- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Azienda ospedaliera di Perugia – €40,000 Fine (Italy, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Azienda ospedaliera di Perugia was fined €40,000 for multiple GDPR violations related to a whistleblowing system. This case highlights the need for healthcare facilities to properly protect personal data and inform employees about data processing.
What happened
Azienda ospedaliera di Perugia failed to secure a whistleblowing system, exposing users' browsing data.
Who was affected
Employees of the healthcare facility who could have been identified as whistleblowers were affected by the data breaches.
What the authority found
The Italian DPA found that the healthcare facility violated several GDPR rules by not securing personal data and failing to inform employees about data processing.
Why this matters
This ruling underscores the importance of data protection in healthcare settings. Organizations must ensure proper security measures and transparency to protect personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA (Garante) has fined Azienda ospedaliera di Perugia EUR 40,000. During an investigation at the healthcare facility, the DPA found multiple GDPR violations. The DPA's investigation took place as part of a series of inspections dealing with the processing of data in the context of whistleblower systems at employers. The healthcare facility used an open source-based whistleblowing web application. However, the application was accessed through systems that were not properly configured. This made it possible to record and store users' browsing data, thus identifying those users and, as such, potential whistleblowers. With respect to the processing of personal data, the health facility had failed to inform the employees in advance. In addition, the DPA found that the healthcare facility had not conducted a data protection impact assessment and had not registered the processing in the register of processing activities. Thus, no sufficient assessment of the risks to the rights and freedoms of the data subjects had been carried out. '
Related Enforcement Actions (0)
No other enforcement actions found for Azienda ospedaliera di Perugia in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
7 April 2022
Authority
Garante per la protezione dei dati personali
Fine Amount
€40,000
About this data
Cite as: Cookie Fines. Azienda ospedaliera di Perugia - Italy (2022). Retrieved from cookiefines.eu
Last updated: