Italy

Azienda sanitaria unica regionale Marche

14,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2022-01-13.

Rank · Sector

#120

of 270 in Health Care

Rank · Italy

#242

of 543

Rank · All fines

#1,233

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2022-01-13
Controller / Processor: Azienda sanitaria unica regionale Marche
Sector: Health Care
Quoted Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 35 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA has imposed a fine of EUR 14,000 on Azienda sanitaria unica regionale Marche. The DPA launched an investigation against the health department following media reports of deficiencies in the system used to collect and manage Covid 19 screening data. The health department used an app that generated QR codes for people who were tested for Covid-19. The QR code was generated based on a progressive criterion rather than on a random basis. Thus, each person was assigned a number. Because of this, it would have been possible for unauthorized persons to change a digit and gain access to another person's profile and thus personal data. The DPA found that the health authority failed to implement adequate technical and organizational measures to ensure a level of security appropriate to the risk to the data subjects.

Open original source Links to the regulator's original publication or another source.