[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbzSEOI-mPzxb7VJAvY2Ha3dbK6GkTdOfoi2q9VRgKf8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"14f781ae-a4c9-4cd3-9bc6-d567acc8cc2b","italian-dpa-fines-controller-for-unlawful-processing-of-sensitive-patient-data-without-legal-basis","0de84e4e-08f1-4e9f-b48b-ccbbcff19e58","Italian DPA Fines Controller for Unlawful Processing of Sensitive Patient Data Without Legal Basis","A data controller was sanctioned by Italy's Garante after processing sensitive patient health data — including records spanning more than 10 years — without a valid legal basis under GDPR. The controller attempted to deflect responsibility by claiming a purely technical role as a 'technological partner,' but the DPA found that ownership of the database and direct involvement in anonymization and data handling clearly established controller status. This case underscores that legal responsibility follows actual data governance behavior, not self-assigned labels. Organizations cannot avoid GDPR obligations by relabeling their role; functional control over data processing determines accountability. The retention of historical sensitive data without justification further compounded the violation, highlighting the critical importance of defined retention schedules and lawful basis documentation.","**Immediate actions:**\n- Conduct a data audit to identify all sensitive personal data (especially health data) held, mapped to a documented and valid GDPR legal basis for each processing activity.\n- Review and purge any historical personal data that exceeds defined retention periods or lacks a demonstrable legal justification for continued storage.\n\n**Governance & Role Clarification:**\n- Formally document and review controller vs. processor classifications for all third-party relationships, ensuring they reflect actual data governance responsibilities rather than contractual preference.\n- Establish and maintain a Records of Processing Activities (RoPA) register that clearly identifies the legal basis, data categories, and retention periods for every processing activity.\n- Ensure Data Processing Agreements (DPAs) accurately reflect the operational reality of each party's role and are reviewed regularly.\n\n**Long-term improvements:**\n- Implement a data retention policy with automated enforcement mechanisms to systematically delete or anonymize data at the end of its lawful retention period.\n- Embed regular GDPR compliance reviews into organizational governance cycles, including legal basis assessments whenever processing activities change.\n- Train staff and leadership on the functional definition of 'data controller' to prevent misclassification of processing roles.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 4 (Definitions — Controller vs. Processor)","GDPR Article 5(1)(e) — Storage Limitation Principle","GDPR Article 6 — Lawfulness of Processing","GDPR Article 9 — Processing of Special Categories of Personal Data","GDPR Article 13\u002F14 — Transparency Obligations","GDPR Article 30 — Records of Processing Activities","NIST Privacy Framework PR.DS-P4 (Data Retention)","NIST SP 800-53 AP-2 (Purpose Specification)","CIS Control 3 — Data Protection","ISO\u002FIEC 27701 — Privacy Information Management",{},"published","2026-10-12T12:20:22.929958+00:00","2026-10-12T12:20:22.886+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_710\u002F2026&diff=53371&oldid=53370","garante-per-la-protezione-dei-dati-personali-italy-710-2026-3b33ab","Garante per la protezione dei dati personali (Italy) - 710\u002F2026",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]