Azienda Ospedaliero Universitaria di Ferrara – €20,000 Fine (Italy, 2025)

The data subject was a patient at gynecology emergency room of a hospital in Ferrara, where she was also an employee. In the days following her medical emergency, she is made aware that her colleagues knew of her sensitive medical issues, as they were circulated in a WhatsApp work groupchat by one of the colleagues. The local health authority of Ferrara (the controller), after being asked by the DPA to provide more insight, explained that only employees having direct need for the patient’s info have access to it through their domain access. To provide more context, it also shared that the health authority implemented an audit system to check the logs of the filing system and report any abnormal activities. Such audits are performed manually, but plans are in place to automatise them upon the reception of EU funds. The health authority further explains that in previous years, after appointing a DPO, they were instructed to delete all generic administrative profiles that allow access to every worker of a specific category (e.g. a “radiology” profile instead of a separate profiles for each radiologist). They carried out the deletion, but realised only after the complaint that a few of those generic profiles remained, and were not found earlier because no abnormal activity resulted from the audits. The remaining generic profiles were immediately deleted after they were found. The DPA upheld the complaint and found violations of Article 5(1)(a) GDPR, Article 5(1)(f) GDPR, Article 9 GDPR, Article 25 GDPR, and Article 32 GDPR. The failure to adequately implement sufficient organisational and technical measures amounts to a breach of Article 32, and Article 5(1)(f). The fact that unauthorised parties could access medical files of patients represented a violation of Article 5(1)(a) and of Article 9. Overall, the lack of appropriate safeguards contravenes the principles of privacy by design and by default, thus breaching Article 25 GDPR. Following this, the DPA imposed