[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3c4oYf3iTgM-jSLTe3AYEkiPKOZQ1hl0ydX4m8AXUaA":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":79},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"04f03ad1-4da0-417f-a6d4-c5db551159c5","Garante per la protezione dei dati personali (Italy) - 385\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-385-2026-073707","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color=background-color:#095d7e; |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=385\u002F2026 |ECLI= |Original_Source_Name_1=GPDP |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10262455 |Original_Source_Language_1=Italian |Original_Source_Language__Code_1=...\" Show changes","Italy's Garante per la protezione dei dati personali has fined the Italian Red Cross €700 for unlawfully disclosing a patient's HIV status alongside their full name on a meal tray note. The DPA found violations of GDPR articles related to data minimization, security, and lawful processing of special category data, noting that national law's protective measures did not justify such a disclosure.","Italian Red Cross fined €700 for unlawfully disclosing HIV status on meal tray.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_385\u002F2026&diff=52073&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-07-07T09:51:50+00:00","2026-07-07T10:00:26.279234+00:00",7,[17,20],{"name":18,"type":19},"Italian Red Cross","vendor",{"name":21,"type":22},"GDPR","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,33,38,43],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":25,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":44},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":48,"vendors":78},[49],{"slug":50,"name":51,"problem":52,"products":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":80,"title":81,"body":82,"framework_refs":83,"framework_notes":94},"italian-red-cross-fined-for-exposing-hiv-status-on-meal-tray-note","Italian Red Cross Fined for Exposing HIV Status on Meal Tray Note","The Italian Red Cross violated GDPR by disclosing a patient's HIV status alongside their full name on a physical meal tray label — a deeply sensitive piece of special category health data exposed in a wholly unnecessary and insecure manner. The root cause was a failure to apply data minimization principles and a lack of staff awareness regarding the legal obligations around processing sensitive medical information. This case demonstrates that data protection failures are not limited to digital systems; paper-based and operational processes carry equal legal and ethical weight. Even well-intentioned operational shortcuts — such as labeling trays with diagnostic information — can constitute serious GDPR violations when proper safeguards are absent.",[84,85,86,87,88,89,90,91,92,93],"GDPR Article 9 — Processing of special categories of personal data","GDPR Article 5(1)(c) — Data minimisation principle","GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 25 — Data protection by design and by default","GDPR Article 32 — Security of processing","NIST SP 800-53 MP-3 (Media Marking)","NIST SP 800-53 AT-2 (Literacy Training and Awareness)","CIS Control 3 — Data Protection","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 Annex A 5.34 — Privacy and protection of personally identifiable information",{}]