Italian Garante: Red Cross violated Art. 9 GDPR by disclosing HIV status on meal tray

[web doc. no. 10262455] Measure of May 28, 2026 Register of Measures No. 385 of May 28, 2026 THE ITALIAN DATA PROTECTION AUTHORITY IN today's meeting, attended by Professor Pasquale Stazione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Members, and Luigi Montuori, Attorney-at-Law, Secretary General; CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter "Regulation"); HAVING SEEN the Personal Data Protection Code (Legislative Decree No. 196 of June 30, 2003) (hereinafter the "Code"); HAVING SEEN Regulation No. 1/2019 concerning internal procedures of external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Journal No. 106 of May 8, 2019, and on www.gpdp.it, web doc. No. 9107633 (hereinafter "Data Protection Authority Regulation No. 1/2019"); HAVING SEEN the documentation in the file; HAVING SEEN the observations made by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and functioning of the Office of the Guarantor for the Protection of Personal Data, web doc. no. 1098801; Rapporteur: Professor Pasquale Stazione; WHEREAS 1. The Complaint and Investigation With a note dated XX, XX filed a complaint, through the LILA non-profit organization, against the Italian Red Cross – Tuscany Regional Committee – Anna Torrigiani Hospital, alleging a violation of the regulations regarding the protection of personal data that occurred during his hospitalization in the orthopedic department. Specifically, the complainant stated that, after "upon admission to the orthopedics department (...) informing the doctor on duty and the nurse (...) of her HIV and HCV status," the following day "she received her lunch and dinner trays with a piece of paper annotating her HIV and HCV status," as well as her name and surname on the lunch tray. She also stated that she had requested "clarification from the Health Director of the Anna Torrigiani Hospital and the Head of the Orthopedics Department (...), without receiving any response to date." As part of the investigation, with note dated XX, protocol no. XX, the Authority requested from the Association, pursuant to art. 157 of the Code, information useful for assessing the case. The request was sent by registered mail to Via di Camerata n. 10, 50133 Florence, and was duly notified on XX. Having received no response, with a note dated XX, protocol no. XX, the Association was notified of the initiation of proceedings for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulations, alleging violation of Article 157 of the Code, pursuant to Article 166, paragraph 5, of the same Code. With a note dated XX, the Association responded to the Authority's request for information, but did not submit written defenses in relation to the dispute referred to in the aforementioned note dated XX. Specifically, the data controller stated, among other things, that: - "In the specific case of the incident, (...) the catering company, although external, has an in-house kitchen. Therefore, this helps us ensure that the information remains within the confines of the Facility and that the kitchen staff (not subject to constant movement) are considered by the Hospital as those responsible for caring for the patients and are consequently informed of any biological risks." - "The information about the patient's condition was reported on the complaint form intended exclusively for the kitchen to pre-alert the portioning staff (who come into contact with the patients) to take appropriate protective/preventive measures (e.g., use of disposable tableware)." - "Following the patient's verbal complaint on the ward, we have amended the meal request form, using only the words 'disposable tableware' in the notes. We sincerely apologize to Ms. (...) for this incident and will take further action to prevent similar situations from recurring." 2. Department's assessment of the treatment performed and notification of the violation pursuant to Article 166, paragraph 5, of the Code In relation to the facts described in the complaint, with note dated XX, file no. XX, the Office notified the Association, pursuant to Article 166, paragraph 5, of the Code, of the initiation of a new proceeding for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulations, inviting the Association to submit written defenses or documents or to request a hearing by the Authority, pursuant to Article 166, paragraphs 6 and 7, of the Code, as well as Article 58, paragraph 2, of the Regulations. 18, paragraph 1, of Law No. 689 of 24 November 1981. Specifically, in the initial investigation, the Authority found that the Association had processed data relating to health and HIV infection in violation of the basic principles of processing set forth in Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as Article 75 of the Code. The Association filed its defense briefs in a note dated XX, declaring that: - "Following the incident, the Medical Director convened both the staff of the affected department and the canteen manager to better clarify the dynamics of the incident and to implement personal data protection measures to prevent similar incidents from recurring. The canteen is an internal service at the Anna Torrigiani Hospital that communicates constantly with the ward staff to ensure adequate and necessary service for each