Italy

Italian Ministry of Defense

10,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2022-04-28.

Rank · Sector

#183

of 357 in Public Sector and Education

Rank · Italy

#272

of 543

Rank · All fines

#1,365

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2022-04-28
Controller / Processor: Italian Ministry of Defense
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-octies Codice della privacy
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 10,000 on the Italian Ministry of Defense.
An employee of the ministry had filed a complaint with the DPA.
During its investigation, the DPA found that two emails had been forwarded without authorization. These e-mails contained, among other things, sensitive information on the health status of the data subject as well as information on legal proceedings.

Open original source Links to the regulator's original publication or another source.