Italian Data Protection Authority (Garante) · 11 June 2026
Lecce Local Health Authority
Insufficient technical and organisational measures to ensure information security
- Regulator
- Italian Data Protection Authority (Garante)
- Decided
- 11 June 2026
- Country
- Italy
- Sector
- Health Care
- Regulator’s reference
- Not recorded
- Fino case number
- 2026/IT/085
What happened
The Italian DPA has imposed a fine of EUR 4,500 on the Lecce Local Health Authority. The Italian Data Protection Authority (DPA) has fined the Lecce Local Health Authority €4,500. The controller operates a hospital whose Urology Department stored patients' analog medical records in an openly accessible trolley. The operator did not implement procedures for the protection of personal data and did not report the personal data breach. None of the unit's personnel had participated in personal data protection training.
Summary from the CMS Enforcement Tracker, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 29Processing under the authority of the controller or processorRead →
- Art. 32Security of processingRead →
- Data security
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2026/IT/085.