Garante per la protezione dei dati personali (Italy) - 9542096: Difference between revisions

From GDPRhub
No edit summary
(One intermediate revision by one other user not shown)
Line 66: Line 66:
}}
}}


The Italian DPA (Garante per la protezione dei dati personali) imposed a fine of € 2000 on Poliambulatorio Talenti S.r.l., an outpatient clinic, for failing to respond to a data subject's access request within the time limits imposed by Article 12(3) GDPR.
The Italian DPA (Garante per la protezione dei dati personali) imposed a fine of €2,000 on Poliambulatorio Talenti S.r.l., an outpatient clinic, for failing to respond to a data subject's access request within the time limits imposed by Article 12(3) GDPR.


==English Summary==
==English Summary==
Line 78: Line 78:


In subsequent documentation sent to the Garante, Poliambulatorio Talenti argued that the delay in replying to the data subject was due to issues with the hardware system, and that the inaccuracy in the name entered in the system was caused by “a material mistake due to the decision to copy by hand the data of the minor's  mother”. During a hearing, the clinic also asked the Garante to close the case, or apply the lowest possible fine.
In subsequent documentation sent to the Garante, Poliambulatorio Talenti argued that the delay in replying to the data subject was due to issues with the hardware system, and that the inaccuracy in the name entered in the system was caused by “a material mistake due to the decision to copy by hand the data of the minor's  mother”. During a hearing, the clinic also asked the Garante to close the case, or apply the lowest possible fine.
===Dispute===
===Holding===
===Holding===
The Garante found that the defensive statements were not enough to overcome its initial findings and close the proceedings. On the other hand, since the access request was fulfilled 62 days after its submission, the DPA found a violation of Article 12(3) in relation to Article 15 GDPR. The Garante hence applied an administrative fine as per Article 83(5) GDPR. The amount of such fine was set at €2,000, taking into account the negligent nature of the delay, the fact that the polyclinic cooperated with the Supervisory Authority, and the lack of “previous relevant infringements”, or “previous provisions” as per Article 58 GDPR, ascribed to Poliambulatorio Talenti.
The Garante found that the defensive statements were not enough to overcome its initial findings and close the proceedings. On the other hand, since the access request was fulfilled 62 days after its submission, the DPA found a violation of Article 12(3) in relation to Article 15 GDPR. The Garante hence applied an administrative fine as per Article 83(5) GDPR. The amount of such fine was set at €2000, taking into account the negligent nature of the delay, the fact that the polyclinic cooperated with the Supervisory Authority, and the lack of “previous relevant infringements”, or “previous provisions” as per Article 58 GDPR, ascribed to Poliambulatorio Talenti.


==Comment==
==Comment==
Line 92: Line 88:


==English Machine Translation of the Decision==
==English Machine Translation of the Decision==
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more detail.
 
<pre>
<!DOCTYPE html><html class="ltr" dir="ltr" lang="it-IT"><head><title>Order injunction against Poliambulatorio Talenti Srl - 14 ... - Privacy Guarantor </title><meta http-equiv="X-UA-Compatible" content="IE=Edge; IE=11; chrome=1" /><meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport" /><!-- CSS OWLCAROUSEL --><link href="https://www.garanteprivacy.it/o/garante-privacy-theme/css/owlcarousel/owl.carousel.min.css" rel="stylesheet" type="text/css" /><link href="https://www.garanteprivacy.it/o/garante-privacy-theme/css/owlcarousel/owl.theme.css" rel="stylesheet" type="text/css" /><!--[if lt IE 9]>
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
    <![endif]--><link href="https://www.garanteprivacy.it/o/garante-privacy-theme/css/interna.css" rel="stylesheet" type="text/css" /><link href="https://www.garanteprivacy.it/o/garante-privacy-theme/css/tree.css" rel="stylesheet" type="text/css"/><link href="https://www.garanteprivacy.it/o/garante-privacy-theme/css/print.css" rel="stylesheet" type="text/css" media="print" /><link rel="apple-touch-icon" href="https://www.garanteprivacy.it/o/garante-privacy-theme/images/icons/iphone.png" /><script src="https://www.garanteprivacy.it/o/garante-privacy-theme/js/util-functions.js" type="text/javascript"></script><script src="https://www.garanteprivacy.it/o/garante-privacy-theme/js/clear-default-text.js" type="text/javascript"></script><script src="https://www.garanteprivacy.it/o/garante-privacy-theme/js/print.js" type="text/javascript"></script><script type="text/javascript">
function mailto(indirizzo) {
re = /\*/gi;
indirizzo=indirizzo.replace(re, "@");
    self.document.location.href = 'mailto:' + indirizzo
}
</script><script src="//f1-eu.readspeaker.com/script/7205/ReadSpeaker.js?pids=embhl" type="text/javascript"></script><!-- META TAG OG --><meta content="text/html; charset=UTF-8" http-equiv="content-type" /><link charset="utf-8" data-senna-track="permanent" href="/o/frontend-theme-font-awesome-web/css/main.css" rel="stylesheet"></script><script data-senna-track="permanent" src="/combo?browserId=other&minifierType=js&languageId=it_IT&b=7201&t=1615713167032&/o/frontend-js-jquery-web/jquery/jquery.min.js&/o/frontend-js-jquery-web/jquery/bootstrap.bundle.min.js&/o/frontend-js-jquery-web/jquery/collapsible_search.js&/o/frontend-js-jquery-web/jquery/fm.js&/o/frontend-js-jquery-web/jquery/form.js&/o/frontend-js-jquery-web/jquery/popper.min.js&/o/frontend-js-jquery-web/jquery/side_navigation.js" type="text/javascript"></script><link href="https://www.garanteprivacy.it/o/garante-privacy-theme/images/favicon.ico" rel="icon" /><link data-senna-track="temporary" href="https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9542096" rel="canonical" /><link data-senna-track="temporary" href="https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9542096" hreflang="it-IT" rel="alternate" /><link data-senna-track="temporary" href="https://www.garanteprivacy.it/en/home/docweb/-/docweb-display/docweb/9542096" hreflang="en-US" rel="alternate" /><link data-senna-track="temporary" href="https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9542096" hreflang="x-default" rel="alternate" /><link class="lfr-css-file" data-senna-track="temporary" href="https://www.garanteprivacy.it/o/garante-privacy-theme/css/clay.css?browserId=other&amp;themeId=garanteprivacy_WAR_garanteprivacytheme&amp;minifierType=css&amp;languageId=it_IT&amp;b=7201&amp;t=1615017666000" id="liferayAUICSS" rel="stylesheet" type="text/css" /><link data-senna-track="temporary" href="/o/frontend-css-web/main.css?browserId=other&amp;themeId=garanteprivacy_WAR_garanteprivacytheme&amp;minifierType=css&amp;languageId=it_IT&amp;b=7201&amp;t=1615021167916" id="liferayPortalCSS" rel="stylesheet" type="text/css" /><link data-senna-track="temporary" href="/combo?browserId=other&amp;minifierType=&amp;themeId=garanteprivacy_WAR_garanteprivacytheme&amp;languageId=it_IT&amp;b=7201&amp;GSolrFormWeb:%2Fcss%2Fmain.css&amp;GSolrFormWeb:%2Fcss%2Fjquery-ui.css&amp;GSolrFormWeb:%2Fjs%2Fthemes%2Fdefault%2Fstyle.css&amp;com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT:%2Fcss%2Fmain.css&amp;com_liferay_portal_search_web_search_bar_portlet_SearchBarPortlet_INSTANCE_templateSearch:%2Fsearch%2Fbar%2Fcss%2Fmain.css&amp;com_liferay_product_navigation_product_menu_web_portlet_ProductMenuPortlet:%2Fcss%2Fmain.css&amp;com_liferay_product_navigation_user_personal_bar_web_portlet_ProductNavigationUserPersonalBarPortlet:%2Fcss%2Fmain.css&amp;t=1615017666000" id="b3819b05" rel="stylesheet" type="text/css" /><script data-senna-track="temporary" type="text/javascript">
// <![CDATA[
var Liferay = Liferay || {};
 
Liferay.Browser = {
acceptsGzip: function() {
return true;
},
 
 
getMajorVersion: function() {
return 0;
},
 
getRevision: function() {
return '';
},
getVersion: function() {
return '';
},
 
 
isAir: function() {
return false;
},
isChrome: function() {
return false;
},
isEdge: function() {
return false;
},
isFirefox: function() {
return false;
},
isGecko: function() {
return false;
},
isIe: function() {
return false;
},
isIphone: function() {
return false;
},
isLinux: function() {
return false;
},
isMac: function() {
return false;
},
isMobile: function() {
return false;
},
isMozilla: function() {
return false;
},
isOpera: function() {
return false;
},
isRtf: function() {
return false;
},
isSafari: function() {
return false;
},
isSun: function() {
return false;
},
isWebKit: function() {
return false;
},
isWindows: function() {
return false;
}
};
 
Liferay.Data = Liferay.Data || {};
 
Liferay.Data.ICONS_INLINE_SVG = true;
 
Liferay.Data.NAV_SELECTOR = '#navigation';
 
Liferay.Data.NAV_SELECTOR_MOBILE = '#navigationCollapse';
 
Liferay.Data.isCustomizationView = function() {
return false;
};
 
Liferay.Data.notices = [
null
 
 
];
 
Liferay.PortletKeys = {
DOCUMENT_LIBRARY: 'com_liferay_document_library_web_portlet_DLPortlet',
DYNAMIC_DATA_MAPPING: 'com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet',
ITEM_SELECTOR: 'com_liferay_item_selector_web_portlet_ItemSelectorPortlet'
};
 
Liferay.PropsValues = {
JAVASCRIPT_SINGLE_PAGE_APPLICATION_TIMEOUT: 0,
NTLM_AUTH_ENABLED: false,
UPLOAD_SERVLET_REQUEST_IMPL_MAX_SIZE: 104857600
};
 
Liferay.ThemeDisplay = {
 
 
getLayoutId: function() {
return '9';
},
 
 
getLayoutRelativeControlPanelURL: function() {
return '/group/guest/~/control_panel/manage?p_p_id=GDocwebDisplay';
},
 
getLayoutRelativeURL: function() {
return '/home/docweb';
},
getLayoutURL: function() {
return 'https://www.garanteprivacy.it/home/docweb';
},
getParentLayoutId: function() {
return '45';
},
isControlPanel: function() {
return false;
},
isPrivateLayout: function() {
return 'false';
},
isVirtualLayout: function() {
return false;
},
 
getBCP47LanguageId: function() {
return 'it-IT';
},
getCanonicalURL: function() {
 
 
return 'https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9542096';
},
getCDNBaseURL: function() {
return 'https://www.garanteprivacy.it';
},
getCDNDynamicResourcesHost: function() {
return '';
},
getCDNHost: function() {
return '';
},
getCompanyGroupId: function() {
return '10168';
},
getCompanyId: function() {
return '10135';
},
getDefaultLanguageId: function() {
return 'it_IT';
},
getDoAsUserIdEncoded: function() {
return '';
},
getLanguageId: function() {
return 'it_IT';
},
getParentGroupId: function() {
return '10160';
},
getPathContext: function() {
return '';
},
getPathImage: function() {
return '/image';
},
getPathJavaScript: function() {
return '/o/frontend-js-web';
},
getPathMain: function() {
return '/c';
},
getPathThemeImages: function() {
return 'https://www.garanteprivacy.it/o/garante-privacy-theme/images';
},
getPathThemeRoot: function() {
return '/o/garante-privacy-theme';
},
getPlid: function() {
return '10563';
},
getPortalURL: function() {
return 'https://www.garanteprivacy.it';
},
getScopeGroupId: function() {
return '10160';
},
getScopeGroupIdOrLiveGroupId: function() {
return '10160';
},
getSessionId: function() {
return '';
},
getSiteAdminURL: function() {
return 'https://www.garanteprivacy.it/group/guest/~/control_panel/manage?p_p_lifecycle=0&p_p_state=maximized&p_p_mode=view';
},
getSiteGroupId: function() {
return '10160';
},
getURLControlPanel: function() {
return '/group/control_panel?refererPlid=10563';
},
getURLHome: function() {
return 'https\x3a\x2f\x2fwww\x2egaranteprivacy\x2eit\x2fweb\x2fguest';
},
getUserEmailAddress: function() {
return '';
},
getUserId: function() {
return '10138';
},
getUserName: function() {
return '';
},
isAddSessionIdToURL: function() {
return false;
},
isImpersonated: function() {
return false;
},
isSignedIn: function() {
return false;
},
isStateExclusive: function() {
return false;
},
isStateMaximized: function() {
return false;
},
isStatePopUp: function() {
return false;
}
};
 
var themeDisplay = Liferay.ThemeDisplay;
 
Liferay.AUI = {
 
 
getAvailableLangPath: function() {
return 'available_languages.jsp?browserId=other&themeId=garanteprivacy_WAR_garanteprivacytheme&colorSchemeId=01&minifierType=js&languageId=it_IT&b=7201&t=1615713158165';
},
getCombine: function() {
return true;
},
getComboPath: function() {
return '/combo/?browserId=other&minifierType=&languageId=it_IT&b=7201&t=1615021169578&';
},
getDateFormat: function() {
return '%d/%m/%Y';
},
getEditorCKEditorPath: function() {
return '/o/frontend-editor-ckeditor-web';
},
getFilter: function() {
var filter = 'raw';
 
filter = 'min';
 
return filter;
},
getFilterConfig: function() {
var instance = this;
 
var filterConfig = null;
 
if (!instance.getCombine()) {
filterConfig = {
replaceStr: '.js' + instance.getStaticResourceURLParams(),
searchExp: '\\.js$'
};
}
 
return filterConfig;
},
getJavaScriptRootPath: function() {
return '/o/frontend-js-web';
},
getLangPath: function() {
return 'aui_lang.jsp?browserId=other&themeId=garanteprivacy_WAR_garanteprivacytheme&colorSchemeId=01&minifierType=js&languageId=it_IT&b=7201&t=1615021169578';
},
getPortletRootPath: function() {
return '/html/portlet';
},
getStaticResourceURLParams: function() {
return '?browserId=other&minifierType=&languageId=it_IT&b=7201&t=1615021169578';
}
};
 
Liferay.authToken = 'RqAZlBbt';
 
 
Liferay.currentURL = '\x2fweb\x2fguest\x2fhome\x2fdocweb\x2f-\x2fdocweb-display\x2fdocweb\x2f9542096';
Liferay.currentURLEncoded = '\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096';
// ]]>
</script><script src="/o/js_loader_config?t=1615713167027" type="text/javascript"></script><script data-senna-track="permanent" src="/combo?browserId=other&minifierType=js&languageId=it_IT&b=7201&t=1615021169578&/o/frontend-js-web/loader/config.js&/o/frontend-js-web/loader/loader.js&/o/frontend-js-web/aui/aui/aui.js&/o/frontend-js-web/aui/aui-base-html5-shiv/aui-base-html5-shiv.js&/o/frontend-js-web/liferay/browser_selectors.js&/o/frontend-js-web/liferay/modules.js&/o/frontend-js-web/liferay/aui_sandbox.js&/o/frontend-js-web/misc/svg4everybody.js&/o/frontend-js-web/aui/arraylist-add/arraylist-add.js&/o/frontend-js-web/aui/arraylist-filter/arraylist-filter.js&/o/frontend-js-web/aui/arraylist/arraylist.js&/o/frontend-js-web/aui/array-extras/array-extras.js&/o/frontend-js-web/aui/array-invoke/array-invoke.js&/o/frontend-js-web/aui/attribute-base/attribute-base.js&/o/frontend-js-web/aui/attribute-complex/attribute-complex.js&/o/frontend-js-web/aui/attribute-core/attribute-core.js&/o/frontend-js-web/aui/attribute-observable/attribute-observable.js&/o/frontend-js-web/aui/attribute-extras/attribute-extras.js&/o/frontend-js-web/aui/base-base/base-base.js&/o/frontend-js-web/aui/base-pluginhost/base-pluginhost.js&/o/frontend-js-web/aui/classnamemanager/classnamemanager.js&/o/frontend-js-web/aui/datatype-xml-format/datatype-xml-format.js&/o/frontend-js-web/aui/datatype-xml-parse/datatype-xml-parse.js&/o/frontend-js-web/aui/dom-base/dom-base.js&/o/frontend-js-web/aui/dom-core/dom-core.js&/o/frontend-js-web/aui/dom-screen/dom-screen.js&/o/frontend-js-web/aui/dom-style/dom-style.js&/o/frontend-js-web/aui/event-base/event-base.js&/o/frontend-js-web/aui/event-custom-base/event-custom-base.js&/o/frontend-js-web/aui/event-custom-complex/event-custom-complex.js&/o/frontend-js-web/aui/event-delegate/event-delegate.js&/o/frontend-js-web/aui/event-focus/event-focus.js&/o/frontend-js-web/aui/event-hover/event-hover.js&/o/frontend-js-web/aui/event-key/event-key.js&/o/frontend-js-web/aui/event-mouseenter/event-mouseenter.js&/o/frontend-js-web/aui/event-mousewheel/event-mousewheel.js" type="text/javascript"></script><script data-senna-track="permanent" src="/combo?browserId=other&minifierType=js&languageId=it_IT&b=7201&t=1615021169578&/o/frontend-js-web/aui/event-outside/event-outside.js&/o/frontend-js-web/aui/event-resize/event-resize.js&/o/frontend-js-web/aui/event-simulate/event-simulate.js&/o/frontend-js-web/aui/event-synthetic/event-synthetic.js&/o/frontend-js-web/aui/intl/intl.js&/o/frontend-js-web/aui/io-base/io-base.js&/o/frontend-js-web/aui/io-form/io-form.js&/o/frontend-js-web/aui/io-queue/io-queue.js&/o/frontend-js-web/aui/io-upload-iframe/io-upload-iframe.js&/o/frontend-js-web/aui/io-xdr/io-xdr.js&/o/frontend-js-web/aui/json-parse/json-parse.js&/o/frontend-js-web/aui/json-stringify/json-stringify.js&/o/frontend-js-web/aui/node-base/node-base.js&/o/frontend-js-web/aui/node-core/node-core.js&/o/frontend-js-web/aui/node-event-delegate/node-event-delegate.js&/o/frontend-js-web/aui/node-event-simulate/node-event-simulate.js&/o/frontend-js-web/aui/node-focusmanager/node-focusmanager.js&/o/frontend-js-web/aui/node-pluginhost/node-pluginhost.js&/o/frontend-js-web/aui/node-screen/node-screen.js&/o/frontend-js-web/aui/node-style/node-style.js&/o/frontend-js-web/aui/oop/oop.js&/o/frontend-js-web/aui/plugin/plugin.js&/o/frontend-js-web/aui/pluginhost-base/pluginhost-base.js&/o/frontend-js-web/aui/pluginhost-config/pluginhost-config.js&/o/frontend-js-web/aui/querystring-stringify-simple/querystring-stringify-simple.js&/o/frontend-js-web/aui/queue-promote/queue-promote.js&/o/frontend-js-web/aui/selector-css2/selector-css2.js&/o/frontend-js-web/aui/selector-css3/selector-css3.js&/o/frontend-js-web/aui/selector-native/selector-native.js&/o/frontend-js-web/aui/selector/selector.js&/o/frontend-js-web/aui/widget-base/widget-base.js&/o/frontend-js-web/aui/widget-htmlparser/widget-htmlparser.js&/o/frontend-js-web/aui/widget-skin/widget-skin.js&/o/frontend-js-web/aui/widget-uievents/widget-uievents.js&/o/frontend-js-web/aui/yui-throttle/yui-throttle.js&/o/frontend-js-web/aui/aui-base-core/aui-base-core.js" type="text/javascript"></script><script data-senna-track="permanent" src="/combo?browserId=other&minifierType=js&languageId=it_IT&b=7201&t=1615021169578&/o/frontend-js-web/aui/aui-base-lang/aui-base-lang.js&/o/frontend-js-web/aui/aui-classnamemanager/aui-classnamemanager.js&/o/frontend-js-web/aui/aui-component/aui-component.js&/o/frontend-js-web/aui/aui-debounce/aui-debounce.js&/o/frontend-js-web/aui/aui-delayed-task-deprecated/aui-delayed-task-deprecated.js&/o/frontend-js-web/aui/aui-event-base/aui-event-base.js&/o/frontend-js-web/aui/aui-event-input/aui-event-input.js&/o/frontend-js-web/aui/aui-form-validator/aui-form-validator.js&/o/frontend-js-web/aui/aui-node-base/aui-node-base.js&/o/frontend-js-web/aui/aui-node-html5/aui-node-html5.js&/o/frontend-js-web/aui/aui-selector/aui-selector.js&/o/frontend-js-web/aui/aui-timer/aui-timer.js&/o/frontend-js-web/liferay/dependency.js&/o/frontend-js-web/liferay/dom_task_runner.js&/o/frontend-js-web/liferay/events.js&/o/frontend-js-web/liferay/language.js&/o/frontend-js-web/liferay/lazy_load.js&/o/frontend-js-web/liferay/liferay.js&/o/frontend-js-web/liferay/util.js&/o/frontend-js-web/liferay/global.bundle.js&/o/frontend-js-web/liferay/portal.js&/o/frontend-js-web/liferay/portlet.js&/o/frontend-js-web/liferay/workflow.js&/o/frontend-js-web/liferay/form.js&/o/frontend-js-web/liferay/form_placeholders.js&/o/frontend-js-web/liferay/icon.js&/o/frontend-js-web/liferay/menu.js&/o/frontend-js-web/liferay/notice.js&/o/frontend-js-web/liferay/poller.js&/o/frontend-js-web/aui/async-queue/async-queue.js&/o/frontend-js-web/aui/base-build/base-build.js&/o/frontend-js-web/aui/cookie/cookie.js&/o/frontend-js-web/aui/event-touch/event-touch.js&/o/frontend-js-web/aui/overlay/overlay.js&/o/frontend-js-web/aui/querystring-stringify/querystring-stringify.js&/o/frontend-js-web/aui/widget-child/widget-child.js&/o/frontend-js-web/aui/widget-position-align/widget-position-align.js&/o/frontend-js-web/aui/widget-position-constrain/widget-position-constrain.js&/o/frontend-js-web/aui/widget-position/widget-position.js" type="text/javascript"></script><script data-senna-track="permanent" src="/combo?browserId=other&minifierType=js&languageId=it_IT&b=7201&t=1615021169578&/o/frontend-js-web/aui/widget-stack/widget-stack.js&/o/frontend-js-web/aui/widget-stdmod/widget-stdmod.js&/o/frontend-js-web/aui/aui-aria/aui-aria.js&/o/frontend-js-web/aui/aui-io-plugin-deprecated/aui-io-plugin-deprecated.js&/o/frontend-js-web/aui/aui-io-request/aui-io-request.js&/o/frontend-js-web/aui/aui-loading-mask-deprecated/aui-loading-mask-deprecated.js&/o/frontend-js-web/aui/aui-overlay-base-deprecated/aui-overlay-base-deprecated.js&/o/frontend-js-web/aui/aui-overlay-context-deprecated/aui-overlay-context-deprecated.js&/o/frontend-js-web/aui/aui-overlay-manager-deprecated/aui-overlay-manager-deprecated.js&/o/frontend-js-web/aui/aui-overlay-mask-deprecated/aui-overlay-mask-deprecated.js&/o/frontend-js-web/aui/aui-parse-content/aui-parse-content.js&/o/frontend-js-web/liferay/layout_exporter.js&/o/frontend-js-web/liferay/session.js&/o/frontend-js-web/liferay/deprecated.js" type="text/javascript"></script><script data-senna-track="temporary" src="/o/js_bundle_config?t=1615713183105" type="text/javascript"></script><script data-senna-track="temporary" type="text/javascript">
// <![CDATA[
 
 
// ]]>
</script><script data-senna-track="temporary" src="/combo?browserId=other&amp;minifierType=&amp;themeId=garanteprivacy_WAR_garanteprivacytheme&amp;languageId=it_IT&amp;b=7201&amp;GSolrFormWeb:%2Fjs%2Fjquery-ui.js&amp;t=1615017666000" type="text/javascript"></script><meta property='og:title' content="Order injunction against Poliambulatorio Talenti S.r.l. - January 14, 2021 [9542096]"/><meta property='og:image' content='https://www.garanteprivacy.it/o/g.docweb.display/images/bn.jpg'/><meta property='og:url' content='https://www.garanteprivacy.it:443/home/docweb/-/docweb-display/docweb/9542096' /><link class="lfr-css-file" data-senna-track="temporary" href="https://www.garanteprivacy.it/o/garante-privacy-theme/css/main.css?browserId=other&amp;themeId=garanteprivacy_WAR_garanteprivacytheme&amp;minifierType=css&amp;languageId=it_IT&amp;b=7201&amp;t=1615017666000" id="liferayThemeCSS" rel="stylesheet" type="text/css" /><style data-senna-track="temporary" type="text/css">
#interna-main-dx .testo p a {​​​​
font-weight: bold;
color: #2173bc;
}​​​​
.portlet-asset-publisher ul.internal-title-list a, a:hover {​​​​
color: #2173bc;
}​​​​
 
#elenco-main div.notizia div.notizia-testo h2 a, a:hover {​​​​
color: #2173bc;
}​​​​
.azione span span{
margin-left: 14px ! important;
    margin-top: 2px ! important;
    color: #2173bc ! important;
}
 
.helper-hidden-accessible{
color: #2173bc ! important;
}
.azione span{
    color: #2173bc !important;
}
 
#interna-menu ul li ul.nested-menu li div.selected {
    background: #e8eae9;
    border-left: 4px solid #214b5f;
    margin: 0 -4px;
    padding: 5px;
}
 
.journal-content-article .testo p a {
    font-weight: bold;
    color: #2173bc;
}
</style><style data-senna-track="temporary" type="text/css">
 
 
 
 
 
#p_p_id_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT_ .portlet-content {
 
}
 
 
 
 
 
 
 
 
 
 
#p_p_id_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx_ .portlet-content {
 
}
 
 
 
 
 
 
 
 
 
 
 
 
#p_p_id_GDocwebDisplay_ .portlet-content {
 
}
#portlet_GDocwebDisplay td {
padding-right: 15px;
}
blockquote {
font-size: inherit;
    border-left: inherit;
}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
</style><script type="text/javascript">
// <![CDATA[
Liferay.Loader.require('frontend-js-spa-web@3.0.22/liferay/init.es', function(frontendJsSpaWeb3022LiferayInitEs) {
(function(){
var frontendJsSpaWebLiferayInitEs = frontendJsSpaWeb3022LiferayInitEs;
(function() {var $ = AUI.$;var _ = AUI._;
 
Liferay.SPA = Liferay.SPA || {};
Liferay.SPA.cacheExpirationTime = -1;
Liferay.SPA.clearScreensCache = false;
Liferay.SPA.debugEnabled = false;
Liferay.SPA.excludedPaths = ["/documents","/image"];
Liferay.SPA.loginRedirect = '';
Liferay.SPA.navigationExceptionSelectors = ':not([target="_blank"]):not([data-senna-off]):not([data-resource-href]):not([data-cke-saved-href]):not([data-cke-saved-href])';
Liferay.SPA.requestTimeout = 0;
Liferay.SPA.userNotification = {
message: 'Sembra che la richiesta stia impiegando più del previsto.',
timeout: 30000,
title: 'Oops'
};
 
frontendJsSpaWebLiferayInitEs.default.init(
function(app) {
app.setPortletsBlacklist({"com_liferay_nested_portlets_web_portlet_NestedPortletsPortlet":true,"com_liferay_site_navigation_directory_web_portlet_SitesDirectoryPortlet":true,"com_liferay_login_web_portlet_LoginPortlet":true,"com_liferay_login_web_portlet_FastLoginPortlet":true});
app.setValidStatusCodes([221,490,494,499,491,492,493,495,220]);
}
);})();})();
});
// ]]>
</script><script data-senna-track="temporary" type="text/javascript">
if (window.Analytics) {
window._com_liferay_document_library_analytics_isViewFileEntry = false;
}
</script><script type="text/javascript">
// <![CDATA[
Liferay.on(
'ddmFieldBlur', function(event) {
if (window.Analytics) {
Analytics.send(
'fieldBlurred',
'Form',
{
fieldName: event.fieldName,
focusDuration: event.focusDuration,
formId: event.formId,
page: event.page - 1
}
);
}
}
);
 
Liferay.on(
'ddmFieldFocus', function(event) {
if (window.Analytics) {
Analytics.send(
'fieldFocused',
'Form',
{
fieldName: event.fieldName,
formId: event.formId,
page: event.page - 1
}
);
}
}
);
 
Liferay.on(
'ddmFormPageShow', function(event) {
if (window.Analytics) {
Analytics.send(
'pageViewed',
'Form',
{
formId: event.formId,
page: event.page,
title: event.title
}
);
}
}
);
 
Liferay.on(
'ddmFormSubmit', function(event) {
if (window.Analytics) {
Analytics.send(
'formSubmitted',
'Form',
{
formId: event.formId
}
);
}
}
);
 
Liferay.on(
'ddmFormView', function(event) {
if (window.Analytics) {
Analytics.send(
'formViewed',
'Form',
{
formId: event.formId,
title: event.title
}
);
}
}
);
// ]]>
</script></head><body class=" controls-visible  yui3-skin-sam guest-site signed-out public-page site"><nav class="quick-access-nav" id="xemb_quickAccessNav"><h1 class="hide-accessible"> Navigation</h1><ul><li> <a href="#main-content">Skip to content</a> </li></ul></nav><div id="wrapper" class="container"><header id="banner"><div id="heading"><h1 class="company-title"><a class="logo custom-logo" href="https://www.garanteprivacy.it" title="Privacy Guarantor"><img alt="Guarantor for the protection of personal data" src="/image/company_logo?img_id=9504180&amp;t=1615803685393" /></a> </h1></div><nav class="sort-pages modify-pages" id="navigation" role="navigation"><div class="pull-left"><ul class="nav" aria-label="Pagine Sito" role="menubar"><li aria-selected='true' class="selected" id="layout_36" role="presentation"> <a aria-labelledby="layout_36" aria-haspopup='true' accesskey="H" title="H." href="https://www.garanteprivacy.it/home"  role="menuitem"><span>Home</span></a></li><li  class="lfr-nav-item" id="layout_2" role="presentation"> <a aria-labelledby="layout_2"  accesskey="A" title="TO" href="https://www.garanteprivacy.it/home/autorita"  role="menuitem"><span>The authority</span></a></li><li  class="lfr-nav-item" id="layout_4" role="presentation"> <a aria-labelledby="layout_4"  accesskey="P" title="P." href="https://www.garanteprivacy.it/home/provvedimenti-normativa"  role="menuitem"><span>Measures and legislation</span></a></li><li  class="lfr-nav-item" id="layout_3" role="presentation"> <a aria-labelledby="layout_3"  accesskey="A" title="TO" href="https://www.garanteprivacy.it/home/attivita-e-documenti"  role="menuitem"><span>Activities and documents</span></a></li><li  class="lfr-nav-item" id="layout_5" role="presentation"> <a aria-labelledby="layout_5"  accesskey="S" title="S." href="https://www.garanteprivacy.it/home/stampa-comunicazione"  role="menuitem"><span>Press and communication</span></a></li><li  class="lfr-nav-item" id="layout_22" role="presentation"> <a aria-labelledby="layout_22"  accesskey="A" title="TO" href="https://www.garanteprivacy.it/home/attivita-internazionali"  role="menuitem"><span>International activities</span></a></li></ul></div><div class="pull-right"> <span class="language-select">Choose your language: <span class="selected">IT</span> <a href="https://www.garanteprivacy.it/c/portal/update_language?p_l_id=2011129&redirect=%2Fhome_en&languageId=en_US" accesskey="E">EN</a></span> </div></nav></header><section id="content"><div class="g-100100-layouttpl" id="main-content" role="main"><div class="portlet-layout row"><div class="col-md-6 portlet-column portlet-column-first" id="column-1"><div class="portlet-dropzone portlet-column-content portlet-column-content-first" id="layout-column_column-1"><div class="portlet-boundary portlet-boundary_com_liferay_journal_content_web_portlet_JournalContentPortlet_  portlet-static portlet-static-end portlet-borderless portlet-journal-content " id="p_p_id_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT_"><span id="p_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT"></span><section class="portlet" id="portlet_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT"><div class="portlet-content"><div class="autofit-float autofit-row portlet-header"><div class="autofit-col autofit-col-expand"><h2 class="portlet-title-text"> Internal rights </h2></div><div class="autofit-col autofit-col-end"><div class="autofit-section"><div class="visible-interaction"></div></div></div></div><div class=" portlet-content-container"><div class="portlet-body"><div class="" data-fragments-editor-item-id="10084-145463" data-fragments-editor-item-type="fragments-editor-mapped-item" ><div class="journal-content-article " data-analytics-asset-id="145461" data-analytics-asset-title="Diritti interna" data-analytics-asset-type="web-content"><div id="diritti-header"> <a href="/home/diritti"><img alt="Rights - How to protect your data" src="/documents/10160/0/Box_diritti_text+%282%29.jpg/5fa07198-2b09-7cc0-3051-1253b90feee0?t=1527846685513" /></a> </div></div></div></div></div></div></section></div></div></div><div class="col-md-6 portlet-column portlet-column-last" id="column-2"><div class="portlet-dropzone portlet-column-content portlet-column-content-last" id="layout-column_column-2"><div class="portlet-boundary portlet-boundary_com_liferay_journal_content_web_portlet_JournalContentPortlet_  portlet-static portlet-static-end portlet-borderless portlet-journal-content " id="p_p_id_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx_"><span id="p_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx"></span><section class="portlet" id="portlet_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx"><div class="portlet-content"><div class="autofit-float autofit-row portlet-header"><div class="autofit-col autofit-col-expand"><h2 class="portlet-title-text"> Internal duties </h2></div><div class="autofit-col autofit-col-end"><div class="autofit-section"><div class="visible-interaction"></div></div></div></div><div class=" portlet-content-container"><div class="portlet-body"><div class="" data-fragments-editor-item-id="10084-145477" data-fragments-editor-item-type="fragments-editor-mapped-item" ><div class="journal-content-article " data-analytics-asset-id="145475" data-analytics-asset-title="Doveri interna" data-analytics-asset-type="web-content"><div id="doveri-header"> <a href="/home/doveri"><img alt="Duties - How to treat data correctly" src="/documents/10160/0/Box_doveri_text+%282%29.jpg/1d455dd5-a62c-371c-a997-bb8099baf11c?t=1527846710765" /></a> </div></div></div></div></div></div></section></div></div></div></div><div class="portlet-layout row"><div class="col-md-12 portlet-column portlet-column-only" id="column-3"><div class="portlet-dropzone portlet-column-content portlet-column-content-only" id="layout-column_column-3"><div class="portlet-boundary portlet-boundary_GSolrFormWeb_  portlet-static portlet-static-end portlet-barebone  " id="p_p_id_GSolrFormWeb_"><span id="p_GSolrFormWeb"></span><section class="portlet" id="portlet_GSolrFormWeb"><div class="portlet-content"><div class="autofit-float autofit-row portlet-header"><div class="autofit-col autofit-col-expand"><h2 class="portlet-title-text"> Search Form Portlet </h2></div><div class="autofit-col autofit-col-end"><div class="autofit-section"></div></div></div><div class=" portlet-content-container"><div class="portlet-body"><script type="text/javascript">
Liferay.on('allPortletsReady', function() {
//if (typeof jQuery != 'undefined') { 
    // jQuery is loaded => print the version
    //console.log("jQuery version is "+jQuery.fn.jquery);
//}
//console.log("allPortletReady ok");
var firstTime = 0;
//console.log("first time" + firstTime);
jQuery('#search').click(
function(){
if (firstTime == 0){
jQuery('#search').val('');
firstTime++;
}
}
);
jQuery('#search').keypress(
function(){
if (firstTime == 0){
jQuery('#search').val('');
firstTime++;
}
}
);
var advFormString = '<form action="/home/ricerca/-/search/key/0" id="advsearchform" name="searchForm" method="post" ><label for="search">Contiene queste parole:</label><input id="advkeyword" name="advkeyword" type="text" value=""  /><label for="not">Non contiene questa parola o frase:</label><input id="not" name="not" type="text" value=""  /><label for="esatta">Contiene questa parola o frase:</label><input id="esatta" name="esatta" type="text" value=""  /><label for="or1">Contiene una o piu di queste parole:</label><input id="or1" name="or1" type="text" value=""  /><label for="or2">Or</label><input id="or2" name="or2" type="text" value=""  /><label for="or3">Or</label><input id="or3" name="or3" type="text" value=""  /><input name="cmd" type="hidden" value="search" /></form>';
var searchLabel = 'cerca';
jQuery("#advancedsearch").html(advFormString);
var dialog = jQuery("#advancedsearch").dialog({ autoOpen: false, height:350, width:420,
      modal: true,
      buttons: [{
          text: searchLabel,
          "id": "btnOk",
          click: function () {
        goAdvSearch();
          },


