Italy

Italian Red Cross

700 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-28.

Rank · Sector

#274

of 281 in Health Care

Rank · Italy

#567

of 573

Rank · All fines

#2,823

of 3,106

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-28
Controller / Processor: Italian Red Cross
Sector: Health Care
Quoted Articles: Art. 5 (1) c), f) GDPR, Art. 9 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA has imposed a fine of EUR 700 on the Italian Red Cross. The data subject suffers from HIV and HCV. They informed employees at the Anna Torrigiani Centre Hospital of these conditions, but later found a note containing their full name and conditions on a food serving tray. Although no patients sharing the data subject's room were informed, the kitchen staff were made aware of the data subject's conditions.

Open original source Links to the regulator's original publication or another source.