- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 9920292 – Complaint Upheld (Italy, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Italian data protection authority upheld complaints against a health institute for its Monkeypox vaccination procedure. The institute required people to fill out a detailed questionnaire, including sensitive questions about sexual orientation and health, before booking a vaccination. This ruling stresses that organizations must inform people about how their data will be used.
What happened
The health institute required a questionnaire with sensitive questions before allowing vaccination appointments.
Who was affected
Individuals seeking Monkeypox vaccinations who were required to fill out the questionnaire.
What the authority found
The Italian DPA found that the health institute did not provide necessary information about data processing to the individuals.
Why this matters
This case highlights the importance of transparency in data collection, especially when sensitive information is involved. Organizations must ensure they inform users about how their data will be processed.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A number of complaints were made to the Italian DPA by multiple data subjects against the Lazzaro Spallanzani National Institute for Infectious Diseases (hereinafter, the controller). The complaints were against the controller’s vaccination procedure for Monkeypox. The controller asked those interested in receiving vaccinations to fill out a questionnaire and send it to an internal email address. The data subjects were unable to book a vaccination appointment without filling the questionnaire. The questionnaire asked questions such as: * "Do you fall under one of the following definitions: gay - transgender – bisexual l - man who has sex with men (MSM)" * "Have you had a recent history (last 3 months) with multiple sexual partners? " * "Have your sexual partner(s) participated in group sex events?" * " Have your sexual partner(s) had a recent sexually transmitted infection (syphilis, gonorrhoea, chlamydia) with at least one episode in the last year?" * "Do you or your sexual partner(s) have a habit of associating sexual acts with the use of chemical drugs (Chemsex)?" This information falls under the category of special personal data under Article 9 GDPR as it relates to both health data, and data concerning a person’s sexual orientation/ sex life. Article 13 GDPR imposes a duty upon controllers to provide data subjects with information regarding the processing, such as the purposes for the processing, the legal basis for processing and the amount of time the data will be stored for, amongst others. The controller, during this process, did not provide data subjects with information regarding the processing. In its investigation of the complaints, the Italian DPA requested further information from Italy’s Ministry of Health on what its official approach was to the provision of Monkeypox vaccinations. The Ministry submitted that there was no instruction from them to the regional health institutes that there should be prior identification of those to be vaccinated,
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 9920292 in IT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 9920292 - Italy (2023). Retrieved from cookiefines.eu
Last updated: