- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Miropass S.r.l. – €40,000 Fine (Italy, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Italy's data protection authority fined Miropass S.r.l. EUR 40,000 for mishandling users' health data in its booking system. This matters because it emphasizes the importance of having a legal basis for processing sensitive information.
What happened
Miropass S.r.l. was fined for processing health data without a legal basis.
Who was affected
Users of the TuPassi booking system, particularly those making appointments at health care facilities.
What the authority found
The authority found that Miropass did not have a valid legal basis for processing personal data, violating GDPR rules.
Why this matters
This case underscores the need for companies to ensure they have proper legal grounds for processing sensitive data, especially in health-related contexts. Businesses should review their data handling practices to avoid similar penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA (Garante) fined Miropass S.r.l. EUR 40,000. Miropass is the provider of the TuPassi booking system, which among others has been used by the Municipality of Rome since 2015. The booking system enables the booking of appointments both on the website of the controller (www.tupassi.it) as well as via the corresponding app. For this purpose, the company collects and processes the personal data of the users. In the course of its investigation, the Italian DPA found that Miropass, particularly in the context of health data resulting from appointment bookings at health care facilities, had no legal basis for the processing and violated the principle of storage limitation.
Related Enforcement Actions (0)
No other enforcement actions found for Miropass S.r.l. in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
17 December 2020
Authority
Garante per la protezione dei dati personali
Fine Amount
€40,000
About this data
Cite as: Cookie Fines. Miropass S.r.l. - Italy (2020). Retrieved from cookiefines.eu
Last updated: