Cooperativa Quadrifoglio s.c. Onlus – €20,000 Fine (Italy, 2025)

Cooperativa Quadrifoglio (the processor) was a social enterprise with a staff of about 3,000 people. The processor provided support and educational services to special need students (the data subjects) as a subcontractor of the municipality of Bologna (the controller). In order for the provider to provide its services, the controller shared information about the data subjects with the processor. The processor was unable to provide some of its services for one day due to a worker strike. The processor emailed the controller about the interruption of certain services. In turn, the controller forwarded the communication to numberous staff members and to 53 families of children who attended two schools within the municipalitySome of the information about the breach is not mentioned in the decision but can be found in the DPA's decision against the controller over the same breach, which includes a more exhaustive explanation of the facts. See [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10146543 Garante per la protezione dei dati personali, provv. 1014654]3.. Due to a human error, the processor attached unnecessary documents to the email, including a list of 61 data subjects who relied on the controller’s services. The list was not pseudonymized and included the data subjects' name and other information, such as detailed information about their health status and the accomodations they needed in school. The controller did not notice the attachment and forwarded it to the families along with the email. The DPA received a complaint related to the incident. Aside from the procedure with the DPA, the processor agreed to cover €2,000 in damages in favor of a data subjects' family, following an amicable settlement between the family and the controller. The DPA held that the documents contained sensitive data from the data subjects. Furthermore, the DPA held that including the data in the documentation was unnecessary for informing the controller about the service interruptions. On these grounds, the DPA held that the processor violated its duty to process data securely, in violation of Articles 28(3) and 32(1) GDPR. The DPA fined the processor for €20,000. In this regard, the DPA considered that the incident was due to a human error and that the processor later implemented stricter data policies, including the pseudonymization of the subjects' data in its communications with the controller.