AST Ascoli Piceno – €17,000 Fine (Italy, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Territorial Health Agency of Ascoli Piceno gave an employee's employer details about their medical check-ups, violating the employee's privacy. This is important because it shows that health information must be kept private and not shared without consent. The agency was fined €17,000 for this breach.
What happened
Ascoli Piceno's health agency disclosed an employee's medical examination details to their employer.
Who was affected
The employee whose medical information was shared with their employer without consent.
What the authority found
The authority ruled that the health agency violated GDPR by disclosing personal health information without proper safeguards.
Why this matters
This ruling emphasizes the importance of confidentiality in healthcare. Organizations must implement strict measures to protect sensitive information from unauthorized access.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject advanced a complaint against the Territorial Health Agency of Ascoli Piceno (in Italian: AST Ascoli Piceno), the controller, which gave the data subject´s employer a certificate for absence with the name of the hospital wards where the data subject had her check-up. This approach disclosed to the data subject's employer which kind of examinations they received. The data subject's attempt to keep this information from their employer was therefore futile. The DPA requested information related to the data subject from the controller under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig~art157 Article 157 of the Italian Privacy Code (Codice in materia di protezione dei dati personali)], to which no reply was ever given. After the controller failed to reply to the DPA's request, the DPA started a formal proceeding under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig~art166 Article 166(5) of the Italian Privacy Code (Codice in materia di protezione dei dati personali)]. The DPA started its analysis by considering how the controller violated Articles 5(1)(c) and (f) GDPR, as well as Article 25 GDPR and Article 32 GDPR due to naming the hospital wards where the data subject had her medical examinations. The DPA further reiterated that healthcare agencies are required to put into place specific procedures aimed at preventing that third parties somehow connect the data subject with the relevant hospital ward, as per [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2018-08-10;101~art22! Article 22(11) Legislative decree of 10 August 2018 (Decreto Legislativo 10 agosto 2018, n. 101)]. Moreover, the DPA previously explained in another decision that no data related to the healthcare structure or the visit prescribed shall be present in any document given to the data subject to certify their presence in the hospital or justify an absence from wo
Related Enforcement Actions (0)
No other enforcement actions found for AST Ascoli Piceno in IT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
26 September 2024
Authority
Garante per la protezione dei dati personali
Fine Amount
€17,000
GDPRhub ID
gdprhub-8727About this data
Cite as: Cookie Fines. AST Ascoli Piceno - Italy (2024). Retrieved from cookiefines.eu
Last updated: