Italy

Lecce Local Health Authority

4,500 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-06-11.

Rank · Sector

#214

of 293 in Health Care

Rank · Italy

#438

of 623

Rank · All fines

#2,006

of 3,267

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-06-11
Controller / Processor: Lecce Local Health Authority
Sector: Health Care
Quoted Articles: Art. 5 (1) f), (2) GDPR, Art. 29 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA has imposed a fine of EUR 4,500 on the Lecce Local Health Authority. The Italian Data Protection Authority (DPA) has fined the Lecce Local Health Authority €4,500. The controller operates a hospital whose Urology Department stored patients' analog medical records in an openly accessible trolley. The operator did not implement procedures for the protection of personal data and did not report the personal data breach. None of the unit's personnel had participated in personal data protection training.

Open original source Links to the regulator's original publication or another source.