Thin Srl: Non-compliance with general data processing principles

The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection regulations. The company was running an international project to improve patient care by collecting and analyzing health data. To participate in the project, GPs were required to add an additional function to their existing management software. The additional function was supposed to automatically anonymize patient data and transfer it to the company's database. However, during its investigation, the DPA found that the add-on feature installed did not effectively anonymize data. In addition, the DPA found that Thin had also violated its information obligations under the GDPR. The company had incorrectly assumed that it was processing anonymized data and had actually processed personal data without providing adequate information to the data subjects.

Industry: Health Care