Italian Data Protection Authority Imposed an Administrative Fine on a Social Enterprise Due to Sensitive Data Breach

The Italian Data Protection Authority (“Authority”) decided to impose an administrative fine of €20,000 on a social enterprise following the accidental disclosure of sensitive data concerning children receiving special educational support.

The following findings and assessments were emphasized in the decision;

The investigation revealed that the social enterprise was acting as a subcontractor on behalf of the Municipality of Bologna (“Municipality”) to provide support and educational services to students with special needs.
It was established that, due to an employee strike, a one-day service interruption occurred and was notified to the Municipality via email. However, as a result of human error, a document containing the names of 61 students, information regarding their health conditions, and details of the special arrangements required at school was mistakenly attached to the email. Unaware of the attachment, the Municipality subsequently forwarded the email to its staff and to 53 families.
It was determined that the attached file contained sensitive personal data that was unnecessary for the purpose of the notification made to the Municipality.
In this context, the processor was found to have failed to comply with its obligations regarding the secure processing of personal data, in violation of Articles 28(3) and 32(1) of the GDPR.
Consequently, an administrative fine of €20,000 was imposed on the processor.
In determining the sanction, it was taken into account that the breach stemmed from human error and that more stringent data protection measures (including pseudonymization of data) were subsequently adopted.
Furthermore, the processor agreed to pay €2,000 in compensation to a family affected by the incident. In relation to the same incident, the Municipality of Bologna, as the data controller, was also fined €40,000.

You can access the full text of the Decision here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.