Italy

Fondazione Policlinico Tor Vergata di Roma

15,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2021-04-21.

Rank · Sector

#116

of 270 in Health Care

Rank · Italy

#223

of 543

Rank · All fines

#1,188

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2021-04-21
Controller / Processor: Fondazione Policlinico Tor Vergata di Roma
Sector: Health Care
Quoted Articles: Art. 5 (1) a), f) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Italian DPA (Garante) has imposed a fine of EUR 15,000 on Fondazione Policlinico Tor Vergata di Roma. In February 2020, a data subject filed a complaint with Garante alleging a breach of data protection laws in relation to the booking services for medical specialists offered by the controller. In order to book a relevant appointment on the booking portal, visitors had to fill out an online form in which various personal data was requested. As the DPA found, the controller had not implemented adequate technical and organizational measures to ensure the protection of data processing. In addition, the controller did not comply with its information obligations pursuant to Art. 13 GDPR, as it had not properly informed the data subjects about the processing of their personal data at the time of the data collection.

Open original source Links to the regulator's original publication or another source.