IRCCS €10,000 for processing personal data without a sufficient legal basis.
StatusNot cited by any decision here yet
Summary
The Garante found violations of Articles 5, 6, and 9 of the GDPR, addressing deficiencies in the hospital's lawful basis for handling both standard and special category health data.
We hold a reference to this item, not its text.
enforcementtracker.comRead at the sourceHow it connects
Related across sources
C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Personal Data Automated Decision-Making
C-667/21 ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts The CJEU (Third Chamber) ruled on a preliminary reference from the Bundesarbeitsgericht in a case where ZQ sought compensation from his employer, Medizinischer Dienst der… CJEU ·Third Chamber Dec 21, 2023 Health Data Healthcare Integrity and Confidentiality Principle
C‑474/24 NADA Austria and Others C‑474/24 - NADA Austria and Others Several data subjects were subject to suspension proceedings by the Austrian Anti-Doping Legal Commission (ÖADR). Under Austrian law, the National Anti-Doping Agency (“NADA”)… CJEU Jul 24, 2026 Criminal Data Material scope (GDPR) Legitimate Interest
C-184/20 OT v Vyriausioji tarnybinės etikos komisija In Case C-184/20, the CJEU Grand Chamber addressed a preliminary reference from a Lithuanian administrative court concerning OT's challenge to a decision by the Vyriausioji… CJEU ·Grand Chamber Aug 1, 2022 Personal Data Legitimate Interest IP Address
W137 2334258-1/5E Federal Administrative Court · BVwG - W137 2334258-1/5E XXXX as the party lodged a complaint at the Austrian DPA (District Hospital XXXX as the co-party) on the unauthorised sharing of her personal data in seven different instances by… Sep 7, 2026 Legitimate Interest Personal Data Integrity and Confidentiality Principle
W292 2292202-1 The data subject is in the military The unit he is employed at (controller) and the data subject are involved in a multitude of legal disputes concerning his employment, disciplinary proceedings, data protection… BVwG - W292 2292202-1 ·Federal Administrative Court Jun 30, 2026 Health Data Integrity and Confidentiality Principle Healthcare