      }]
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
});
jQuery("#ricercaavanzata").click(function(event) {
event.preventDefault();
jQuery("#advancedsearch").dialog('open');
});
jQuery("#searchButton").click(function( event ) {
event.preventDefault();
goSearch();
});
jQuery("input").keypress(function(event) {
if (event.keyCode === 13) {
event.preventDefault();
goSearch();
}
});
var goAdvSearch = function() {
var actionUrl = "/home/ricerca/-/search/key/" + jQuery("#advkeyword").val().replace(".","")
+ "_not_" + jQuery("#not").val().replace(".","")
+ "_esatta_" + jQuery("#esatta").val().replace(".","")
+ "_or1_" + jQuery("#or1").val().replace(".","")
+ "_or2_" + jQuery("#or2").val().replace(".","")
+ "_or3_" + jQuery("#or3").val().replace(".","")
;
jQuery('#advsearchform').attr('action', actionUrl).submit();
dialog.dialog('close');
}
var goSearch = function() {
var searchKey = jQuery("#search").val();
if (!searchKey.trim()) searchKey = "0";
searchKey = encodeURI(searchKey).replace(".","");
//alert(searchKey);
var actionUrl = "/home/ricerca/-/search/key/" + searchKey;
if (jQuery("#radio-2").prop("checked")) {
console.log ("checked");
actionUrl = "/home/ricerca/-/search/docweb/" + searchKey;
}
jQuery('#searchform').attr('action', actionUrl).submit();
};
});
</script><form action="/home/ricerca/-/search/key/0" id="searchform" name="searchForm" method="post"><fieldset><!--  <legend><input type="submit" value="RICERCA" /></legend> --><input name="keyword" id="search" type="text" placeholder="inserisci chiave di ricerca" /><input id="searchButton" type="submit" value="search for" /><input id="radio-1" name="testoodoc" type="radio" value="testo" checked="checked"/> <label for="radio-1">text</label><input id="radio-2" name="testoodoc" type="radio" value="docweb" /> <label for="radio-2">docweb</label> <a class="ricercaavanzata" id="ricercaavanzata" href="#">advanced search</a> <input id="startdate" name="startdate" type="hidden" value="Inizio"/><input id="stopdate" name="stopdate" type="hidden" value="Fine"/><input name="cmd" type="hidden" value="search" /></fieldset></form><div id="advancedsearch" title="ADVANCED SEARCH" ></div></div></div></div></section></div><div class="portlet-boundary portlet-boundary_GDocwebDisplay_  portlet-static portlet-static-end portlet-barebone  " id="p_p_id_GDocwebDisplay_"><span id="p_GDocwebDisplay"></span><section class="portlet" id="portlet_GDocwebDisplay"><div class="portlet-content"><div class="autofit-float autofit-row portlet-header"><div class="autofit-col autofit-col-expand"><h2 class="portlet-title-text"> g-docweb-display Portlet </h2></div><div class="autofit-col autofit-col-end"><div class="autofit-section"></div></div></div><div class=" portlet-content-container"><div class="portlet-body"><div id="internal-content-wrapper" xmlns:dc="//purl.org/dc/elements/1.1/" ><h1 class="interna-titolo" property="dc:title"> Order injunction against Poliambulatorio Talenti Srl - January 14, 2021 [9542096] </h1><div id="interna-main-sx"><p class="sottotitolo" property="dc:description"></p><div class="tab-container"><div class="tab"> <span>CARD</span></div><div class="scheda"><dl><dt class="autore" style="display: none"> Author:</dt><dd> <span property="dc:creator" style="display: none">Guarantor for the protection of personal data</span></dd><dt class="docweb"> Doc-Web:</dt><dd> <span property="dc:identifier"><a href="/garante/doc.jsp?ID=9542096">9542096</a></span></dd><dt class="data" > Date:</dt><dd> <span property="dc:date">14/01/21</span></dd><dt class="argomenti" > Topics:</dt><dd class="argomenti"> <span property="dc:subject"><a  href="https://www.garanteprivacy.it/web/guest/home/ricerca/-/search/argomento/Sanità e ricerca scientifica">Healthcare and scientific research</a></span></dd><dt class="tipologia"> Typology:</dt><dd class="tipologia"> <span property="dc:type"><a  href="https://www.garanteprivacy.it/web/guest/home/ricerca/-/search/tipologia/Ordinanza ingiunzione o revoca">Order injunction or revocation</a></span></dd></dl></div></div><br /><div id="interna-quicklinks"><p> SEE ALSO (10)</p><ul><li> <a href="49220">The Guarantor simplifies the procedures for the issue of authorizations for doctors and health personnel - November 27, 1997</a></li><li> <a href="48409">Epidemiological control for mad cow disease - March 23, 1999</a></li><li> <a href="1686068">No to indiscriminate collections on HIV in medical offices [1686068]</a></li><li> <a href="1598313">Launch of public consultation on &#39;Guidelines on the subject of electronic health records and health records&#39; - March 5, 2009 [1598313]</a></li><li> <a href="1318699">Information: information for general practitioners and pediatricians - July 19, 2006 [1318699]</a></li><li> <a href="48593">Privacy and Health - January 14, 1999</a></li><li> <a href="48934">Privacy and health: news can be given on the presence of patients in hospitals - 02 June 1998</a></li><li> <a href="49243">Privacy and public health companies - November 17, 1997</a></li><li> <a href="48509">Cancer screening - 08 March 1999</a></li><li> <a href="1672856">Information notices by family doctors and paediatricians - 19 July 2006 [1672856]</a></li></ul></div></div><div id="interna-main-dx"><div class="azioni"><div class="azione"> <span><a href="javascript:_GDocwebDisplay_printPage();"><img src="https://www.garanteprivacy.it/o/garante-privacy-theme/images/icons/icona_stampa.png" alt="Print"/> <span><span class="helper-hidden-accessible">Print</span> Print</span></a></span> </div><div class="azione"><form action="https://www.garanteprivacy.it:443/pdf?p_p_id=PdfUtil&p_p_lifecycle=2&p_p_state=normal&p_p_mode=view&p_p_resource_id=%2Foffering%2FprintPDF&p_p_cacheability=cacheLevelPage&_PdfUtil_articleId=9542096" method="post" name="pdfForm" ></form> <a href="#" onclick="document.pdfForm.submit()"><img src="https://www.garanteprivacy.it/o/garante-privacy-theme/images/icons/icona_pdf.png" alt="PDF"/> <span><span class="helper-hidden-accessible">Transform content into</span> PDF</span></a></div><div class="azione"> <span><a href="mailto:?subject=Dal sito del Garante per la protezione dei dati personali&amp;body=https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9542096"><img src="https://www.garanteprivacy.it/o/garante-privacy-theme/images/icons/icona_condividi.png" alt="Share" /> <span>Send by mail <span class="helper-hidden-accessible">Send by mail</span></span></a></span></div><div class="azione"><table border="0" cellspacing="1"><tr><td><!-- Facebook --> <a rel="nofollow"
href="https://www.facebook.com/sharer/sharer.php?u=https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9542096"><img
src="https://www.garanteprivacy.it/o/garante-privacy-theme/images/social/facebook.png" title="Facebook" alt="Facebook" /></a> </td><!-- <td> --><!-- Google+ <a rel="nofollow" --><!-- </td> --></tr><tr><td><!-- Twitter --> <a rel="nofollow"
href="https://twitter.com/home?status=Ordinanza+ingiunzione+nei+confronti+di+Poliambulatorio+Talenti+S.r.l.+-+14+gennaio+2021+%5B9542096%5D+-+https%3A%2F%2Fwww.garanteprivacy.it%2Fweb%2Fguest%2Fhome%2Fdocweb%2F-%2Fdocweb-display%2Fdocweb%2F9542096+-+%23GarantePrivacy"><img
src="https://www.garanteprivacy.it/o/garante-privacy-theme/images/social/twitter.png" title="Twitter" alt="Twitter" /></a></td><td><!-- LinkedIn --> <a rel="nofollow"
href="https://www.linkedin.com/sharing/share-offsite/?mini=true&amp;url=https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9542096" ><img
src="https://www.garanteprivacy.it/o/garante-privacy-theme/images/social/linkedin.png" title="LinkedIn" alt="LinkedIn" /></a></td></tr></table> <span style="margin-left: 14px; margin-top: 2px;">Sharing <span class="helper-hidden-accessible">Sharing</span></span> </div></div><div id="readspeaker_button1" class="rs_skip rsbtn rs_preserve" style="margin-top:40px;"> <a class="rsbtn_play" accesskey="L" title="Listen to this page with ReadSpeaker" href="//app-eu.readspeaker.com/cgi-bin/rsent?customerid=7205&amp;lang=it_it&amp;readid=content-area&amp;url=https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9542096"><span class="rsbtn_left rsimg rspart"><span class="rsbtn_text"><span>Listen</span></span></span><span class="rsbtn_right rsimg rsplay rspart"></span></a></div><div id="content-area"><div class="testo"><p style="text-align: right;"> <span style="font-size:12px;">[doc. web n. 9542096]</span></p><p> <strong><span style="font-size:12px;"></span><span style="font-size:12px;">Injunction order against Poliambulatorio Talenti Srl - January 14, 2021</span><span style="font-size:12px;"></span></strong><span style="font-size:12px;"></span></p><p style="text-align: right;"> <span style="font-size:12px;">Record of measures<br /> n. 8 of 14 January 2020</span></p><p style="text-align: center;"><span style="font-size:12px;"></span> <strong><span style="font-size:12px;">THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA</span></strong><span style="font-size:12px;"></span></p><p style="text-align: justify;"> <span style="font-size:12px;">IN today&#39;s meeting, which was attended by prof. Pasquale Stanzione, president, professor Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer. Guido Scorza, members, and the cons. Fabio Mattei, general secretary;</span></p><p style="text-align: justify;"> <span style="font-size:12px;">GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46 / CE, &quot;General Data Protection Regulation&quot; (hereinafter, &quot;Regulation&quot;);</span></p><p style="text-align: justify;"> <span style="font-size:12px;">GIVEN the legislative decree 30 June 2003, n. 196 containing the “Code regarding the protection of personal data”, containing provisions for the adaptation of national law to the Regulation (hereinafter the “Code”);</span></p><p style="text-align: justify;"> <span style="font-size:12px;">GIVEN the Regulation n. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved with resolution no. 98 of 4/4/2019, published in the Official Gazette no. 106 of 8/5/2019 and in www.gpdp.it, doc. web n. 9107633 (hereinafter &quot;Regulation of the Guarantor no. 1/2019&quot;);</span></p><p style="text-align: justify;"> <span style="font-size:12px;">Having seen the documentation in the deeds;</span></p><p style="text-align: justify;"> <span style="font-size:12px;">Given the observations made by the secretary general pursuant to art. 15 of the Guarantor Regulation n. 1/2000;</span></p><p style="text-align: justify;"> <span style="font-size:12px;">Rapporteur the lawyer. Guido Scorza;</span><span style="font-size:12px;"></span></p><p style="text-align: center;"> <strong><span style="font-size:12px;">WHEREAS</span><span style="font-size:12px;"></span></strong></p><p> <strong><span style="font-size:12px;">1. The Complaint</span></strong></p><p style="text-align: justify;"> <span style="font-size:12px;">On 19 September 2019, Mr. XX exercised the right of access to the personal data of which to art. 15 of the Regulation, in relation to the processing of both their personal data and the personal data relating to the two minor daughters.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">This request was not followed up by any response within the terms indicated in art. 12, par. 3, of the Regulation and, following this, the interested party, on 23 October 2019, presented a formal complaint to this Authority.</span><span style="font-size:12px;"></span></p><p style="text-align: justify;"> <strong><span style="font-size:12px;">2. The preliminary activity.</span></strong></p><p style="text-align: justify;"> <span style="font-size:12px;">With note prot. n. 39690 of November 18, 2019, the health facility was formally invited by the Office to comply with the complainant&#39;s requests within 20 days of receipt of this invitation.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">On November 20, 2019, this structure provided a reply apologizing to the complainant &quot;(...) for not having fulfilled the (...) request for exercise (of the rights referred to in) art. 15 of EU Reg. 2016/679 and (informing him), possibly for the future, (...) (to have) prepared, starting from the (previous) year, an internal procedure that (...) allows to follow up on requests for exercise of the rights of the interested parties by signing a specific form present in acceptance, which (...) allows you to register the request and respond promptly &quot;, and also attaching the related documentation. Of this reply, on the same date, the undersigned Authority was informed.