Italy

Vortika s.r.l.

30,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-14.

Rank · Sector

#90

of 281 in Health Care

Rank · Italy

#180

of 573

Rank · All fines

#947

of 3,106

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-14
Controller / Processor: Vortika s.r.l.
Sector: Health Care
Quoted Articles: Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 37 GDPR
Type of violation: Insufficient fulfilment of information obligations

Summary

The Italian DPA has imposed a fine of EUR 30,000 on Vortika s.r.l. The data subject filed a complaint regarding the controller's failure to adequately inform them about the processing of their personal data. The data subject was no longer a patient of the clinic, as asserted by Vortika s.r.l., who had taken over the clinic. Stating that, as a result they were not obliged to notify the data subject about the processing of their personal data, as they had become the lessee after the data subject's admission to the clinic. However by taking over the clinic Vortika s.r.l. gained control of the clinic's patients' personal data, therefore requiring them to inform the data subjects about the processing activities. Furthermore the controller did not appoint a data protection officer.

Open original source Links to the regulator's original publication or another source.