Italy

Health Protection Agency of the Metropolitan City of Milan, Workplace Prevention and Safety Service, Milan North

7,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2025-05-21.

Rank · Sector

#203

of 357 in Public Sector and Education

Rank · Italy

#325

of 543

Rank · All fines

#1,569

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2025-05-21
Controller / Processor: Health Protection Agency of the Metropolitan City of Milan, Workplace Prevention and Safety Service, Milan North
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) c), f) GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 7,000 on Health Protection Agency of the Metropolitan City of Milan, Workplace Prevention and Safety Service, Milan North. The controller forwarded health data of a data subject to their employer without a sufficient legal basis.

Open original source Links to the regulator's original publication or another source.