Azienda Ospedaliero-Universitaria Città della Salute e della Scienza di Torino – €6,000 Fine (Italy, 2025)

An employee (the data subject) of a hospital (the controller) worked at the controller's DPO office. She received an email from the personnel office containing information about her vaccination status (vaccination completed) and the suspension from service of another employee due to failure to vaccinate. The email was sent to the shared email address of the DPO office, to which the manager, the complainant and the other employee had access to. As a result, both employees became aware of each other's vaccination status, even thought they were not authorised to access such data. The data subject filed a complaint. The DPA concluded that despite the controller's intention to avoid misdelivery and the urgency of the situation, using the shared email box for this communication constituted an unlawful disclosure of personal data, including health data. Employees' personal data must only be made available to those who need to process it for the purposes of their assigned tasks and specific role within the organisation. Making data available – by sending it to a functional email address – to individuals who are part of the organisation but who do not need to know the information may constitute unlawful ‘communication’ of personal data, as it lacks a suitable legal basis.