Italy

Cluster S.r.l.

18,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2023-11-16.

Rank · Sector

#108

of 270 in Health Care

Rank · Italy

#214

of 543

Rank · All fines

#1,126

of 3,042

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2023-11-16
Controller / Processor: Cluster S.r.l.
Sector: Health Care
Quoted Articles: Art. 5 GDPR, Art. 32 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA imposed a fine of EUR 18,000 on Cluster S-r.l. A data subject had complained to the DPA because their son's health-related data and their own personal data had been published on the internet. The controller had organized a medical training event at which documents containing personal data of the data subject and their deceased son were forwarded to the participants without sufficient anonymization. Some documents were later published on the internet by a third party.

Open original source Links to the regulator's original publication or another source.