Azienda Ospedale-Università Padova – €5,000 Fine (Italy, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Azienda Ospedale-Università Padova was fined €5,000 for mishandling personal data by sending an email that revealed the addresses of multiple recipients. This incident matters because it shows the importance of protecting personal information and obtaining consent before sharing it. Small businesses should ensure they handle personal data carefully to avoid similar issues.
What happened
Azienda Ospedale-Università Padova sent an email with consent forms that exposed the email addresses of 19 recipients.
Who was affected
Recipients of the email who were invited to participate in a clinical trial were affected.
What the authority found
The Italian data protection authority found that the company violated GDPR rules by not protecting personal data and failing to obtain proper consent.
Why this matters
This case highlights the need for companies to prioritize data privacy and consent when handling personal information. It serves as a reminder for businesses to implement better data protection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
Processing notes: articles corrected, scope corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA has imposed a fine of EUR 5,000 on Azienda Ospedale-Università Padova. The controller had sent an email containing consent forms for participation in a clinical trial to several recipients in an open distribution list. This allowed the recipients to view the email addresses of all other recipients, 19 in total.
Violations (1)
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Related Enforcement Actions (0)
No other enforcement actions found for Azienda Ospedale-Università Padova in IT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
Fine Date
11 January 2023
Authority
Garante per la protezione dei dati personali
Fine Amount
€5,000
About this data
Cite as: Cookie Fines. Azienda Ospedale-Università Padova - Italy (2023). Retrieved from cookiefines.eu
Last updated: