Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Thin Srl: Non-compliance with general data processing principles

€15,000 Fine
Thin Srl
ITALY
Art. 5 GDPR Art. 9 GDPR Art. 13 GDPR
Health Data Healthcare Processing Agreement Anonymization Healthcare IP Address Personal Data International Transfer
Jun 1, 2023 Source

How it connects

Related across sources

Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review

Full text

The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection regulations. The company was running an international project to improve patient care by collecting and analyzing health data. To participate in the project, GPs were required to add an additional function to their existing management software. The additional function was supposed to automatically anonymize patient data and transfer it to the company's database. However, during its investigation, the DPA found that the add-on feature installed did not effectively anonymize data. In addition, the DPA found that Thin had also violated its information obligations under the GDPR. The company had incorrectly assumed that it was processing anonymized data and had actually processed personal data without providing adequate information to the data subjects.

Industry: Health Care

Original document at the source www.garanteprivacy.it

Similar Content