- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Azienda sanitaria unica regionale Marche – €14,000 Fine (Italy, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Azienda sanitaria unica regionale Marche was fined for failing to secure personal data collected during Covid-19 screenings. This case is significant because it highlights the need for strong security measures to protect sensitive health information.
What happened
The health authority did not implement adequate security measures for handling Covid-19 screening data, risking unauthorized access.
Who was affected
Individuals whose personal data was collected during Covid-19 testing by the health authority.
What the authority found
The Garante found that the health authority violated GDPR by not ensuring appropriate security for personal data.
Why this matters
This ruling emphasizes the importance of implementing robust security measures in health data management, especially during public health crises.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA has imposed a fine of EUR 14,000 on Azienda sanitaria unica regionale Marche. The DPA launched an investigation against the health department following media reports of deficiencies in the system used to collect and manage Covid 19 screening data. The health department used an app that generated QR codes for people who were tested for Covid-19. The QR code was generated based on a progressive criterion rather than on a random basis. Thus, each person was assigned a number. Because of this, it would have been possible for unauthorized persons to change a digit and gain access to another person's profile and thus personal data. The DPA found that the health authority failed to implement adequate technical and organizational measures to ensure a level of security appropriate to the risk to the data subjects.
Related Enforcement Actions (0)
No other enforcement actions found for Azienda sanitaria unica regionale Marche in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
13 January 2022
Authority
Garante per la protezione dei dati personali
Fine Amount
€14,000
About this data
Cite as: Cookie Fines. Azienda sanitaria unica regionale Marche - Italy (2022). Retrieved from cookiefines.eu
Last updated: