Physician
Insufficient legal basis for data processing
Ngày ra quyết định
15 tháng 4, 2021
Thẩm quyền
Italian Data Protection Authority (Garante)
IT
Ngành
Health Care
Quốc gia
IT
Luật
GDPRTrạng thái
FINALMô tả
The Italian DPA (Garante) has imposed a fine of EUR 5,000 on a physician. The controller had shown slides of a clinical case at a congress, which were subsequently published on the website of the Società triveneta di chirurgia. The slides contained personal data of a patient, such as the patient's initials, age, gender, a detailed medical history of the patient, details of admissions from 1980 to 2016 and surgical procedures performed during that period, indicating the date of admission and the date of surgery, the surgical department that performed the procedures, the days spent in hospital, numerous diagnostic images and 22 photographs showing the patient during the surgeries. At no time had the data subject consented to such processing of his or her personal data.