Garante per la protezione dei dati personali (Italy) - 616/2026
Italian DPA fines healthcare agency €24,000 for data minimization and access control violations.
The Italian Data Protection Authority (Garante) has fined the University Health Agency of Friuli Centrale €24,000 for violations related to its electronic health record system. The agency failed to adequately restrict access to patient data, particularly Covid-19 results and surgical department information, to only those directly involved in patient care. Additionally, the DPA found that the system's automatic computer lockout mechanism had an inappropriate inactivity period, and the agency lacked a system for detecting anomalous processing activities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe University Health Agency of Friuli Centrale failed to enforce the principle of least privilege within its electronic health record (EHR) system, allowing staff access to sensitive patient data — including Covid-19 results and surgical records — beyond what their care role required. Compounding this, the system's automatic screen lockout inactivity timeout was set to an inappropriately long interval, increasing the risk of unauthorized access to unattended sessions. Perhaps most critically, the agency had no mechanism in place to detect anomalous or unauthorized data processing activities, meaning breaches could go unnoticed indefinitely. In healthcare, where patient data is among the most sensitive personal information, these combined failures represent serious non-compliance with GDPR's data minimization and integrity principles and create real risk of harm to patients.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.