Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Azienda Universitaria Friuli Centrale: Insufficient legal basis for data processing

€55,000 Fine
Azienda Universitaria Friuli Centrale
ITALY
Art. 5 GDPR Art. 9 GDPR Art. 14 GDPR Art. 35 GDPR Art. 2 GDPR
DPIA Health Data Healthcare Privacy Impact Assessment Profiling Marketing Personal Data Automated Decision-Making
Dec 15, 2022 Source

How it connects

Related across sources

News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD Guidance EDPB Annual Report 2019 EDPB Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review Guidance EDPB Annual Report 2023 EDPB Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Guidance EDPB Annual Report 2021 EDPB

Full text

The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Friuli Centrale. The health authority has created patient profiles using algorithms and personal patient data to indicate the risk of having complications in the event of a Covid 19 infection. This was intended to identify appropriate diagnostic and therapeutic pathways in a timely manner in the event of complications. However, the DPA found that the health authority did not have a valid legal basis to process patients' personal data for profiling. In addition, the DPA found that the health authority had failed to conduct a data protection impact assessment. In calculating the fine, the DPA took into account the aggravating factor that a large number of individuals were affected.

Industry: Health Care

Original document at the source www.garanteprivacy.it

Similar Content