Garante per la protezione dei dati personali (Italy) - 710/2026
Italian DPA finds controller violated GDPR by processing sensitive data without legal basis.
Summary
The Italian Garante per la protezione dei dati personali (DPA) has ruled against a data controller for violating GDPR. The DPA found that the controller processed sensitive patient data, including historical data exceeding 10 years, without an appropriate legal basis. The controller's claims of being a technological partner were dismissed, as they were actively involved in processing and anonymization, and their ownership of the database and instructions on data handling demonstrated their role as a controller.
The lesson from this incident
Full lessonA data controller was sanctioned by Italy's Garante after processing sensitive patient health data — including records spanning more than 10 years — without a valid legal basis under GDPR. The controller attempted to deflect responsibility by claiming a purely technical role as a 'technological partner,' but the DPA found that ownership of the database and direct involvement in anonymization and data handling clearly established controller status. This case underscores that legal responsibility follows actual data governance behavior, not self-assigned labels. Organizations cannot avoid GDPR obligations by relabeling their role; functional control over data processing determines accountability. The retention of historical sensitive data without justification further compounded the violation, highlighting the critical importance of defined retention schedules and lawful basis documentation.