Italy

Azienda Ospedaliera Universitaria Careggi

6,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2021-02-25.

Rank · Sector

#171

of 270 in Health Care

Rank · Italy

#327

of 543

Rank · All fines

#1,612

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2021-02-25
Controller / Processor: Azienda Ospedaliera Universitaria Careggi
Sector: Health Care
Quoted Articles: Art. 5 GDPR, Art. 9 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA (Garante) has imposed a fine of EUR 6,000 on Azienda Ospedaliera Universitaria Careggi for a breach of Art. 5 GDPR and Art. 9 GDPR. Azienda Ospedaliera Universitaria Careggi had notified the DPA of a data breach under Art. 33 GDPR regarding the transfer of health data to the wrong person. Medical documents of a patient had been sent by mail both to the affected patient and to another patient. The controller states that the incident occurred due to an error in the printing process. The ward where the affected patient was treated was only equipped with two printers, and one doctor had unknowingly also taken a colleague's print job (the affected patient's documents) when taking out his print job (the documents of the wrong recipient).

Open original source Links to the regulator's original publication or another source.