Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Azienda Unità Sanitaria Locale Toscana Sud Est: Non-compliance with general data processing principles

€100,000 Fine
Azienda Unità Sanitaria Locale Toscana Sud Est
ITALY
Art. 5 GDPR Art. 13 GDPR Art. 14 GDPR Art. 28 GDPR Art. 30 GDPR Art. 32 GDPR Art. 35 GDPR
DPIA Health Data Healthcare Privacy Impact Assessment Healthcare Controllers IP Address Processing Agreement
Dec 17, 2020 Source

How it connects

Related across sources

Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet Guidance EDPB Annual Report 2021 EDPB Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet

Full text

The Italian DPA (Garante) imposed a fine of EUR 100,000 on Azienda USL Toscana Sud Est. The controller is a company in the healthcare sector that, among other things, launched the so-called 'Sanità di iniziativa' (Health Initiative) program. Within the framework of this program, participating healthcare companies transmit data on chronically ill patients to the controller. On the basis of this data, the controller then develops health plans for the patients. The Italian DPA notes several violations of data protection provisions related to this program. For example, when giving consent to the processing of their data, the data subjects were not adequately informed about how long their data would be stored, what rights they had (in particular their rights of complaint and access), and how exactly their data would be processed and for what purpose. In addition, the controller had not kept a register of processing activities. Finally, the controller had neither implemented adequate technical and organizational measures to protect the processing nor conducted a data protection impact assessment, although this would have been necessary due to the nature of the data processed (health data).

Industry: Health Care

Original document at the source www.garanteprivacy.it

Similar Content