Garante per la protezione dei dati personali (Italy) - 385/2026
Italian Red Cross fined €700 for unlawfully disclosing HIV status on meal tray.
Italy's Garante per la protezione dei dati personali has fined the Italian Red Cross €700 for unlawfully disclosing a patient's HIV status alongside their full name on a meal tray note. The DPA found violations of GDPR articles related to data minimization, security, and lawful processing of special category data, noting that national law's protective measures did not justify such a disclosure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Italian Red Cross?
Get an email when a new story names Italian Red Cross, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Italian Red Cross violated GDPR by disclosing a patient's HIV status alongside their full name on a physical meal tray label — a deeply sensitive piece of special category health data exposed in a wholly unnecessary and insecure manner. The root cause was a failure to apply data minimization principles and a lack of staff awareness regarding the legal obligations around processing sensitive medical information. This case demonstrates that data protection failures are not limited to digital systems; paper-based and operational processes carry equal legal and ethical weight. Even well-intentioned operational shortcuts — such as labeling trays with diagnostic information — can constitute serious GDPR violations when proper safeguards are absent.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.