Italy

Azienda sanitaria locale di Bari

50,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2023-03-02.

Rank · Sector

#68

of 270 in Health Care

Rank · Italy

#115

of 543

Rank · All fines

#728

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2023-03-02
Controller / Processor: Azienda sanitaria locale di Bari
Sector: Health Care
Quoted Articles: Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR, Art. 25 (1), (2) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 50,000 on Azienda sanitaria locale di Bari. The healthcare facility had published reviews of former patients on the Internet and provided access to hundreds of documents on which it was possible to identify the patients. The information about the patients had been crudely redacted, but not enough to prevent the data from being disclosed. In particular, information about the patients' state of health, clinical data on operations, diagnoses, etc. were visible.

Open original source Links to the regulator's original publication or another source.