Italy

Azienda Usl Valle d'Aosta

40,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2022-11-10.

Rank · Sector

#77

of 270 in Health Care

Rank · Italy

#140

of 543

Rank · All fines

#819

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2022-11-10
Controller / Processor: Azienda Usl Valle d'Aosta
Sector: Health Care
Quoted Articles: Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA has fined Azienda Usl Valle d'Aosta EUR 40,000. An employee and patient of the health department had filed a complaint with the DPA because a colleague who had never treated them had repeatedly accessed their medical file, despite the fact that they had explicitly refused their consent to the data processing.

During its investigation, the DPA found that, in order to simplify patient management during the Covid 19 pandemic, the health department had simplified the medical record system. As a result, patient medical records were accessible to any employee, whether or not the affected patient had consented to it.

The DPA considered this a violation of the obligation to implement appropriate technical and organizational measures to protect personal data.

Open original source Links to the regulator's original publication or another source.