Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Fondazione Policlinico Tor Vergata di Roma: Non-compliance with general data processing principles

€15,000 Fine
Fondazione Policlinico Tor Vergata di Roma
ITALY
Art. 5 GDPR Art. 13 GDPR Art. 25 GDPR Art. 32 GDPR
Personal Data Healthcare Healthcare IP Address Processing Agreement Controllers Security Privacy by Design & Default
Apr 21, 2021 Source

How it connects

Related across sources

Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet

Full text

The Italian DPA (Garante) has imposed a fine of EUR 15,000 on Fondazione Policlinico Tor Vergata di Roma. In February 2020, a data subject filed a complaint with Garante alleging a breach of data protection laws in relation to the booking services for medical specialists offered by the controller. In order to book a relevant appointment on the booking portal, visitors had to fill out an online form in which various personal data was requested. As the DPA found, the controller had not implemented adequate technical and organizational measures to ensure the protection of data processing. In addition, the controller did not comply with its information obligations pursuant to Art. 13 GDPR, as it had not properly informed the data subjects about the processing of their personal data at the time of the data collection.

Industry: Health Care

Original document at the source www.garanteprivacy.it

Similar Content