Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Miropass S.r.l.: Insufficient legal basis for data processing

The Italian DPA (Garante) fined Miropass S.r.l.

€40,000 Fine
Miropass S.r.l.
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 9 GDPR Art. 28 GDPR
Retention Period Storage Limitation Controllers Types of Special Categories of Personal Data Healthcare
Dec 17, 2020 Source garanteprivacy.it

Full text

The Italian DPA (Garante) fined Miropass S.r.l. EUR 40,000. Miropass is the provider of the TuPassi booking system, which among others has been used by the Municipality of Rome since 2015. The booking system enables the booking of appointments both on the website of the controller (www.tupassi.it) as well as via the corresponding app. For this purpose, the company collects and processes the personal data of the users. In the course of its investigation, the Italian DPA found that Miropass, particularly in the context of health data resulting from appointment bookings at health care facilities, had no legal basis for the processing and violated the principle of storage limitation.

Industry: Industry and Commerce

How it connects

References

Related across sources

439360 French Conseil d'État strikes down GendNotes police app decree for excessive special data In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile… CE Apr 13, 2021 Types of Special Categories of Personal Data Retention Period Personal Data
C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-175/20 SIA 'SS' v Valsts ieņēmumu dienests In Case C-175/20, the Court of Justice of the EU interpreted GDPR Articles 5 and 6 in response to a preliminary ruling from the Latvian Regional Administrative Court concerning a… CJEU ·Fifth Chamber Feb 24, 2022 Retention Period Personal Data Legitimate Interest
Opinion 03/2022 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space Opinion Jul 12, 2022 Healthcare Health Data Types of Special Categories of Personal Data
C-740/22 Endemol Shine Finland Oy In Case C-740/22, the Court of Justice of the European Union (Sixth Chamber) ruled on a preliminary reference from the Itä-Suomen hovioikeus (Court of Appeal, Eastern Finland)… CJEU ·Sixth Chamber Mar 7, 2024 Criminal Data Personal Data Types of Special Categories of Personal Data
Related documents