[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn4AIbLSDdXAOXnmIUmIrgl1zjjzxIITmpYCujgKpGkA":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"160a295c-b252-4e5a-9e30-a36698c22cc1","Garante per la protezione dei dati personali (Italy) - 616\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-616-2026-91bc1f","← Older revision Revision as of 08:10, 16 September 2026 Line 113: Line 113: === Facts === === Facts === The DPA received a complaint from a data subject concerning the processing operations of the University Health Agency of Friuli Centrale’s (the controller) electronic health record system. The complaint related in particular to access by the controller, its staff and other healthcare professionals from other facilities to Covid-19 results and surgical department data. It also concerned the lack of access logs. The DPA received a complaint from an employee (the data subject) of the University Health Agency of Friuli Centrale (the controller) concerning the controller's processing of the electronic health record system. The complaint related in particular to access by the controller, its staff and other healthcare professionals from other facilities to Covid-19 results and surgical department data. It also concerned the lack of access logs. The DPA initiated an investigation. The controller highlighted the exceptional circumstances of Covid-19, and the difficulties of organisational management of healthcare facilities. The controller deemed the use of these verification methods justified as it was the only method to quickly ensure a negative test and allow the data subject access to a ward. The DPA initiated an investigation. The controller highlighted the exceptional circumstances of Covid-19, and the difficulties of organisational management of healthcare facilities. The controller deemed the use of these verification methods justified as it was the only method to quickly ensure a negative test and allow the data subject access to a ward. Line 121: Line 121: Moreover, the controller addressed the upcoming implementation of a system which detects anomalies, and that given the number of staff on duty, especially in emergency room areas, it is plausible to assume that the person who viewed the list of the data subject’s documents would have been able to gain access even if a shorter automatic lockout period was implemented. With this the controller addressed their systemic vulnerability to malicious conduct by employees. Moreover, the controller addressed the upcoming implementation of a system which detects anomalies, and that given the number of staff on duty, especially in emergency room areas, it is plausible to assume that the person who viewed the list of the data subject’s documents would have been able to gain access even if a shorter automatic lockout period was implemented. With this the controller addressed their systemic vulnerability to malicious conduct by employees. === Holding === === Holding === The DPA insisted on the principle of data minimisation, the risk of unauthorised access and the necessity of imposing restrictions to limit the access to electronic health records solely to those involved with the patients care, and not those in administrative positions. The DPA found a violation of the principle of data minimisation by the controller, as there were no restrictions limiting the access by employees to electronic health records solely to those involved with the patients care. The DPA found the measures implemented by the controller to ensure data protection by design and default were not adequate. Namely, as the automatic locking of the computers was not established with an appropriate inactivity period which took into account the nature, subject matter, context, processing purpose and risk to the rights and freedoms of data subjects. Moreover, the DPA found the controller's data protection by design and default inadequate, particularly the automatic locking mechanism. It held that the period of inactivity chosen did not take into account the nature, subject matter, context, processing purpose and risk to the rights and freedoms of data subjects. Similarly, the reference to the large number of staff on duty was found invalid by the DPA as the implementation of an automatic lockout based on the specific needs and nature of tasks would have constituted a technical measure which is suitable to ensure a level of security appropriate to the risk of unauthorised access. The systemic vulnerability should have in fact prompted the controller to adopt all technical and organisational measures to reduce the risk of unauthorised access. The DPA further emphasised that the systemic vulnerability should have in fact prompted the controller to adopt all technical and organisational measures to reduce the risk of unauthorised access and ensure a level of security appropriate to the posed risk. Finally, the DPA found that the controller never adopted a system for automatic detection of anomalies possibly constituting unlawful processing. The DPA found that the controller insufficiently relied on conducting checks after data subject's complain rather than implementing a system of random checks to electronic health record access which could have also been a mechanism to deter employees from gaining access to records that they should not have access too. Finally, the DPA found that the controller insufficiently relied on conducting checks after data subject's complain rather than implementing a system of random checks, as a mechanism deterring unauthorised access. In light of the foregoing, the DPA found the controller in violation of [[Article 5 GDPR|Articles 5(1)(a), (b), (c), and (f)]], [[Article 9 GDPR|Article 9]], [[Article 25 GDPR|Article 25]] and [[Article 32 GDPR]] and correspondingly imposed a fine of €24.000 on them. In light of the foregoing, the DPA found the controller in violation of [[Article 5 GDPR|Articles 5(1)(a), (b), (c), and (f)]], [[Article 9 GDPR|Article 9]], [[Article 25 GDPR|Article 25]] and [[Article 32 GDPR]] and correspondingly imposed a fine of €24.000 on them.","The Italian Data Protection Authority (Garante) has fined the University Health Agency of Friuli Centrale €24,000 for violations related to its electronic health record system. The agency failed to adequately restrict access to patient data, particularly Covid-19 results and surgical department information, to only those directly involved in patient care. Additionally, the DPA found that the system's automatic computer lockout mechanism had an inappropriate inactivity period, and the agency lacked a system for detecting anomalous processing activities.","Italian DPA fines healthcare agency €24,000 for data minimization and access control violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_616\u002F2026&diff=53086&oldid=53036","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-16T08:10:43+00:00","2026-09-16T10:00:21.147411+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"electronic health record system","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":44,"vendors":126},[45,74,97],{"slug":46,"name":47,"problem":48,"products":49},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":75,"name":76,"problem":77,"products":78},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[79,87,92],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":88,"product_name":89,"url":90,"description":91},"entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":93,"product_name":94,"url":95,"description":96},"workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":98,"name":99,"problem":100,"products":101},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":147},"italian-health-agency-fined-24k-for-weak-ehr-access-controls-and-missing-anomaly-detection","Italian Health Agency Fined €24K for Weak EHR Access Controls and Missing Anomaly Detection","The University Health Agency of Friuli Centrale failed to enforce the principle of least privilege within its electronic health record (EHR) system, allowing staff access to sensitive patient data — including Covid-19 results and surgical records — beyond what their care role required. Compounding this, the system's automatic screen lockout inactivity timeout was set to an inappropriately long interval, increasing the risk of unauthorized access to unattended sessions. Perhaps most critically, the agency had no mechanism in place to detect anomalous or unauthorized data processing activities, meaning breaches could go unnoticed indefinitely. In healthcare, where patient data is among the most sensitive personal information, these combined failures represent serious non-compliance with GDPR's data minimization and integrity principles and create real risk of harm to patients.",[132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],"GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 25 — Data protection by design and by default","GDPR Article 32 — Security of processing","GDPR Article 35 — Data Protection Impact Assessment","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 AC-11 (Session Lock)","NIST SP 800-53 AU-6 (Audit Record Review, Analysis, and Reporting)","NIST SP 800-53 SI-4 (System Monitoring)","CIS Control 5 — Account Management","CIS Control 6 — Access Control Management","CIS Control 8 — Audit Log Management","HIPAA 45 CFR §164.312(a)(2)(iii) — Automatic Logoff","ISO\u002FIEC 27001:2022 — A.5.15 Access Control, A.8.5 Secure Authentication",{}]