# San Pio Hospital in Benevento: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2025-01-16
- Original: https://www.enforcementtracker.com/ETid-3046
- Canonical: https://overview.legal/posts/52400
- Topics: Personal Data, Healthcare, Employees, Controllers, Processing Agreement, Processing, Supervisory Authorities, Special Categories of Data, Data Controller, Types of Special Categories of Personal Data

## Summary

The Italian DPA has imposed a fine of EUR 6,000 on the San Pio Hospital in Benevento. The controller did not ensure that only entitled employees had access to technical consultancy reports for employees, which include sensitive personal data about the affected employee.

## Full text

The Italian DPA has imposed a fine of EUR 6,000 on the San Pio Hospital in Benevento. The controller did not ensure that only entitled employees had access to technical consultancy reports for employees, which include sensitive personal data about the affected employee.

GDPR Articles: Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 (2) b) GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/52400 · 2026-08-22