patient, in compliance with all medical prescriptions and patient data protection regulations. This is the first time the unpleasant situation that is the subject of the complaint has occurred at the Hospital. According to the Director's request for explanations to the staff, the alleged violation involved the doctor on duty and the nurse to whom the patient communicated her condition, and the canteen manager who was responsible for preparing the lunch tray and placing the note containing the patient's status inside. The patient room was occupied by XX and Another patient, who, according to the staff involved, was unaware of the incident. The cause of the violation was eliminated following a report. - "The placing of the ticket on the tray was due to an involuntary and completely isolated error. As previously stated, the management of the Anna Torrigiani Hospital have convened all the staff involved and ensured that all future information flows are conducted in compliance with privacy regulations. In addition to having drawn up a privacy policy for the Hospital, which describes the organizational model applied in the facility and the procedures related to privacy protection, the document has been distributed to all staff and published on the hospital's website. (...) A training course has been scheduled for the Anna Torrigiani Hospital staff and will be held by March of this year, and a dedicated email address for reporting personal data breaches is available on the website." - "The Anna Torrigiani Center and its staff regret this incident and highlight the Association's sensitivity to the issue of HIV, which is the subject of awareness campaigns throughout the country and internationally aimed at preventing stigmatization and unfair treatment (...)." 3. 3. Legal Framework and Authority Assessments 3.1. Applicable Legal Framework Having acknowledged the Association's representations in the documents and defense briefs, we note that: 1. "Health data" means "personal data relating to the physical or mental health of a natural person, including the provision of healthcare, which reveal information about that natural person's state of health" (Article 4, paragraph 1, no. 15, of the Regulation); 2. The data controller is required to comply with the principles of personal data protection, including the principle of "minimization," according to which data must be "adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed," and the principle of "integrity and confidentiality," according to which personal data must be "processed in a manner that ensures appropriate security," including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures (Article 5, paragraph 1, letters c) and f), of the Regulation); 3. In the healthcare sector, information on health status may be disclosed to the data subject and to third parties only on the basis of an appropriate legal basis (Article 9 of the Regulation); 4. The legislator has provided enhanced protection for the processing of data relating to HIV infection, establishing the obligation, on the part of the healthcare provider and any other person who becomes aware of a case of AIDS or HIV infection, to provide the necessary assistance by adopting the measures necessary to protect the confidentiality of the person being treated, as well as any measure or precaution necessary to protect the rights and dignity of the person (Article 5, paragraph 1, Law No. 135 of 5 June 1990, containing the "Program of urgent interventions for the prevention and fight against AIDS").On this point, see also the Civil Court of Cassation, Section III, January 30, 2009, no. 2468, according to which "Pursuant to the aforementioned Law, art. 5, paragraph 1, it is the responsibility of healthcare personnel to demonstrate that they have adopted all necessary measures to guarantee the patient's right to confidentiality and to prevent data relating to test results and the patient's health conditions from being disclosed to third parties." The aforementioned provisions fall within the specific sector regulations safeguarded by art. 75 of the Code, which governs the processing of personal data for health protection purposes in the healthcare sector; 5. The Guarantor has repeatedly drawn attention to the above-mentioned confidentiality regime, both in the context of various interventions—see, among others, provisions containing “Provisions concerning the collection of information on the HIV status of patients by healthcare professionals” of November 12, 2009, no. 35, web doc. no. 1673588; provision of September 16, 2021, no. 328, web doc. no. 9722297; provision of June 10, 2021, no. 239, web doc. no. 9677521; provision of June 6, 2024, no. 337, web doc. no. 10039453 — both by classifying data relating to HIV infection among those subject to "greater protection of anonymity" (see opinion of May 22, 2014, web doc. no. 3230826, and provision of June 4, 2015, web doc. no. 4084632); 6. Ministerial Decree of September 28, 1990, which implemented Article 7 of the aforementioned Law No. 135/1990, established specific provisions for protection from occupational HIV infection in public and private healthcare and care facilities. The decree emphasizes that, since it is not possible to identify with certainty all HIV-infected patients, measures to protect against infection must be adopted, with