Azienda USL della Romagna
- Country
- Italy
- Fine
- 50,000 EUR
- Date
- 2021-01-27
- Sector
- Hospital
- Articles
- Art. 5, par. 1, lett. a), d) and f)art. 9 andart. 32, par. 1 lett. b) of GDPR
Failure to comply with general data processing principles, processing of special categories of personal data without proper legal basis, insufficient technical and organisational measures to ensure the ongoing information security.
The case concerned the violation of a hospital patient who had explicitly requested the Hospital that no third party, including family members, be informed of her health condition. In particular, a hospital nurse, not being aware of the request, called her on the home number recorded in the hospital register, thus speaking to a family member and revealing him the ward where the patient was admitted. For this reason, the Hospital was held liable for not having implemented sufficient technical and organisational measures to ensure that the patient's wish to be contacted only at a specific telephone number was respected.