L’Azienda socio sanitaria territoriale Melegnano e della Martesana - A.S.S.T. – €3,500 Fine (Italy, 2022)

This case was initiated by a data breach notification reported to the Italian DPA (Garante per la Protezione dei Dati Personali – Garante), by a controller, which in this case was the local health authority of Melegnano e della Martesana (L’Azienda socio sanitaria territoriale Melegnano e della Martesana - A.S.S.T.). The data breach concerned the unauthorised disclosure of a medical report to a third party. The data breach did not involve the controller’s IT systems and infrastructures, and was instead due a mistake by an employee, which handed over the wrong physical paper copy of a medical report to another patient. The controller explained to the Garante that it only became aware of the violation following a communication by the lawyer of the person to whom the aforementioned medical documentation had been mistakenly given to. The controller stated that they had subsequently asked this person to destroy any digital and paper copies that may have been made of it, and to not disclose the contents of the report to any third parties. Additionally, the controller stated that it had notified the affected data subject that the data breach had occurred, and had also conducted an internal audit to determine the causes for the mistake, revising its internal procedures, and implementing further training courses focused on the correct management of documentation and health data. The Garante held that the mistake by the employee had led to disclosing a data subject’s health data to a third party without a valid legal basis, in violation of Article 9 GDPR. Additionally, it held that the employee’s negligence also constituted a violation of the principle of integrity and confidentiality under Article 5(1)(f) GDPR on behalf of the controller, since it is responsible for processing personal data in such a way as to ensure security through appropriate technical and organisational measures in order to prevent unauthorised or unlawful processing. However, the Garante acknowledged, as mitigating factors, that the health data breach was an isolated incident concerning only one data subject; that the controller had introduced measures to remedy the human error; that the controller had communicated the breach to the data subject as well as to the Garante; that there had been no data subject complaint related to the data breach; and that the controller had fully cooperated with the Garante during the investigation. Based on these considerations, the Garante issued a fine of €3500 against the controller for a violation of Articles 9 and 5(1)(f) GDPR.