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">Subsequently, on November 27, 2019, the complainant wrote to this Authority complaining that, among the documentation sent by the aforementioned structure and, precisely, in that concerning the consent to the processing of data, as well as the consent for the sending of reports via e-mail mail - both relating to the minor daughter of the complainant - a name appeared that the complainant referred to be the name of a man, &quot;(...) but from the reverse tax code that is read in brackets after said name (...) it appears (goes) instead (... ) ”That this name referred to a female individual.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">By e-mail dated 9 December 2019, the complainant, representing to this Authority that he had asked the Company for explanations regarding this irregularity, declared himself dissatisfied with the response received on 28 November 2019.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">With a request for information sent to the health facility with note prot. n. 19148 of 26 May 2020, pursuant to art. 157 of the Code, clarifications were requested regarding the inaccuracies highlighted above and whether, in particular, other subjects, without any legitimacy, had become aware of information regarding the minor daughter of the complainant, as well as clarifications regarding the measures implemented and used to guarantee the accuracy and confidentiality of personal data, in particular health data.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">With a note dated 4 June 2020, the health facility, in response to the request for information, represented that the inaccuracy of the subscriber&#39;s personal data reported on the documents relating to the minor was due to the incorrect transcription on the aforementioned forms for the consent of the name of another patient with the same surname as the mother of the complainant&#39;s minor daughters; it was also represented that, in a communication sent to the complainant it was represented that &quot;the forms, containing the consents and information regarding the minor (...) have not been communicated in any way (to the subject whose name appears on the models) or to another subject as these are forms stored in paper format internally and to which only authorized internal subjects have access &quot;and (...) therefore, apart from the transcription error, there was in no way any leakage of the data of the minor &quot;.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">Furthermore, the health facility represented that (...) the staff was adequately informed on how to proceed and, above all, consent forms were developed and made available (divided by: consent to data processing for the purposes indicated in the information / consent sending the reports by e-mail / consent to venous sampling) through which it is clearly possible to enter the data of the minor / disabled and of the parent / guardian who will have to sign on his / her behalf &quot;, finally illustrating the technical security measures organizational procedures adopted within the Outpatient Clinic and attaching the documentation certifying the appointment of the data protection officer and the related communication to the Guarantor.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">With note prot. n. 22936 of 22 June 2020, the Office, on the basis of the elements acquired, notified the health facility, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, par. 2, of the Regulations, inviting the aforementioned holder to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (Article 166, paragraphs 6 and 7, of the Code; as well as Article 18, paragraph 1, of Law no. . 689 of 11/24/1981).</span></p><p style="text-align: justify;"> <span style="font-size:12px;">With the aforementioned note, the Office represented that it had ascertained that the health facility had responded to the request for access to data, made by the interested party, only following the invitation formulated by the Office in the context of the procedure relating to complaint presented by the latter, pursuant to art. 77 of the Regulation, or after 62 days from the date on which the interested party had exercised his right; this, in violation of art. 12, par. 3, in relation to art. 15 of the Regulation.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">With regard to the notified violation, the health facility sent its defense briefs with a note dated 25 June 2020, representing that &quot;the profiles of critics who involved Poliambulatorio Talenti Srl as Data Controller concerned the non-compliance with what provided for by art. 12, paragraph 3, which requires the Data Controller to provide the data subject with information relating to the right exercised within one month; this deadline was not respected due to problems with the hardware system that (...) led to the change of the PC (for which) it was not possible to view the email [relating to the access request presented by the interested party] within the established terms ”And asking to be heard by the Authority.</span> <span style="font-size:12px;"></span></p><p style="text-align: justify;"><span style="font-size:12px;"></span> <span style="font-size:12px;">As for the inaccuracy &quot;of the personal data concerning the subscriber of the documents relating to the minor (...), it was a material error due to the decision to copy the data of the minor&#39;s mother by hand (...) on the consent document generated management software. The problem arose from the impossibility of inserting the data of the minor and the signatory parent in this software separately. In reporting such data manually on the consent form, the material error was integrated that led to copying the data from the top line of the management system, relating to Mr. XXX (having the same surname as the mother of the minor daughter of the complainant). There was no communication of the minor&#39;s data (...) to Mr. XXX. &quot;</span></p><p style="text-align: justify;"> <span style="font-size:12px;">On 11 November 2020, the hearing pursuant to art. 166, paragraphs 6 and 7, of the Code and art. 18, paragraph 1, by law no. 689 of 11/24/1981. In this circumstance, the health facility reaffirmed what was already represented in the defense briefs, asking to proceed with the dismissal of the proceeding or, alternatively, the application of a penalty in the smallest amount possible.</span><span style="font-size:12px;"></span></p><p> <strong><span style="font-size:12px;">3. The legislation on the protection of personal data</span></strong></p><p style="text-align: justify;"><span style="font-size:12px;"></span> <span style="font-size:12px;">The Regulation, in the articles 12 and ss. having in place the &quot;rights of the interested party&quot;, provides for the right of the latter to obtain from the data controller the relative information requested pursuant to art. from 15 to 22 of the same Regulation (in the specific case, pursuant to art.15 and Recital 63), without undue delay and, in any case, at the latest within one month of receipt of the request. This, unless one of the cases of limitation of the rights of the interested party, exhaustively indicated in art. 23 of the Regulation and 2-undecies of the Code, which are not conferring with respect to the matter in question.</span></p><p> <strong><span style="font-size:12px;">4. Outcome of the preliminary investigation</span></strong></p><p style="text-align: justify;"> <span style="font-size:12px;">In light of the aforementioned assessments, it is noted that the statements made by the data controller in the defensive writings ˗ for the veracity of which one may be called to answer pursuant to art. 168 of the Code ˗ although deserving of consideration, they do not allow to overcome the findings notified by the Office with the act of initiation of the procedure and are insufficient to allow the filing of this procedure, however, none of the cases provided for by the art. 11 of the Guarantor Regulation n. 1/2019.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">In the case of a complaint, the health facility having provided feedback on the exercise of the right of access to personal data - carried out by the complainant on 19 September 2019 - on 20 November 2019, or after 62 days from the date of submission of this request for access and, therefore, well beyond the one-month term provided for by art. 12 of the Regulations, the preliminary assessments of the Office relating to the ascertained violation of art. 12, par. 3, in relation to art. 15 of the same Regulation.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">The violation of the aforementioned provisions makes the administrative sanction envisaged by art. 83, par. 5 of the Regulation, as also referred to by art. 166, paragraph 2, of the Code.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">In this context, considering, in any case, that the conduct has exhausted its effects, the conditions for the adoption of the corrective measures pursuant to art. 58, par. 2, of the Regulation.</span></p><p><span style="font-size:12px;"></span> <strong><span style="font-size:12px;">5. Adoption of the injunction order for the application of the pecuniary administrative sanction and ancillary sanctions (articles 58, par. 2, lett. I), and 83 of the Regulations; art. 166, paragraph 7, of the Code).</span></strong></p><p style="text-align: justify;"> <span style="font-size:12px;">The Guarantor, pursuant to art. 58, par. 2, lett. i), and 83 of the Regulations as well as art. 166 of the Code, has the power to &quot;inflict a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or instead of such measures, depending on the circumstances of each single case &quot;and, in this context,&quot; the College [of the Guarantor] adopts the injunction order, with which it also disposes with regard to the application of the ancillary administrative sanction of its publication, in whole or in excerpt, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code &quot;(Article 16, paragraph 1, of the Guarantor Regulation no. 1/2019).</span></p><p style="text-align: justify;"> <span style="font-size:12px;">In this regard, the violation of the aforementioned provisions is subject to the application of the pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">The aforementioned administrative pecuniary sanction imposed, depending on the circumstances of each individual case, must be determined in the amount taking into account the principles of effectiveness, proportionality and dissuasiveness, indicated in art. 83, par. 1, of the Regulation, in light of the elements provided for in art. 83, par. 2, of the Regulation in relation to which the negligent nature of the untimely feedback provided by the health facility is considered, caused by technical problems with the hardware system, in addition to the fact that this structure has carried out collaborative conduct with the Authority during the preliminary investigation of this proceeding and that there are no previous relevant violations committed by the structure itself or previous provisions pursuant to art. 58 of the Regulation charged to the same.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">On the basis of the aforementioned elements, assessed as a whole, it is believed to determine the amount of the pecuniary sanction, in the amount of € 2,000.00 (two thousand) for the violation of art. 12, par. 3, in relation to art. 15 of the Regulation.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">It is also believed that the ancillary sanction of the publication on the website of the Guarantor of this provision, provided for by art. 166, paragraph 7, of the Code and art. 16 of the Guarantor Regulation n. 1/2019.</span></p><p style="text-align: justify;"> <span style="font-size:12px;">Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.