reference to the activities performed in public and private healthcare and care facilities, for each individual undergoing treatment, regardless of their knowledge of their HIV status (see preamble and Article 1); 7. Within the scope of the powers set forth in Article 58 of the Regulation and to carry out its duties, the Garante may request the data controller, the data processor, the data controller's or data processor's representative, the data subject, or even third parties to provide information and produce documents, including those relating to the contents of databases (Articles 157 and 166, paragraph 2, of the Code). Given that the alleged violations concern the same data controller, the two investigations are being merged, pursuant to Article 10, paragraph 4, of the Garante's Regulation No. 1/2019. 3.2. Declaration regarding the unlawfulness of processing In light of the above considerations, taking into account the statements made by the data controller during the investigation, and considering that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances or produces false documents or records is liable pursuant to Article 168 of the Code, the information provided by the Italian Red Cross – Tuscany Regional Committee – Anna Torrigiani Center, as the data controller, is not sufficient to allow the dismissal of these proceedings, nor to overcome the findings notified by the Office with the aforementioned initiating documents. In particular, the indication, in the context of the food service, of the patient's HIV and HCV status, along with her name and surname, is not justified by the need to implement specific protection measures for staff. As noted above, industry regulations require that, given the impossibility of knowing with certainty the HIV status of patients, protective measures must be adopted generally for all individuals undergoing treatment. No justification was provided for the failure to respond to the request for information made pursuant to Article 157 of the Code. The Association therefore carried out processing in violation of the basic principles set forth in Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, Article 75 of the Code, in relation to failure to comply with the provisions of Law No. 135/1990, as well as Article 157 of the Code. For these reasons, the processing of personal data by the Association must be declared unlawful, as set out in the reasons given. In this context, given that the conduct has exhausted its effects and that the data controller has declared that it has raised awareness among the personnel involved regarding the need to comply with the applicable regulations, the conditions for adopting corrective measures pursuant to Article 58, paragraph 2, of the Regulation are not currently met. 4. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions The violation of Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as Articles 75 and 157 of the Code, resulting from the conduct of the Italian Red Cross – Tuscany Regional Committee – Anna Torrigiani Centre, entails the application of the administrative pecuniary sanction pursuant to Article 83, paragraph 5, of the Regulation. The Guarantor, pursuant to Article 58, paragraph 2, letter i), of the Regulation and Article 83, paragraph 5, of the Regulation, has issued a preliminary ruling. 166 of the Code, has the power to "impose an administrative pecuniary sanction pursuant to Article 83, in addition to the (other) (corrective) measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each individual case," by issuing an injunction pursuant to Article 18 of Law No. 689 of 24 November 1981. In this case, the data controller has engaged in two distinct acts: first, failure to comply with the principles of data minimization, integrity, and confidentiality of personal data, pursuant to Article 5, paragraph 1, letters c) and f), Article 9 of the Regulation, and the specific provisions relating to HIV, without prejudice to Article 75 of the Code; and second, failure to comply with the obligation to provide information to the Data Protection Authority pursuant to Article 157 of the Code. These conducts must be considered separately for the purposes of quantifying the applicable administrative sanctions. 4.1. Failure to comply with the principles of data minimization, integrity, and confidentiality of personal data, Article 9 of the Regulation, and Article 75 of the Code In calculating the administrative sanction, pursuant to Article 83, paragraph 3, of the Regulation, the violations referred to in Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as Article 75 of the Code, are considered together, as they relate to a single processing operation (Guidelines 04/2022 on the calculation of administrative pecuniary sanctions pursuant to the GDPR, version 2.0, adopted on May 24, 2023, paragraph 3.1.2, point 39). The level of severity of the violation, based on the elements referred to in Article 83, paragraph 2, letter a), of the GDPR, is: The risk of data breaches, as set out in Articles 83(2)(a), (b), and (g) of the Regulation, must be considered high, given the category of data affected by the breach, namely health information and, in particular, data subject to greater protection. This assessment, however, takes into account the absence of intent in the controller's conduct. In addition to the accounting data, the additional elements required by Article 83(2) of the Regulation were also assessed, and in particular that: - the controller took immediate action to mitigate the negative effects of the breach (Article 83(2)(c) of the Regulation); - the controller has not committed any previous relevant breaches (Article 83(2)(e) of the Regulation); - the Authority became aware of the breach following a complaint (Article 83(2)(h) of the Regulation); - the Italian Red Cross, the organization to which the Anna Torrigiani Hospital belongs, performs tasks of public interest, is an auxiliary of public authorities in the humanitarian sector, and is under the High Patronage of the President of the Republic (Article 1, Legislative Decree No. 178 of September 28, 2012); - there is no evidence that the patient who occupied the same room as the complainant was aware of the incident (Article 83, paragraph 2, letter k), of the Regulation). In light of the above factors, assessed as a whole, the data controller's conduct violates Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as Article 83, paragraph 2, letter k), of the Regulation. 75 of the Code, it is deemed appropriate to set the administrative fine at €500.00, taking into account that the fine must be, in each individual case, effective, proportionate, and dissuasive, pursuant to Article 83, paragraph 1, of the Regulation. 4.2. Failure to respond to a request for information pursuant to Article 157 of the Code With reference to the violation of Article 157 of the Code, subject to the administrative fine pursuant to Article 83, paragraph 5, of the Regulation, pursuant to Article 166, paragraph 2, of the Code, the level of severity of the violation, based on the elements referred to in Article 83, paragraph 2, letters a), b), and g), of the Regulation, must be considered medium. The absence of previous relevant violations committed by the data controller and the specific tasks performed by the Association were also considered (Article 83, paragraph 2, letters e) and k), of the Regulation). In light of the above, having assessed the relevant factors as a whole, the administrative fine for the data controller's conduct in violation of Article 157 of the Code is deemed to be €200.00. 4.3. Additional Considerations and Additional Sanction of Publication of the Injunction Given the nature of the health data at issue, it is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Italian Data Protection Authority (Garante) No. 1/2019, this chapter, containing the injunction, should be published on the Garante's website. Furthermore, the conditions set forth in Article 17 of Regulation No. 1/2019, concerning internal procedures of external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met. Finally, please note that a copy of this provision will be published on the Authority's website, pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Guarantor's Regulation No. 1/2019. NOW CONSIDERING ALL THE ABOVE, THE GUARANTOR pursuant to Articles 57, paragraph 1, letter b) and c) of the Italian Data Protection Authority, f) and 83 of the Regulation, finds the processing carried out by the Italian Red Cross – Tuscany Regional Committee - Anna Torrigiani Center, with registered office at Via di Camerata, 10, 50133, Florence, VAT number 06627070482, unlawful, within the terms set out in the grounds, for violation of Articles 5, paragraph 1, letters c) and f), 9 of the Regulation, and Articles 75 and 157 of the Code; ORDERS pursuant to Article 58, paragraph 2, letter i) of the Regulation, as well as Article 166 of the Code, the same Association, represented by its legal representative pro tempore, to pay the sum of €700.00 (seven hundred) as an administrative fine for the violation indicated in this order. ORDER The aforementioned Association to pay the sum of €700.00 (seven hundred) according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981. It is hereby stated that pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half of the fine imposed within the deadline set out in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, established for filing an appeal as indicated below. ORDERS a) pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Italian Data Protection Authority Regulation No. 1/2019, the publication of the injunction order on the Italian Data Protection Authority's website; b) pursuant to art. 154-bis, paragraph 3, of the Code and art. 37 of the Italian Data Protection Authority Regulation No. 1/2019, the publication of this provision on the Authority's website; c) pursuant to art. 17 of the Italian Data Protection Authority Regulation No. 1/2019, the recording of the violations and measures adopted in accordance with art. 58, paragraph 2, of the Regulation, in the Authority's internal register provided for by art. 57, paragraph 1, letter u) of the Regulation. Pursuant to art. 78 of the Regulation, art. 152 of the Code, and art. 10 of Legislative Decree No. 150/2011, an appeal against this provision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of notification of the provision itself, or within sixty days if the appellant resides abroad. Rome, May 28, 2026 THE PRESIDENT Stanzione THE REPORTER Stanzione THE SECRETARY GENERAL Montuori [web doc. no. 10262455] Provision of May 28, 2026 Register of Provisions no. 385 of May 28, 2026 THE AUTHORITY FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, attended by Professor Pasquale Stazione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, members, and Attorney Luigi Montuori, Secretary General; HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter the "Regulation"); HAVING REGARD to the Personal Data Protection Code (Legislative Decree No. 196 of 30 June 2003) (hereinafter the "Code"); HAVING REGARD to Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, approved by Resolution No. 98 of 4/4/2019, published in the Official Journal No. 106 of 8/5/2019 and at www.gpdp.it, web doc. no. 9107633 (hereinafter "Regulation of the Italian Data Protection Authority no. 1/2019"); SEEN the documentation in the file; SEEN the observations made by the Secretary General pursuant to Article 15 of Regulation of the Italian Data Protection Authority no. 1/2000 on the organization and functioning of the Office of the Data Protection Authority, web doc. no. 1098801; Rapporteur: Professor Pasquale Stazione; WHEREAS 1. The Complaint and Investigation With note dated XX, XX filed a complaint, through the LILA non-profit organization, against the Italian Red Cross – Tuscany Regional Committee – Anna Torrigiani Hospital, alleging a violation of the regulations regarding the protection of personal data that occurred during his hospitalization in the orthopedic department. Specifically, the complainant stated that, after "upon admission to the orthopedics department (...) informing the doctor on duty and the nurse (...) of her HIV and HCV status," the following day "she received her lunch and dinner trays with a piece of paper annotating her HIV and HCV status," as well as her name and surname on the lunch tray. She also stated that she had requested "clarification from the Health Director of the Anna Torrigiani Hospital and the Head of the Orthopedics Department (...), without receiving any response to date." As part of the investigation, with note dated XX, protocol no. XX, the Authority requested from the Association, pursuant to art. 157 of the Code, information useful for assessing the case. The request was sent by registered mail to Via di Camerata n. 10, 50133 Florence, and was duly notified on XX. Having received no response, with a note dated XX, protocol no. XX, the Association was notified of the initiation of proceedings for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulations, alleging violation of Article 157 of the Code, pursuant to Article 166, paragraph 5, of the same Code. With a note dated XX, the Association responded to the Authority's request for information, but did not submit written defenses in relation to the dispute referred to in the aforementioned note dated XX. Specifically, the data controller stated, among other things, that: - "In the specific case of the incident, (...) the catering company, although external, has an in-house kitchen. Therefore, this helps us ensure that the information remains within the confines of the Facility and that the kitchen staff (not subject to constant movement) are considered by the Hospital as those responsible for caring for the patients and are consequently informed of any biological risks." - "The information about the patient's condition was reported on the complaint form intended exclusively for the kitchen to pre-alert the portioning staff (who come into contact with the patients) to take appropriate protective/preventive measures (e.g., use of disposable tableware)." - "Following the patient's verbal complaint on the ward, we have amended the meal request form, using only the words 'disposable tableware' in the notes. We sincerely apologize to Ms. (...) for this incident and will take further action to prevent similar situations from recurring." 2. Department's assessment of the treatment performed and notification of the violation pursuant to Article 166, paragraph 5, of the Code In relation to the facts described in the complaint, with note dated XX, file no. XX, the Office notified the Association, pursuant to Article 166, paragraph 5, of the Code, of the initiation of a new proceeding for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulations, inviting the Association to submit written defenses or documents or to request a hearing by the Authority, pursuant to Article 166, paragraphs 6 and 7, of the Code, as well as Article 58, paragraph 2, of the Regulations. 18, paragraph 1, of Law No. 689 of 24 November 1981. Specifically, in the initial investigation, the Authority found that the Association had processed data relating to health and HIV infection in violation of the basic principles of processing set forth in Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as Article 75 of the Code. The Association filed its defense briefs in a note dated XX, declaring that: - "Following the incident, the Medical Director convened both the staff of the affected department and the canteen manager to better clarify the dynamics of the incident and to implement personal data protection measures to prevent similar incidents from recurring. The canteen is an internal service at the Anna Torrigiani Hospital that communicates constantly with the ward staff to ensure adequate and necessary service for each patient, in compliance with all medical prescriptions and patient data protection