Italy

Regione Lazio

75,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2021-01-14.

Rank · Sector

#52

of 357 in Public Sector and Education

Rank · Italy

#94

of 543

Rank · All fines

#561

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2021-01-14
Controller / Processor: Regione Lazio
Sector: Public Sector and Education
Quoted Articles: Art. 5 (2) GDPR, Art. 28 GDPR
Type of violation: Insufficient data processing agreement

Summary

The Italian DPA (Garante) has fined Regione Lazio (Lazio Region) EUR 75,000 for failing to designate Capodarco, the company it entrusted with the management of reservations for healthcare services in 1999, as a data processor. The controller had not entered into a contract with Capodarco that would have governed its role as data processor in accordance with the requirements of data protection law. Thus, a proper contract for commissioned processing had not been concluded until 2019, which meant that data had been processed unlawfully for a period of about 20 years.

Open original source Links to the regulator's original publication or another source.