Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Lazio Region: Non-compliance with general data processing principles

The Italian DPA has imposed a fine of EUR 100,000 on Lazio Region.

€100,000 Fine
Lazio Region
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 9 GDPR Art. 12 GDPR Art. 13 GDPR Art. 14 GDPR Art. 24 GDPR
Personal Data Supervisory Authorities Healthcare Processing Accuracy
Sep 15, 2022 Source garanteprivacy.it

Full text

The Italian DPA has imposed a fine of EUR 100,000 on Lazio Region. An individual had filed a complaint with the DPA because she had received an invitation from the regional health authority to participate in the cervical cancer screening program that was addressed to her daughter, who died in 1995. During its investigation, the DPA discovered that the daughter's data was still in the region's database even though she had already died. For this reason, the DPA found that the Region had violated the principles of accuracy and correctness. As the owner of the data, the Region should have ensured that the personal information was accurate and updated as necessary, and taken all reasonable steps to delete or correct the information it used in a timely manner. In addition to the above, the Garante also found that the Region had not properly provided data subjects with the required information about the processing of their personal data when sending out the invitation letters for a cervical cancer screening campaign. In imposing the fine, the DPA took into account, as an aggravating factor, that the Region had already received a fine.

Industry: Health Care

How it connects

References

All 9

Related across sources

C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Automated Decision-Making Marketing
C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data
2025 EDPB Annual Report 2024 De EDPB heeft het Jaarraport van 2024 gepubliceerd. Met ook een handzame samenvatting voor degene die geen tijd hebben. Er wordt ook een lijst met zaken van enkele DPAs… Apr 23, 2025 Direct Marketing Legitimate Interest Privacy by Design
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… CJEU ·Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision
W252 2247042-1 Austrian Fed Admin Court: AMS access response omitted 2018 family doctor call note The controller, an Public Employment Service Austria, processed the personal data of the data subject in connection with his file. On 21 February 2019, 15 March 2019 and 25… Federal Administrative Court Jan 22, 2024 Right of Access Personal Data Data Portability
1181/18 Cyprus court annuls DPA order requiring access to confidential academic promotion files An assistant professor (the data subject) requested access to the content of evaluation reports by independent reviewers and letters of recommendation prepared during the academic… Administrative Court of Cyprus Dec 8, 2025 Right of Access Supervisory Authorities Personal Data
Related documents