regulations. This is the first time the unpleasant situation that is the subject of the complaint has occurred at the Hospital. According to the Director's request for explanations to the staff, the alleged violation involved the doctor on duty and the nurse to whom the patient communicated her condition, and the canteen manager who was responsible for preparing the lunch tray and placing the note containing the patient's status inside. The patient room was occupied by XX and another patient, who, according to the staff involved, was unaware of the incident. The cause of the violation was eliminated following a report; - "The placing of the ticket on the tray was due to an involuntary and completely isolated error.As mentioned, the management of the Anna Torrigiani Presidium has convened all relevant personnel and ensured that all future information flows are conducted in compliance with privacy regulations. In addition to drafting a privacy policy for the Presidium, which describes the organizational model applied within the facility and the procedures related to privacy protection, the document has been distributed to all personnel and published on the facility's website. (…) A training course has been scheduled and will be held by March. for the staff of the Anna Torrigiani Presidium, and a dedicated email address is available on the website for reporting personal data breaches; - "The Anna Torrigiani Presidium and its staff are sorry for what happened and highlight the Association's sensitivity to the issue of HIV, which is the subject of awareness campaigns throughout the country and internationally aimed at avoiding stigmatization and unfair treatment (...)". 3. 3. Legal Framework and Authority Assessments 3.1. Applicable Legal Framework Having acknowledged the Association's representations in the documents and in its defense briefs, we note that: 1. "health data" means "personal data relating to the physical or mental health of a natural person, including the provision of healthcare, which reveal information about his or her state of health" (Article 4, paragraph 1, no. 15, of the Regulation); 2. the data controller is required to comply with the principles of personal data protection, including These include the "minimization" principle, according to which data must be "adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed," and the "integrity and confidentiality" principle, according to which personal data must be "processed in a manner that ensures appropriate security," including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures (Article 5, paragraph 1, letters c) and f), of the Regulation); 3. In the healthcare sector, information on health status may be communicated to the data subject and to third parties only on the basis of an appropriate legal basis (Article 9 of the Regulation); 4. The legislator has provided enhanced protection for the processing of data relating to HIV infection, establishing the obligation for healthcare professionals and any other person who becomes aware of a case of AIDS or HIV infection to provide the necessary assistance by adopting the necessary measures to protect the confidentiality of the person being cared for. as well as any measure or precaution necessary to protect the rights and dignity of the person (Article 5, paragraph 1, Law No. 135 of 5 June 1990, containing the “Programme of urgent interventions for the prevention and fight against AIDS”). On this point, see also Civil Court of Cassation, Section III, 30 January 2009, No. 2468, according to which “Pursuant to the aforementioned Law, art. 5, paragraph 1, it is the responsibility of healthcare personnel to demonstrate that they have taken all necessary measures to guarantee the patient's right to confidentiality and to prevent data relating to the test results and the patient's health conditions from being disclosed to third parties. The aforementioned provisions fall within the specific sector regulations safeguarded by Article 75 of the Code, which governs the processing of personal data for health protection purposes in the healthcare sector; 5. The Guarantor has repeatedly drawn attention to the above-mentioned confidentiality regime, both in the context of various interventions—see, among others, provision containing "Provisions concerning the collection of information on patients' HIV status by healthcare professionals" of November 12, 2009, no. 35, web doc. no. 1673588; provision of September 16, 2021, no. 328, web doc. no. 9722297; provision of June 10, 2021, no. 239, web doc. no. 9677521; provision of June 6, 2024, no. 337, web doc. no. 10039453 — both by classifying data relating to HIV infection among those subject to "greater protection of anonymity" (see opinion of May 22, 2014, web doc. no. 3230826, and provision of June 4, 2015, web doc. no. 4084632); 6. Ministerial Decree of September 28, 1990, which implemented Article 7 of the aforementioned Law no. 135/1990, established specific provisions for the protection from occupational HIV infection in public and private healthcare and assistance facilities. The decree highlights that, since it is not possible to identify with certainty all HIV-infected patients, measures to protect against infection must be adopted, with reference to the activities performed in public and private healthcare and assistance facilities, for each individual undergoing treatment, regardless of their knowledge of their HIV status (see preamble and Article 1); 7. Within the scope of the powers set forth in Article 58 of the Regulation and for the performance of its duties, the Garante may require the data controller, the data processor, the data controller's or data processor's representative, the data subject, or even third parties to provide information and produce documents, including with reference to the contents of databases (Articles 157 and 166, paragraph 2, of the Code). Given that the alleged violations concern the same data controller, the two investigations are being merged, pursuant to Article 10, paragraph 4, of the Garante Regulation No. 1/2019. 