Italian Data Protection Authority (Garante) · 28 April 2022
Ospedale San Raffaele s.r.l.
Non-compliance with general data processing principles
Fine€70,000Fine issued
- Regulator
- Italian Data Protection Authority (Garante)
- Decided
- 28 April 2022
- Country
- Italy
- Sector
- Health Care
- Regulator’s reference
- Not recorded
- Fino case number
- 2022/IT/089
What happened
The Italian DPA fined a hospital €70,000 for putting the recipients of two medical newsletters in CC instead of BCC, revealing the personal data (including health data) to all recipients without legal basis.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(1)(f)Read →
- Art. 9Processing of special categories of personal dataRead →
- Data principles
- Special categories
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2022/IT/089.