[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjl4-Pi-XqLu6cZKmMKRXBtusc0ptRq2QLc2kHenperI":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":22},"0de84e4e-08f1-4e9f-b48b-ccbbcff19e58","Garante per la protezione dei dati personali (Italy) - 710\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-710-2026-3b33ab","Show changes","The Italian Garante per la protezione dei dati personali (DPA) has ruled against a data controller for violating GDPR. The DPA found that the controller processed sensitive patient data, including historical data exceeding 10 years, without an appropriate legal basis. The controller's claims of being a technological partner were dismissed, as they were actively involved in processing and anonymization, and their ownership of the database and instructions on data handling demonstrated their role as a controller.","Italian DPA finds controller violated GDPR by processing sensitive data without legal basis.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_710\u002F2026&diff=53371&oldid=53370","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-10-12T11:26:53+00:00","2026-10-12T12:00:19.665245+00:00",7,[],"c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":17,"icon":19,"name":20,"slug":21},null,"Policy","policy",[23,28,33],{"category":24},{"id":25,"icon":19,"name":26,"slug":27},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":29},{"id":30,"icon":19,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":19,"name":36,"slug":37},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[],{"controls":41,"vendors":42},[],[],{"slug":44,"title":45,"body":46,"framework_refs":47,"framework_notes":58},"italian-dpa-fines-controller-for-unlawful-processing-of-sensitive-patient-data-without-legal-basis","Italian DPA Fines Controller for Unlawful Processing of Sensitive Patient Data Without Legal Basis","A data controller was sanctioned by Italy's Garante after processing sensitive patient health data — including records spanning more than 10 years — without a valid legal basis under GDPR. The controller attempted to deflect responsibility by claiming a purely technical role as a 'technological partner,' but the DPA found that ownership of the database and direct involvement in anonymization and data handling clearly established controller status. This case underscores that legal responsibility follows actual data governance behavior, not self-assigned labels. Organizations cannot avoid GDPR obligations by relabeling their role; functional control over data processing determines accountability. The retention of historical sensitive data without justification further compounded the violation, highlighting the critical importance of defined retention schedules and lawful basis documentation.",[48,49,50,51,52,53,54,55,56,57],"GDPR Article 4 (Definitions — Controller vs. Processor)","GDPR Article 5(1)(e) — Storage Limitation Principle","GDPR Article 6 — Lawfulness of Processing","GDPR Article 9 — Processing of Special Categories of Personal Data","GDPR Article 13\u002F14 — Transparency Obligations","GDPR Article 30 — Records of Processing Activities","NIST Privacy Framework PR.DS-P4 (Data Retention)","NIST SP 800-53 AP-2 (Purpose Specification)","CIS Control 3 — Data Protection","ISO\u002FIEC 27701 — Privacy Information Management",{}]