3.2. Declaration regarding the unlawfulness of the processing In light of the assessments As set out above, taking into account the statements made by the data controller during the investigation and considering that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Guarantor, falsely declares or certifies information or circumstances or produces false documents or records is liable pursuant to Article 168 of the Code, the information provided by the Italian Red Cross – Tuscany Regional Committee – Anna Torrigiani Center, as data controller, is not sufficient to allow the dismissal of these proceedings, nor to overcome the findings notified by the Office with the aforementioned initiating documents. In particular, the indication, within the scope of the food service, of the patient's HIV and HCV status, together with her name and surname, is not justified by the need to implement specific protection measures for staff. As highlighted above, in fact, the sector legislation provides that, given the impossibility of knowing with certainty the HIV-positive status of patients, protection measures must be adopted generally for each individual subjected to Treatment. No justification was provided for the failure to respond to the request for information made pursuant to Article 157 of the Code. The Association therefore carried out processing in violation of the basic principles set forth in Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, Article 75 of the Code, in relation to failure to comply with the provisions of Law No. 135/1990, as well as Article 157 of the Code. For these reasons, the processing of personal data carried out by the Association must be declared unlawful, in accordance with the terms set out in the grounds. In this context, given that the conduct has exhausted its effects and taking into account that the data controller has declared that it has sensitized the personnel involved to the need to comply with the applicable regulations, the conditions for adopting corrective measures pursuant to Article 58, paragraph 2, of the Regulation are not currently met. 4. Adoption of the injunction order for the application of the administrative pecuniary sanction and additional sanctions Violation of Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as Articles 75 and 157 of the Code, resulting from the conduct of the Italian Red Cross – Tuscany Regional Committee – Anna Torrigiani Center, entails the application of the administrative pecuniary sanction pursuant to Article 83, paragraph 5, of the Regulation. The Guarantor, pursuant to Article 58, paragraph 2, letter i), of the Regulation and Article 166 of the Code, has the power to "impose an administrative pecuniary sanction pursuant to Article 83, in addition to the (other) (corrective) measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each individual case," by issuing an injunction order pursuant to Article 83. 18 of Law No. 689 of 24 November 1981. In this case, the data controller engaged in two distinct acts: first, failure to comply with the principles of minimization, integrity, and confidentiality of personal data, pursuant to Article 5, paragraph 1, letters c) and f), Article 9 of the Regulation, and the specific provisions relating to HIV, without prejudice to Article 75 of the Code; and second, failure to comply with the obligation to provide information to the Data Protection Authority pursuant to Article 157 of the Code. These acts must be considered separately for the purposes of quantifying the applicable administrative sanctions. 4.1. Failure to comply with the principles of minimization, integrity, and confidentiality of personal data, Article 9 of the Regulation, and Article 75 of the Code In calculating the administrative sanction, pursuant to Article 83, paragraph 3, of the Regulation, the violations referred to in Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as art. 75 of the Code, as they refer to a single processing operation (Guidelines 04/2022 on the calculation of administrative pecuniary sanctions pursuant to the GDPR, version 2.0, adopted on 24 May 2023, paragraph 3.1.2, point 39). The severity of the breach, based on the elements set forth in Article 83(2)(a), (b), and (g) of the Regulation, must be considered high, given the category of data affected by the breach, namely health information and, in particular, data subject to greater protection. This assessment, however, takes into account the absence of intent in the controller's conduct. In addition to the accounting data, the additional elements set forth in Article 83(2) of the Regulation were