</span><span style="font-size:12px;"></span></p><p style="margin-left: 40px; text-align: center;"> <strong><span style="font-size:12px;">WHEREAS, THE GUARANTOR</span></strong></p><p style="text-align: justify; margin-left: 40px;"> <span style="font-size:12px;">the violation of art. 12, par. 3, in relation to art. 15 of the Regulations by Poliambulatorio Talenti Srl in the terms set out in the motivation;</span></p><p style="margin-left: 40px; text-align: center;"> <strong><span style="font-size:12px;"></span><span style="font-size:12px;">ORDER</span><span style="font-size:12px;"></span></strong></p><p style="text-align: justify; margin-left: 40px;"> <span style="font-size:12px;">to Poliambulatorio Talenti Srl in the person of the pro-tempore legal representative, with registered office in Rome, via Padre Semeria, n. 33 CF 1961330584 / VAT number 01021921000 pursuant to art. 58, par. 2, lett. i), and 83, par. 5, of the Regulation and 166, paragraph 2, of the Code, to pay the sum of € 2,000.00 (two thousand) as a pecuniary administrative sanction for the violation indicated in the motivation; it is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed;</span><span style="font-size:12px;"></span></p><p style="margin-left: 40px; text-align: center;"> <strong><span style="font-size:12px;">INJUNCES</span><span style="font-size:12px;"></span></strong></p><p style="text-align: justify; margin-left: 40px;"> <span style="font-size:12px;">to the same health facility to pay the sum of € 2,000.00 (two thousand), in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, according to the methods indicated in the annex, within 30 days from the notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of Law 689/1981;</span><span style="font-size:12px;"></span></p><p style="margin-left: 40px; text-align: center;"> <strong><span style="font-size:12px;">HAS</span></strong></p><p style="text-align: justify; margin-left: 80px;"><span style="font-size:12px;"></span> <span style="font-size:12px;">the publication of this provision on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code;</span></p><p style="text-align: justify; margin-left: 80px;"> <span style="font-size:12px;">the annotation of this provision in the Authority&#39;s internal register, provided for by art. 57, par. 1, lett. u), of the Regulations, violations and measures adopted in compliance with art. 58, par. 2, of the Regulation.</span><span style="font-size:12px;"></span></p><p style="text-align: justify; margin-left: 40px;"> <span style="font-size:12px;">Pursuant to art. 78 of the Regulation, of art. 152 of the Code and 10 of Legislative Decree 1 September 2011, n. 150, against this provision, it is possible to lodge an appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the applicant resides abroad.</span><span style="font-size:12px;"></span></p><p style="text-align: justify;"> <span style="font-size:12px;"><em>Rome, January 14, 2021</em></span></p><p style="text-align: right;"> <span style="font-size:12px;">PRESIDENT<br /> Stanzione</span></p><p style="text-align: right;"> <span style="font-size:12px;">THE RAPPORTEUR<br /> Peel</span></p><p style="text-align: right;"> <span style="font-size:12px;">THE SECRETARY GENERAL<br /> Mattei</span> </p></div></div><br /></div><hr /></div></div></div></div></section></div></div></div></div><div class="portlet-layout row"><div class="col-md-12 portlet-column portlet-column-only" id="column-4"><div class="empty portlet-dropzone portlet-column-content portlet-column-content-only" id="layout-column_column-4"></div></div></div><div class="portlet-layout row"><div class="col-md-12 portlet-column portlet-column-only" id="column-5"><div class="portlet-dropzone portlet-column-content portlet-column-content-only" id="layout-column_column-5"><div class="portlet-boundary portlet-boundary_MenuPortlet_  portlet-static portlet-static-end portlet-barebone  " id="p_p_id_MenuPortlet_INSTANCE_gOpqEbGKfxmQ_"><span id="p_MenuPortlet_INSTANCE_gOpqEbGKfxmQ"></span><section class="portlet" id="portlet_MenuPortlet_INSTANCE_gOpqEbGKfxmQ"><div class="portlet-content"><div class="autofit-float autofit-row portlet-header"><div class="autofit-col autofit-col-expand"><h2 class="portlet-title-text"> g-menu Portlet </h2></div><div class="autofit-col autofit-col-end"><div class="autofit-section"></div></div></div><div class=" portlet-content-container"><div class="portlet-body"><c:if test="true"><div id="_MenuPortlet_INSTANCE_gOpqEbGKfxmQ_"><div class="menu"><c:if test="false"></c:if><div class="block"><div id='pre-footer'><div class='pre-footer-column'><p class='pre-footer-header'><a href="https://www.garanteprivacy.it/home/autorita" >The authority</a></p><ul class='pre-footer'><li> <a href="https://www.garanteprivacy.it/home/autorita/collegio" >The Guarantor</a></li><li> <a href="https://www.garanteprivacy.it/home/autorita/compiti" >Duties of the Guarantor</a></li><li> <a href="https://www.garanteprivacy.it/home/autorita/ufficio" >The office</a></li><li> <a href="https://www.garanteprivacy.it/home/autorita/regolamenti-interni" >Internal regulations</a></li><li> <a href="https://www.garanteprivacy.it/home/autorita/codice-etico" >Ethical code</a></li><li> <a href="https://www.garanteprivacy.it/home/footer/contatti#urp" >URP</a></li><li> <a href="https://www.garanteprivacy.it/home/trasparenza" >Transparent authority</a></li></ul></div><div class='pre-footer-column'><p class='pre-footer-header'> <a href="https://www.garanteprivacy.it/home/provvedimenti-normativa" >Measures and legislation</a></p><ul class='pre-footer'><li> <a href="https://www.garanteprivacy.it/home/provvedimenti-normativa/provvedimenti" >Measures</a></li><li> <a href="https://www.garanteprivacy.it/home/provvedimenti-normativa/normativa" >Regulations</a></li><li> <a href="https://www.garanteprivacy.it/codice" >Code</a></li><li> <a href="https://www.garanteprivacy.it/regolamentoue" >EU Regulation 2016/679</a></li><li> <a href="https://www.garanteprivacy.it/codici-di-condotta" >Codes of conduct</a></li><li> <a href="https://www.garanteprivacy.it/home/provvedimenti-normativa/giurisprudenza" >Law</a></li><li> <a href="https://www.garanteprivacy.it/segnalazioni-al-parlamento-e-al-governo-e-note-istituzionali" >Reports to Parliament and the Government and institutional notes</a></li></ul></div><div class='pre-footer-column'><p class='pre-footer-header'> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti" >Activities and documents</a></p><ul class='pre-footer'><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/documenti/audizioni" >Hearings</a></li><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/documenti/relazioni-annuali" >Annual reports</a></li><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/iniziative" >Events and training</a></li><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/iniziative/giornate-europee-della-protezione-dei-dati-personali" >European Days</a></br> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/iniziative/giornate-europee-della-protezione-dei-dati-personali" >of data protection</a></li><li> <a href="https://www.garanteprivacy.it/temi" >Themes</a></li><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/libri" >Publications</a></li><li> <a href="https://www.garanteprivacy.it/faq" >FAQ</a></li><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/protocolli-d-intesa" >Protocols and conventions</a></li></ul></div><div class='pre-footer-column'><p class='pre-footer-header'> <a href="https://www.garanteprivacy.it/home/stampa-comunicazione" >Press and communication</a></p><ul class='pre-footer'><li> <a href="/home/ricerca/-/search/tipologia/comunicato stampa" >Press releases</a></li><li> <a href="https://www.garanteprivacy.it/home/stampa-comunicazione/newsletter" >Newsletter</a></li><li><a href="https://www.garanteprivacy.it/home/stampa-comunicazione/vademecum-e-campagne-informative" >Vademecum and information campaigns</a></li><li> <a href="https://www.garanteprivacy.it/home/stampa-comunicazione/interviste" >Interviews and speeches</a></li><li> <a href="https://www.garanteprivacy.it/home/stampa-comunicazione/contatti-per-la-stampa" >Press contacts</a></li><li> <a href="https://www.garanteprivacy.it/home/footer/link" >Useful links</a></li></ul></div><div class='pre-footer-column'><p class='pre-footer-header'> <a href="https://www.garanteprivacy.it/home/attivita-internazionali" >International activities</a></p><ul class='pre-footer'><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/attivita-comunitarie-e-internazionali/cooperazione-in-ambito-ue" >Cooperation</a></br> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/attivita-comunitarie-e-internazionali/cooperazione-in-ambito-ue" >within the EU</a></li><li> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/attivita-comunitarie-e-internazionali/cooperazione-in-ambito-extra-ue" >Cooperation</a></br> <a href="https://www.garanteprivacy.it/home/attivita-e-documenti/attivita-comunitarie-e-internazionali/cooperazione-in-ambito-extra-ue" >outside the EU</a></li><li> <a href="https://www.garanteprivacy.it/edpb" >EDPB</a></li><li> <a href="https://www.garanteprivacy.it/schengen" >Schengen</a></li><li> <a href="/home/attivita-e-documenti/attivita-comunitarie-e-internazionali/cooperazione-in-ambito-ue/sistema-di-informazione-visti-vis" >VIS</a> </li></ul></div></div></div></div></div></c:if></div></div></div></section></div></div></div></div></div><form action="#" class="hide" id="hrefFm" method="post" name="hrefFm"><span></span><input hidden type="submit"/></form></section><footer id="footer" role="contentinfo"><div class="portlet-boundary portlet-boundary_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_  portlet-static portlet-static-end portlet-barebone portlet-navigation " id="p_p_id_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_"><span id="p_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer"></span><section class="portlet" id="portlet_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer"><div class="portlet-content"><div class="autofit-float autofit-row portlet-header"><div class="autofit-col autofit-col-expand"><h2 class="portlet-title-text"> Navigation menu </h2></div><div class="autofit-col autofit-col-end"><div class="autofit-section"></div></div></div><div class=" portlet-content-container"><div class="portlet-body"><div id="navbar_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer"><ul aria-label="Pagine Sito" class="nav nav-justified navbar-blank navbar-nav navbar-site" role="menubar"><li class="lfr-nav-item nav-item" id="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412906" role="presentation"> <a aria-labelledby="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412906"  class="nav-link text-truncate" href='https://www.garanteprivacy.it/home/footer/contatti#urp'  role="menuitem"><span class="text-truncate">URP</span></a> </li><li class="lfr-nav-item nav-item" id="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412907" role="presentation"> <a aria-labelledby="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412907"  class="nav-link text-truncate" href='https://www.garanteprivacy.it/home/footer/contatti'  role="menuitem"><span class="text-truncate">Contacts</span></a> </li><li class="lfr-nav-item nav-item" id="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412909" role="presentation"> <a aria-labelledby="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412909"  class="nav-link text-truncate" href='https://www.garanteprivacy.it/home/footer/mappa-del-sito'  role="menuitem"><span class="text-truncate">site map</span></a> </li><li class="lfr-nav-item nav-item" id="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412910" role="presentation"> <a aria-labelledby="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412910"  class="nav-link text-truncate" href='https://www.garanteprivacy.it/home/footer/regole-del-sito'  role="menuitem"><span class="text-truncate">Site rules</span></a> </li><li class="lfr-nav-item nav-item" id="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412911" role="presentation"> <a aria-labelledby="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9412911"  class="nav-link text-truncate" href='https://www.garanteprivacy.it/informativa-protezione-dati'  role="menuitem"><span class="text-truncate">Data protection information</span></a> </li><li class="lfr-nav-item nav-item" id="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9502631" role="presentation"> <a aria-labelledby="layout_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_9502631"  class="nav-link text-truncate" href='https://form.agid.gov.it/view/2a9e50ae-a7b6-4859-882a-3aa49a5c071b'  role="menuitem"><span class="text-truncate">Accessibility statement</span></a></li></ul></div><script type="text/javascript">
// <![CDATA[
AUI().use('liferay-navigation-interaction', function(A) {(function() {var $ = AUI.$;var _ = AUI._; var navigation = A.one('#navbar_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer');


Liferay.Data.NAV_INTERACTION_LIST_SELECTOR = '.navbar-site';
IN TODAY'S MEETING, which was attended by Prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and Mr. Guido Scorza, components, and Cons. Fabio Mattei, Secretary General;
Liferay.Data.NAV_LIST_SELECTOR = '.navbar-site';


if (navigation) {
HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter, "Regulation");
navigation.plug(Liferay.NavigationInteraction);
}
})();});
// ]]>
</script></div></div></div></section></div></footer></div><script type="text/javascript">
// <![CDATA[


HAVING REGARD to Legislative Decree no. 196 of June 30, 2003, containing the "Personal Data Protection Code", with provisions for the adaptation of the national system to the Regulation (hereinafter, "Code");


HAVING REGARD to Regulation No. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution No. 98 of 4/4/2019, published in G.U. No. 106 of 8/5/2019 and at www.gpdp.it, web doc. No. 9107633 (hereinafter "Regulation of the Guarantor No. 1/2019");


Having regard to the documentation on file;


Liferay.BrowserSelectors.run();
Having regard to the comments made by the Secretary General pursuant to Article 15 of the Regulation of the Guarantor No. 1/2000;


// ]]>
Guido Scorza, lawyer;
</script><script type="text/javascript">
// <![CDATA[


PREMISES


Liferay.currentURL = '\x2fweb\x2fguest\x2fhome\x2fdocweb\x2f-\x2fdocweb-display\x2fdocweb\x2f9542096';
1. The Complaint
Liferay.currentURLEncoded = '\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096';


// ]]>
On September 19, 2019, Mr. XX exercised, against Poliambulatorio Talenti S.r.l. with registered office in Rome, via Padre Semeria, 33 C.F. 1961330584/ P.IVA 01021921000, (hereinafter the "health facility"), the right of access to personal data under Article 15 of the Regulation, in relation to the processing of both his personal data and the personal data relating to his two minor daughters.
</script><script type="text/javascript">
// <![CDATA[


This request was not followed by any response within the terms indicated by Article 12(3) of the Regulation and, following this, the interested party, on 23 October 2019, submitted a formal complaint to this Authority.
// ]]>
</script><script type="text/javascript">
// <![CDATA[
(function() {var $ = AUI.$;var _ = AUI._;
var onDestroyPortlet = function() {
Liferay.detach('messagePosted', onMessagePosted);
Liferay.detach('destroyPortlet', onDestroyPortlet);
};


Liferay.on('destroyPortlet', onDestroyPortlet);
2. Preliminary Activity.


var onMessagePosted = function(event) {
By memorandum no. 39690 of November 18, 2019, the health facility was formally invited by the Office to comply with the complainant's requests within 20 days of receipt of said invitation.
if (window.Analytics) {
Analytics.send('posted', 'Comment', {
className: event.className,
classPK: event.classPK,
commentId: event.commentId,
text: event.text
});
}
};


Liferay.on('messagePosted', onMessagePosted);
On November 20, 2019 this facility, provided a response apologizing to the complainant "(...) for not having processed in time the (...) request to exercise (the rights under) art. 15 of Reg. EU 2016/679 and (informing him), possibly for the future, (...) (to have) prepared, starting from the (previous) year, an internal procedure that (...) allows to respond to requests to exercise the rights of interested parties through the signing of a special form in acceptance, which (...) allows to record the request and respond promptly", and also attaching the relevant documentation. On the same date, it informed the undersigned Authority of this response.
})();(function() {var $ = AUI.$;var _ = AUI._;
var pathnameRegexp = /\/documents\/(\d+)\/(\d+)\/(.+?)\/([^&]+)/;


function handleDownloadClick(event) {
Subsequently, on November 27, 2019, the complainant wrote to this Authority complaining that, among the documentation sent by the aforementioned structure and, precisely, in that concerning the consent to the processing of data, as well as the consent to send the reports by e-mail - both relating to the minor daughter of the complainant - appeared a name that the complainant reported to be the name of a man, " (...) but from the reverse tax code that reads in brackets after that name (...) it appears (...)" that this name was referred to a female individual.  
if (event.target.nodeName.toLowerCase() === 'a' && window.Analytics) {
var anchor = event.target;
var match = pathnameRegexp.exec(anchor.pathname);


var fileEntryId =
By email dated December 9, 2019, the complainant, representing to this Authority that he had asked the Company for an explanation of this irregularity, stated that he was dissatisfied with the response received on November 28, 2019.
anchor.dataset.analyticsFileEntryId ||
(anchor.parentElement &&
anchor.parentElement.dataset.analyticsFileEntryId);


if (fileEntryId && match) {
With a request for information sent to the healthcare facility with note prot. no. 19148 of May 26, 2020, pursuant to art. 157 of the Code, clarifications were requested regarding the aforementioned inaccuracies and whether, in particular, other parties, without any legitimacy, had become aware of information regarding the complainant's minor daughter, as well as clarifications regarding the measures implemented and used to guarantee the accuracy and confidentiality of personal data, in particular health data.
var getParameterValue = function(parameterName) {
var result = null;


anchor.search
In a note dated June 4, 2020, the healthcare facility, in response to the request for information, stated that the inaccuracy of the subscriber's personal details on the documents relating to the minor child was due to the incorrect transcription on the aforementioned consent forms of the name of another patient with the same surname as the mother of the complainant's minor daughters; Furthermore, it was represented that, in a communication sent to the complainant, it had been represented that "the forms, containing the consents and information regarding the minor (...) have not been communicated in any way (to the person whose name appears on the forms) or to any other person as these are forms kept in paper format internally and to which only authorized internal subjects have access" and (...) therefore, apart from the transcription error, there has been no leakage of the minor's data".
.substr(1)
.split('&')
.forEach(function(item) {
var tmp = item.split('=');


if (tmp[0] === parameterName) {
In addition, the health facility represented that (...) the staff has been adequately informed on how to proceed and, above all, consent forms have been prepared and made available (distinct for: consents to the processing of data for the purposes indicated in the informative report / consent to the sending of reports by e-mail / consents to the venous sampling) through which it is clearly possible to enter the data of the minor/guardian and of the parent/guardian who will have to sign on his behalf", illustrating, finally, the technical-organizational security measures adopted within the Outpatient Clinic and attaching the documentation certifying the appointment of the person responsible for data protection and the relative communication to the Guarantor.
result = decodeURIComponent(tmp[1]);
}
});


return result;
With memorandum no. 22936 of June 22, 2020, the Office, on the basis of the elements acquired, notified the health facility, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, paragraph 2, of the Regulations, inviting the aforesaid owner to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (art. 166, paragraphs 6 and 7, of the Code; as well as art. 18, paragraph 1, of law no. 689 of November 24, 1981).
};


Analytics.send('documentDownloaded', 'Document', {
With the above-mentioned note, the Office stated that it had ascertained that the healthcare facility had only responded to the request for access to the data made by the interested party following the invitation made by the Office as part of the procedure relating to the claim submitted by the latter, pursuant to art. 77 of the Regulation, i.e. after 62 days from the date on which the interested party had exercised his or her right; this, in violation of art. 12, par. 3, in relation to art. 15 of the Regulation.
groupId: match[1],
fileEntryId: fileEntryId,
preview: !!window._com_liferay_document_library_analytics_isViewFileEntry,
title: decodeURIComponent(match[3].replace(/\+/gi, ' ')),
version: getParameterValue('version')
});
}
}
}


document.body.addEventListener('click', handleDownloadClick);
With regard to the notified violation, the health care facility sent its defensive memoranda with a note dated June 25, 2020, representing that "the critical profiles that involved Poliambulatorio Talenti Srl as Data Controller concerned the failure to comply with the provisions of art. 12, paragraph 3, which requires the Owner to provide the interested party with information about the right exercised within one month; this deadline was not met due to problems with the hardware system that (...) led to the change of the PC (so) it was not possible to view the email [relating to the request for access submitted by the interested party] within the prescribed time" and asking to be heard by the Authority.


var onDestroyPortlet = function() {
With regard to the inaccuracy "of the personal data concerning the subscriber of the documents relating to the minor (...), it was a material error due to the decision to copy by hand the data of the minor's mother (...) on the consent document generated by the management software. The problem arose from the impossibility of inserting in this software the personal data of the minor and the personal data of the signatory parent separately. In manually reporting this data on the consent form, a material error was made, which led to the data being copied from the top line of the management software, relating to Mr. XXX (having the same surname as the mother of the minor daughter of the complainant). There was no communication of the data of the minor (...) to Mr. XXX."
document.body.removeEventListener('click', handleDownloadClick);
Liferay.detach('destroyPortlet', onDestroyPortlet);
};


Liferay.on('destroyPortlet', onDestroyPortlet);
On November 11, 2020 a hearing was held pursuant to art. 166, paragraphs 6 and 7, of the Code and art. 18, paragraph 1, of law no. 689 of November 24, 1981. On this occasion, the health facility reiterated what had already been represented in the defense briefs, requesting that the proceedings be archived or, alternatively, that a penalty be applied to the lowest possible extent.
})();(function() {var $ = AUI.$;var _ = AUI._;
var onVote = function(event) {
if (window.Analytics) {
Analytics.send('VOTE', 'Ratings', {
className: event.className,
classPK: event.classPK,
ratingType: event.ratingType,
score: event.score
});
}
};


var onDestroyPortlet = function() {
3. Personal data protection regulations
Liferay.detach('ratings:vote', onVote);
Liferay.detach('destroyPortlet', onDestroyPortlet);
};


Liferay.on('ratings:vote', onVote);
Articles 12 et seq. of the Regulation, concerning the "rights of the data subject", provide for the data subject's right to obtain from the data controller the information requested pursuant to articles 15 to 22 of the Regulation itself (in this specific case, pursuant to article 15 and Recital 63), without undue delay and, in any case, within one month of receiving the request at the latest. This, unless there is one of the cases of limitation of the rights of the interested party, exhaustively indicated in art. 23 of the Regulation and 2-undecies of the Code, which are not relevant to the case in question.
Liferay.on('destroyPortlet', onDestroyPortlet);
})();(function() {var $ = AUI.$;var _ = AUI._;
var onShare = function(data) {
if (window.Analytics) {
Analytics.send('shared', 'SocialBookmarks', {
className: data.className,
classPK: data.classPK,
type: data.type,
url: data.url
});
}
};


var onDestroyPortlet = function() {
4. Outcome of the preliminary investigation
Liferay.detach('socialBookmarks:share', onShare);
Liferay.detach('destroyPortlet', onDestroyPortlet);
};


Liferay.on('socialBookmarks:share', onShare);
In the light of the above evaluations, it is noted that the statements made by the data controller in the defensive writings ˗ for the truthfulness of which one may be called to account pursuant to art. 168 of the Code ˗ although worthy of consideration, do not allow to overcome the findings notified by the Office with the act of initiation of the proceedings and are insufficient to allow the dismissal of these proceedings, not occurring, moreover, any of the cases provided for by art. 11 of the Regulation of the Guarantor No 1/2019.
Liferay.on('destroyPortlet', onDestroyPortlet);
})();
if (Liferay.Data.ICONS_INLINE_SVG) {
svg4everybody(
{
attributeName: 'data-href',
polyfill: true
}
);
}


function _GDocwebDisplay_printPage() {
In the case complained of, since the healthcare facility provided feedback to the exercise of the right of access to personal data - made by the complainant on September 19, 2019 - on November 20, 2019, i.e. after 62 days from the date of submission of such request for access and, therefore, well beyond the one-month period provided for by Article 12 of the Regulation, the Office's preliminary assessments regarding the ascertained violation of Article 12, paragraph 3, in relation to Article 15 of the same Regulation are confirmed.
window.open('https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/print/9542096', '', "directories=0,height=480,left=80,location=1,menubar=1,resizable=1,scrollbars=yes,status=0,toolbar=0,top=180,width=640");
}
Liferay.Portlet.register('GDocwebDisplay');


Liferay.Portlet.onLoad(
Violation of the above provisions makes the administrative penalty provided for by art. 83, paragraph 5 of the Regulations applicable, as also referred to in art. 166, paragraph 2, of the Code.
{
canEditTitle: false,
columnPos: 1,
isStatic: 'end',
namespacedId: 'p_p_id_GDocwebDisplay_',
portletId: 'GDocwebDisplay',
refreshURL: '\x2fc\x2fportal\x2frender_portlet\x3fp_l_id\x3d10563\x26p_p_id\x3dGDocwebDisplay\x26p_p_lifecycle\x3d0\x26p_t_lifecycle\x3d0\x26p_p_state\x3dnormal\x26p_p_mode\x3dview\x26p_p_col_id\x3dcolumn-3\x26p_p_col_pos\x3d1\x26p_p_col_count\x3d2\x26p_p_isolated\x3d1\x26currentURL\x3d\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096',
refreshURLData: {"_GDocwebDisplay_docweb":["9542096"]}
}
);


In this context, considering, in any case, that the conduct has exhausted its effects, the conditions for the adoption of the corrective measures pursuant to art. 58, paragraph 2, of the Regulations do not apply.
Liferay.Portlet.register('com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer');


