Italian Red Cross – €700 Fine (Italy, 2026)

A data subject brought a complaint to the DPA through a non-profit organisation (LILA) against the Italian Red Cross (the controller). While the data subject was hospitalised, they received their food tray with a note stating their full name and medical condition as a patient with HIV. The data subject had also contacted the health directorate of the hospital, but had not received a response. During the DPA’s investigations, the controller stated that it included information on patients’ conditions to alert the kitchen staff on protective measures needed. The controller later modified the form alerting the staff to replace the patient’s medical condition with specific requests (e.g. to use disposable tableware). The DPA found a violation of Article 9 GDPR. The DPA highlighted that under national law, the controller has additional responsibilities in ensuring the confidentiality of data subjects that have HIV or AIDS. National law also requires medical facilities to implement protective measures to prevent the transmission of HIV. However, this requirement does not justify including the data subject’s full name and condition in the context of meal service. Therefore, the controller did not have a legal basis to process the data subject’s personal data in the context of disclosing the data subject’s HIV status while providing meals. This was the case for both including the patient's medical information in the form to the kitchen staff and disclosing the data through the note in the meal tray. The DPA also found a violation of Articles 5(1)(c) and (f) GDPR. The DPA considered that the processing activity violated the principle of data minimisation. The controller also failed to ensure security of processing by disclosing the data subject’s medical condition. Finally, the DPA found a violation of [https://www.gazzettaufficiale.it/atto/stampa/serie_generale/originario Article 157 of the Code], as the controller had not complied with its obligation to provide information to the DPA during its investigations. The DPA fined the controller €700. The DPA took into account that the controller had implemented measures to prevent future incidents from happening, such as raising awareness among staff.