Italy

Azienda USL Toscana Centro

10,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2022-03-10.

Rank · Sector

#132

of 269 in Health Care

Rank · Italy

#267

of 543

Rank · All fines

#1,347

of 3,039

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2022-03-10
Controller / Processor: Azienda USL Toscana Centro
Sector: Health Care
Quoted Articles: Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 32 GDPR,
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA (Garante) has imposed a fine of EUR 10,000 on Azienda USL Toscana Centro. The DPA initiated an investigation against the controller after it reported a data breach under Art. 33 GDPR. The controller had mistakenly sent patient medical records to the wrong patients. The DPA therefore found that the health care facility had not taken sufficient technical and organisational measures to protect personal data.

Open original source Links to the regulator's original publication or another source.