Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Azienda sanitaria unica regionale Marche: Insufficient technical and organisational measures to ensure information security

€14,000 Fine
Azienda sanitaria unica regionale Marche
ITALY
Art. 5 GDPR Art. 32 GDPR Art. 35 GDPR
Healthcare Security Privacy by Design & Default Personal Data Processing Agreement Supervisory Authorities Law Enforcement
Jan 13, 2022 Source

How it connects

Related across sources

Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance EDPB Annual Report 2021 EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Guidance EDPB Annual Report 2019 EDPB

Full text

The Italian DPA has imposed a fine of EUR 14,000 on Azienda sanitaria unica regionale Marche. The DPA launched an investigation against the health department following media reports of deficiencies in the system used to collect and manage Covid 19 screening data. The health department used an app that generated QR codes for people who were tested for Covid-19. The QR code was generated based on a progressive criterion rather than on a random basis. Thus, each person was assigned a number. Because of this, it would have been possible for unauthorized persons to change a digit and gain access to another person's profile and thus personal data. The DPA found that the health authority failed to implement adequate technical and organizational measures to ensure a level of security appropriate to the risk to the data subjects.

Industry: Health Care

Original document at the source www.gpdp.it

Similar Content