Italy

Thin Srl

15,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2023-06-01.

Rank · Sector

#118

of 270 in Health Care

Rank · Italy

#229

of 543

Rank · All fines

#1,203

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2023-06-01
Controller / Processor: Thin Srl
Sector: Health Care
Quoted Articles: Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 13 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection regulations. The company was running an international project to improve patient care by collecting and analyzing health data.

To participate in the project, GPs were required to add an additional function to their existing management software. The additional function was supposed to automatically anonymize patient data and transfer it to the company's database. However, during its investigation, the DPA found that the add-on feature installed did not effectively anonymize data.
In addition, the DPA found that Thin had also violated its information obligations under the GDPR. The company had incorrectly assumed that it was processing anonymized data and had actually processed personal data without providing adequate information to the data subjects.

Open original source Links to the regulator's original publication or another source.