Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Concentrix Cvg Italy s.r.l.: Insufficient legal basis for data processing

€20,000 Fine
Concentrix Cvg Italy s.r.l.
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 9 GDPR
Health Data Healthcare Integrity and Confidentiality Principle Professional Secrecy Controllers Personal Data Employees Processing Agreement
Nov 26, 2020 Source

How it connects

Related across sources

Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet

Full text

The union UILCOM Sardegna filed a complaint with the Italian DPA (garante) against the call center operator Concentrix Cvg Italy s.r.l. regarding an internal regulation of the controller. Under the terms of a 'clean desk policy,' the company had prohibited employees from keeping certain items, such as smartphones, on their desks, which was intended to ensure confidentiality in the processing of customers' personal data. Exceptions were made for medication, which the data subjects proved they needed to take during their shift. These had to be placed visibly on the desk, making it indirectly possible for other employees to obtain information on the health status of the data subjects. The controller had indeed informed the data subjects about the rules of procedure and obtained their consents. However, this did not contain any information on the processing of their health data.

Industry: Employment

Original document at the source www.garanteprivacy.it

Similar Content