Italy

Giuliano Isontina University Health Authority

10,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-03.

Rank · Sector

#152

of 283 in Health Care

Rank · Italy

#331

of 595

Rank · All fines

#1,493

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-03
Controller / Processor: Giuliano Isontina University Health Authority
Sector: Health Care
Quoted Articles: Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Italian DPA has imposed a fine of EUR 10,000 on Giuliano Isontina University Health Authority. The controller notified the relevant authorities of a personal data breach regarding a data subject's health record. The data subject's former spouse and three other healthcare professionals employed by the controller accessed this data without authorisation. The personal data could be accessed due to a loophole that allowed unauthorised personnel to access personal data via an override using a self-declaration form stating the reason for accessing that data.

Open original source Links to the regulator's original publication or another source.