also assessed, and in particular: - the controller took immediate action to mitigate the negative effects of the breach (Article 83(2)(c) of the Regulation); - the controller has not committed any previous relevant breaches (Article 83(2)(e) of the Regulation); - the Authority became aware of the breach following a complaint (Article 83(2)(h) of the Regulation); - the Italian Red Cross, the organization to which the Anna Torrigiani Hospital belongs, performs tasks of public interest, is an auxiliary of public authorities in the humanitarian sector, and is under the High Patronage of the President of the Republic (Article 1, Legislative Decree No. 178 of September 28, 2012); - there is no evidence that the patient who occupied the same room as the complainant was aware of the incident (Article 83, paragraph 2, letter k), of the Regulation). In light of the above factors, assessed as a whole, the data controller's conduct violates Articles 5, paragraph 1, letters c) and f), and 9 of the Regulation, as well as Article 83, paragraph 2, letter k), of the Regulation. 75 of the Code, it is deemed appropriate to set the administrative fine at €500.00, taking into account that the fine must be, in each individual case, effective, proportionate, and dissuasive, pursuant to Article 83, paragraph 1, of the Regulation. 4.2. Failure to respond to a request for information pursuant to Article 157 of the Code With reference to the violation of Article 157 of the Code, subject to the administrative fine pursuant to Article 83, paragraph 5, of the Regulation, pursuant to Article 166, paragraph 2, of the Code, the level of severity of the violation, based on the elements referred to in Article 83, paragraph 2, letters a), b), and g), of the Regulation, must be considered medium. The absence of previous relevant violations committed by the data controller and the specific tasks performed by the Association were also considered (Article 83, paragraph 2, letters e) and k), of the Regulation). In light of the above, having assessed the relevant elements as a whole, the administrative fine for the data controller's conduct in violation of Article 157 of the Code is deemed to be €200.00. 4.3. Additional Considerations and Additional Sanction of Publication of the Injunction Given the nature of the health data at issue, it is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Data Protection Authority No. 1/2019, this chapter, containing the injunction, should be published on the website of the Data Protection Authority. Furthermore, the conditions set forth in Article 17 of Regulation No. 1/2019, concerning internal procedures of external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met. Finally, please note that a copy of this provision will be published on the Authority's website, pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Guarantor's Regulation No. 1/2019. NOW CONSIDERING ALL THE ABOVE, THE GUARANTOR pursuant to Articles 57, paragraph 1, letter b) and c) of the Italian Data Protection Authority, f) and 83 of the Regulation, finds the processing carried out by the Italian Red Cross – Tuscany Regional Committee - Anna Torrigiani Center, with registered office at Via di Camerata, 10, 50133, Florence, VAT number 06627070482, unlawful, within the terms set out in the grounds, for violation of Articles 5, paragraph 1, letters c) and f), 9 of the Regulation, and Articles 75 and 157 of the Code; ORDERS pursuant to Article 58, paragraph 2, letter i) of the Regulation, as well as Article 166 of the Code, the same Association, represented by its legal representative pro tempore, to pay the sum of €700.00 (seven hundred) as an administrative fine for the violation indicated in this order. ORDER The aforementioned Association to pay the sum of €700.00 (seven hundred) according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981. It is hereby stated that pursuant to Article 166, paragraph 8 of the Code, the offender retains the right to settle the dispute by paying—again according to the methods indicated in the attachment—an amount equal to half of the fine imposed within the deadline set out in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, established for filing an appeal as indicated below. ORDERS a) pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Italian Data Protection Authority Regulation No. 1/2019, the publication of the injunction order on the Italian Data Protection Authority's website; b) pursuant to art. 154-bis, paragraph 3, of the Code and art. 37 of the Italian Data Protection Authority Regulation No. 1/2019, the publication of this provision on the Authority's website; c) pursuant to art. 17 of the Italian Data Protection Authority Regulation No. 1/2019, the recording of the violations and measures adopted in accordance with art. 58, paragraph 2, of the Regulation, in the Authority's internal register provided for by art. 57, paragraph 1, letter u) of the Regulation. Pursuant to art. 78 of the Regulation, art. 152 of the Code, and art. 10 of Legislative Decree No. 150/2011, an appeal against this provision may be filed before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of notification of the provision itself, or within sixty days if the appellant resides abroad. Rome, May 28, 2026 THE PRESIDENT Stanzione THE REPORTER Stanzione THE SECRETARY GENERAL Montuori