Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Azienda ospedaliera di Perugia: Non-compliance with general data processing principles

€40,000 Fine
Azienda ospedaliera di Perugia
ITALY
Art. 5 GDPR Art. 13 GDPR Art. 14 GDPR Art. 25 GDPR Art. 30 GDPR Art. 32 GDPR Art. 35 GDPR
DPIA Privacy Impact Assessment Healthcare Health Data Healthcare Personal Data IP Address Processing
Apr 7, 2022 Source

How it connects

Related across sources

News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet Guidance EDPB Annual Report 2021 EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679 EDPB

Full text

The Italian DPA (Garante) has fined Azienda ospedaliera di Perugia EUR 40,000. During an investigation at the healthcare facility, the DPA found multiple GDPR violations. The DPA's investigation took place as part of a series of inspections dealing with the processing of data in the context of whistleblower systems at employers. The healthcare facility used an open source-based whistleblowing web application. However, the application was accessed through systems that were not properly configured. This made it possible to record and store users' browsing data, thus identifying those users and, as such, potential whistleblowers. With respect to the processing of personal data, the health facility had failed to inform the employees in advance. In addition, the DPA found that the healthcare facility had not conducted a data protection impact assessment and had not registered the processing in the register of processing activities. Thus, no sufficient assessment of the risks to the rights and freedoms of the data subjects had been carried out. '

Industry: Health Care

Original document at the source www.gpdp.it

Similar Content