# Medical association: Insufficient fulfilment of data subjects rights

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2024-06-20
- Original: https://www.enforcementtracker.com/ETid-2404
- Canonical: https://overview.legal/posts/48519
- Topics: Storage Limitation, Personal Data, Retention Period, Healthcare, Healthcare, Controllers, Data Controller, Supervisory Authorities, Processing Agreement, Law Enforcement

## Summary

The Italian DPA has imposed a fine of EUR 4,000 on the medical association 'Ordine dei Medici Chirurghi e degli Odontoiatri'. A patient had filed a complaint with the DPA. During its investigation the DPA fount that the controller had not responded to the data subject's request for access to their personal data in a timely manner. Additionally, the controller failed to provide sufficient information regarding the retention period of their personal data.

## Full text

The Italian DPA has imposed a fine of EUR 4,000 on the medical association 'Ordine dei Medici Chirurghi e degli Odontoiatri'. A patient had filed a complaint with the DPA. During its investigation the DPA fount that the controller had not responded to the data subject's request for access to their personal data in a timely manner. Additionally, the controller failed to provide sufficient information regarding the retention period of their personal data.

GDPR Articles: Art. 12 (3) GDPR, Art. 13 (2) a) GDPR, Art. 15 GDPR
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/48519 · 2026-08-22