Italian Data Protection Authority
- Country
- Italy
- Fine
- 30,000 EUR
- Date
- 2020-01-23
- Sector
- Università degli studi di Roma "La Sapienza" (university)
- Articles
- Art. 32 of GDPR
This fine concerns insufficient technical and organisational measures to ensure information security
On december 2018 Università degli studi di Roma "La Sapienza", notified to the Italian DPA a data breach regarding the disclosure of personal data processed through the platform that the data controller was using for the processing of whistleblowing reports. According to the Italian DPA, the data breach occured as the platform used by the University did not provide sufficient technical measures regarding access control, which would have made it possible to limit access only to authorised parties in possession of authentication credentials and a specific authorisation profile. <br /><br />