Studio Fisiokinesiterapico Romano S.r.l. – Reprimand (Italy, 2025)

A physiotherapy clinic (the controller) offered patients the option of receiving clinical reports by email. The data subject had analyses carried out at the controller's premises and requested that the results be sent to their email address. Having not received the report, the data subject returned to the clinic in person, where a member of staff confirmed that the document had already been sent by email. It was then found that the report had been sent to a different address, differing from the data subject's by a single letter ("L" instead of "D"). The data subject verified that the incorrect address existed and was active, meaning that an unknown third party had received documentation containing their name, surname, date of birth and tax identification number. The data subject filed a complaint with DPA. During the investigation, the controller stated that the error resulted from a bug in the interface between its management software and the laboratory's software. It explained that, because it only became aware of the incident upon receiving the DPA's official notification (approximately two months after the event ) it had not been possible to contact the unintended recipient in a timely manner. The controller acknowledged the error, described it as an isolated and unintentional incident, and reported that it had since fixed the software bug, invalidated the incorrect email address in its systems, updated its address verification procedures, and retrained its staff. The DPA noted that it had previously issued guidelines to all public and private healthcare providers setting out the precautions to be followed when sending clinical reports by email. Those guidelines specifically required controllers to validate email addresses through an online verification procedure before transmitting documents, so as to avoid sending health data to unintended recipients. The controller had failed to implement such a measure. As a result, the data subject's health data was disc