Regione Lazio
€75,000
Insufficient data processing agreement
决定日期
2021年1月14日
权力
Italian Data Protection Authority (Garante)
IT
部门
Public Sector and Education
国家
IT
法律
GDPR现状
FINAL说明
The Italian DPA (Garante) has fined Regione Lazio (Lazio Region) EUR 75,000 for failing to designate Capodarco, the company it entrusted with the management of reservations for healthcare services in 1999, as a data processor. The controller had not entered into a contract with Capodarco that would have governed its role as data processor in accordance with the requirements of data protection law. Thus, a proper contract for commissioned processing had not been concluded until 2019, which meant that data had been processed unlawfully for a period of about 20 years.
法律引文
Art. 5 (2)Art. 28
问题与违规
Insufficient data processing agreement