- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
ISWEB S.p.A. – €40,000 Fine (Italy, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
ISWEB S.p.A. was fined EUR 40,000 for not giving proper instructions to an external provider that hosted a whistleblower system for a healthcare facility. This matters because it highlights the importance of clear data processing instructions to protect personal information. Companies providing such systems need to ensure they comply with data protection rules.
What happened
ISWEB S.p.A. failed to provide specific instructions to an external provider for processing personal data related to a whistleblower system.
Who was affected
Visitors to the healthcare facility's whistleblower system whose data was processed without proper instructions.
What the authority found
The Italian DPA found that ISWEB did not comply with GDPR requirements for data processing instructions.
Why this matters
This case underscores the need for companies to ensure that any external providers they use for data processing are given clear instructions. It sets a precedent for accountability in data handling practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Italian DPA imposed a fine of EUR 40,000 on ISWEB S.p.A.. The fine is related to a fine against the healthcare facility Azienda ospedaliera di Perugia. ISWEB had provided the healthcare facility with the web application for its whistleblower system. During an investigation at the healthcare facility, the DPA identified multiple GDPR violations related to the whistleblower system. The DPA's investigation took place as part of a series of inspections addressing whistleblower system data processing at employers. In relation to ISWEB, the DPA found that they had used an external provider to host the whistleblower systems. However, ISWEB failed to provide the external provider with specific instructions for the processing of data subjects' data, as well as to inform the health care facility of the same.
Related Enforcement Actions (0)
No other enforcement actions found for ISWEB S.p.A. in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
7 April 2022
Authority
Garante per la protezione dei dati personali
Fine Amount
€40,000
Enforcement Tracker ID
ETid-1160
About this data
Cite as: Cookie Fines. ISWEB S.p.A. - Italy (2022). Retrieved from cookiefines.eu
Last updated: