Italy

Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital)

80,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2020-09-30.

Rank · Sector

#47

of 270 in Health Care

Rank · Italy

#88

of 543

Rank · All fines

#528

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2020-09-30
Controller / Processor: Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital)
Sector: Health Care
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

According to the data protection authority, personal information about participants in a public competition had been unlawfully disclosed online. The reason for this was that, due to a configuration error, a list of the codes assigned to the candidates was temporarily accessible on the platform, which allowed access to the documents submitted by the candidates with their personal data. This was a violation of the principle of protection of information security. In addition, the data protection authority found that the information obligations were also not complied with and that the hospital had also not provided a sufficient data processing agreement with the data processor [which was also fined, see fine for "Scanshare"] in accordance with Art. 28 GDPR.

Open original source Links to the regulator's original publication or another source.