Liferay.Portlet.onLoad(
5. Adoption of the injunction order for the application of the pecuniary administrative sanction and accessory sanctions (art. 58, paragraph 2, letter i), and 83 of the Regulations; art. 166, paragraph 7, of the Code).
{
canEditTitle: false,
columnPos: 0,
isStatic: 'end',
namespacedId: 'p_p_id_com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer_',
portletId: 'com_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer',
refreshURL: '\x2fc\x2fportal\x2frender_portlet\x3fp_l_id\x3d10563\x26p_p_id\x3dcom_liferay_site_navigation_menu_web_portlet_SiteNavigationMenuPortlet_INSTANCE_sitemap_menu_footer\x26p_p_lifecycle\x3d0\x26p_t_lifecycle\x3d0\x26p_p_state\x3dnormal\x26p_p_mode\x3dview\x26p_p_col_id\x3dnull\x26p_p_col_pos\x3dnull\x26p_p_col_count\x3dnull\x26p_p_static\x3d1\x26p_p_isolated\x3d1\x26currentURL\x3d\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096\x26settingsScope\x3dportletInstance',
refreshURLData: {}
}
);


The Supervisory Authority, pursuant to articles 58, paragraph 2, letter i), and 83 of the Regulations as well as art. 166 of the Code, has the power to "impose a pecuniary administrative sanction pursuant to article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each case" and, within this framework, "the Board [of the Supervisory Authority] adopts the injunction, with which it also orders the application of the accessory administrative sanction of its publication, in full or in extracts, on the website of the Supervisory Authority pursuant to article 166, paragraph 7, of the Code" (art. 16, paragraph 1, of the Regulation of the Garante).
Liferay.Portlet.register('com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx');


Liferay.Portlet.onLoad(
In this regard, the violation of the cited provisions is subject to the application of the pecuniary administrative sanction provided by Article 83, paragraph 5, of the Regulation.
{
canEditTitle: false,
columnPos: 0,
isStatic: 'end',
namespacedId: 'p_p_id_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx_',
portletId: 'com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx',
refreshURL: '\x2fc\x2fportal\x2frender_portlet\x3fp_l_id\x3d10563\x26p_p_id\x3dcom_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_D0Mx\x26p_p_lifecycle\x3d0\x26p_t_lifecycle\x3d0\x26p_p_state\x3dnormal\x26p_p_mode\x3dview\x26p_p_col_id\x3dcolumn-2\x26p_p_col_pos\x3d0\x26p_p_col_count\x3d1\x26p_p_isolated\x3d1\x26currentURL\x3d\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096',
refreshURLData: {}
}
);


The amount of the fine imposed must be determined on the basis of the circumstances of each individual case, taking into account the principles of effectiveness, proportionality and dissuasiveness set out in art. 83, paragraph 1 of the Regulations, in the light of the factors set out in art. 83, paragraph 2 of the Regulations in relation to which the infringement is to be punished. 2, of the Regulation, in relation to which the culpable nature of the untimely response provided by the healthcare facility is taken into account, caused by technical problems with the hardware system, as well as the fact that the facility has cooperated with the Authority during the preliminary investigation of the present procedure and that there are no previous relevant violations committed by the facility itself or previous measures referred to in art. 58 of the Regulation against the same.
Liferay.Portlet.register('MenuPortlet_INSTANCE_gOpqEbGKfxmQ');


Liferay.Portlet.onLoad(
On the basis of the above elements, taken as a whole, the amount of the fine should be set at 2,000.00 (two thousand) euros for the violation of art. 12, paragraph 3, in relation to art. 15 of the Regulations.
{
canEditTitle: false,
columnPos: 0,
isStatic: 'end',
namespacedId: 'p_p_id_MenuPortlet_INSTANCE_gOpqEbGKfxmQ_',
portletId: 'MenuPortlet_INSTANCE_gOpqEbGKfxmQ',
refreshURL: '\x2fc\x2fportal\x2frender_portlet\x3fp_l_id\x3d10563\x26p_p_id\x3dMenuPortlet_INSTANCE_gOpqEbGKfxmQ\x26p_p_lifecycle\x3d0\x26p_t_lifecycle\x3d0\x26p_p_state\x3dnormal\x26p_p_mode\x3dview\x26p_p_col_id\x3dcolumn-5\x26p_p_col_pos\x3d0\x26p_p_col_count\x3d1\x26p_p_isolated\x3d1\x26currentURL\x3d\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096',
refreshURLData: {}
}
);


It is also considered that the ancillary sanction of the publication on the website of the Guarantor of this measure, provided for in art. 166, paragraph 7, of the Code and art. 16 of the Regulation of the Guarantor n. 1/2019 should be applied.
Liferay.Portlet.register('GSolrFormWeb');


Liferay.Portlet.onLoad(
It should be noted, finally, that the requirements of art. 17 of Regulation no. 1/2019 concerning the internal procedures having external relevance, aimed at the performance of tasks and the exercise of powers delegated to the Guarantor.
{
canEditTitle: false,
columnPos: 0,
isStatic: 'end',
namespacedId: 'p_p_id_GSolrFormWeb_',
portletId: 'GSolrFormWeb',
refreshURL: '\x2fc\x2fportal\x2frender_portlet\x3fp_l_id\x3d10563\x26p_p_id\x3dGSolrFormWeb\x26p_p_lifecycle\x3d0\x26p_t_lifecycle\x3d0\x26p_p_state\x3dnormal\x26p_p_mode\x3dview\x26p_p_col_id\x3dcolumn-3\x26p_p_col_pos\x3d0\x26p_p_col_count\x3d2\x26p_p_isolated\x3d1\x26currentURL\x3d\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096',
refreshURLData: {}
}
);


ALL THIS PREMISED THE SUPERVISOR
Liferay.Portlet.register('com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT');


Liferay.Portlet.onLoad(
noted the violation of art. 12, par. 3, in relation to art. 15 of the Regulation by Poliambulatorio Talenti S.r.l. in the terms set out in the grounds;
{
canEditTitle: false,
columnPos: 0,
isStatic: 'end',
namespacedId: 'p_p_id_com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT_',
portletId: 'com_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT',
refreshURL: '\x2fc\x2fportal\x2frender_portlet\x3fp_l_id\x3d10563\x26p_p_id\x3dcom_liferay_journal_content_web_portlet_JournalContentPortlet_INSTANCE_A9oT\x26p_p_lifecycle\x3d0\x26p_t_lifecycle\x3d0\x26p_p_state\x3dnormal\x26p_p_mode\x3dview\x26p_p_col_id\x3dcolumn-1\x26p_p_col_pos\x3d0\x26p_p_col_count\x3d1\x26p_p_isolated\x3d1\x26currentURL\x3d\x252Fweb\x252Fguest\x252Fhome\x252Fdocweb\x252F-\x252Fdocweb-display\x252Fdocweb\x252F9542096',
refreshURLData: {}
}
);
Liferay.Loader.require('metal-dom/src/all/dom', 'clay-tooltip/src/ClayTooltip', function(metalDomSrcAllDom, clayTooltipSrcClayTooltip) {
(function(){
var dom = metalDomSrcAllDom;
var ClayTooltip = clayTooltipSrcClayTooltip;
(function() {var $ = AUI.$;var _ = AUI._;
var focusInPortletHandler = dom.delegate(
document,
'focusin',
'.portlet',
function(event) {
dom.addClasses(dom.closest(event.delegateTarget, '.portlet'), 'open');
}
);


var focusOutPortletHandler = dom.delegate(
ORDERS
document,
'focusout',
'.portlet',
function(event) {
dom.removeClasses(dom.closest(event.delegateTarget, '.portlet'), 'open');
}
);
})();(function() {var $ = AUI.$;var _ = AUI._;
if (!Liferay.Data.LFR_PORTAL_CLAY_TOOLTIP) {
Liferay.Data.LFR_PORTAL_CLAY_TOOLTIP = ClayTooltip.default.init(
{
selectors: [
'.manage-collaborators-dialog .lexicon-icon[data-title]:not(.lfr-portal-tooltip)',
'.manage-collaborators-dialog .lexicon-icon[title]:not(.lfr-portal-tooltip)',
'.management-bar [data-title]:not(.lfr-portal-tooltip)',
'.management-bar [title]:not(.lfr-portal-tooltip)',
'.preview-toolbar-container [data-title]:not(.lfr-portal-tooltip)',
'.preview-toolbar-container [title]:not(.lfr-portal-tooltip)',
'.progress-container[data-title]',
'.source-editor__fixed-text__help[data-title]',
'.taglib-discussion [data-title]:not(.lfr-portal-tooltip)',
'.taglib-discussion [title]:not(.lfr-portal-tooltip):not([title=""])',
'.upper-tbar [data-title]:not(.lfr-portal-tooltip)',
'.upper-tbar [title]:not(.lfr-portal-tooltip)'
]
}
);
}
})();})();
});AUI().use('aui-tooltip', 'liferay-menu', 'liferay-notice', 'aui-base', 'liferay-session', 'liferay-poller', function(A) {(function() {var $ = AUI.$;var _ = AUI._;
if (A.UA.mobile) {
Liferay.Util.addInputCancel();
}
})();(function() {var $ = AUI.$;var _ = AUI._;
if (!Liferay.Data.LFR_PORTAL_TOOLTIP) {
var triggerShowEvent = ['mouseenter', 'MSPointerDown', 'touchstart'];


if (A.UA.ios) {
Poliambulatorio Talenti S.r.l. in the person of its pro-tempore legal representative, with registered office in Rome, via Padre Semeria, no. 33 C.F. 1961330584/ P.IVA 01021921000 in accordance with art. 58, par. 2, lett. i), and 83, par. 5, of the Regulations and 166, paragraph 2, of the Code, to pay the sum of €2000.00 (two thousand) as a fine for the violation indicated in the grounds; it should be noted that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half the fine imposed;
triggerShowEvent = ['touchstart'];
}


Liferay.Data.LFR_PORTAL_TOOLTIP = new A.TooltipDelegate(
URGES
{
constrain: true,
opacity: 1,
trigger: '.lfr-portal-tooltip',
triggerHideEvent: ['click', 'mouseleave', 'MSPointerUp', 'touchend'],
triggerShowEvent: triggerShowEvent,
visible: false,
zIndex: Liferay.zIndex.TOOLTIP
}
);


Liferay.on(
the same health facility to pay the sum of € 2,000.00 (two thousand), in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, according to the procedures indicated in the annex, within 30 days of notification of this measure, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of law no. 689/1981;
'beforeNavigate',
function(event) {
Liferay.Data.LFR_PORTAL_TOOLTIP.getTooltip().hide();
}
);
}
})();(function() {var $ = AUI.$;var _ = AUI._;
new Liferay.Menu();


var liferayNotices = Liferay.Data.notices;
PROVISIONS


for (var i = 1; i < liferayNotices.length; i++) {
the publication of this measure on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code;
new Liferay.Notice(liferayNotices[i]);
}


the annotation of this measure in the internal register of the Authority, provided for by art. 57, par. 1, letter u), of the Regulation, of the violations and of the measures adopted in compliance with art. 58, par. 2, of the Regulation.
})();(function() {var $ = AUI.$;var _ = AUI._;
Liferay.Session = new Liferay.SessionBase(
{
autoExtend: true,
redirectOnExpire: false,
redirectUrl: 'https\x3a\x2f\x2fwww\x2egaranteprivacy\x2eit\x2fweb\x2fguest',
sessionLength: 600,
warningLength: 0
}
);


Pursuant to art. 78 of the Regulations, art. 152 of the Code and 10 of Legislative Decree no. 150 of September 1, 2011, an appeal against this measure may be lodged with the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of communication of the measure itself, or within sixty days if the appellant resides abroad.
})();});
// ]]>
</script><script src="https://www.garanteprivacy.it/o/garante-privacy-theme/js/main.js?browserId=other&amp;minifierType=js&amp;languageId=it_IT&amp;b=7201&amp;t=1615017666000" type="text/javascript"></script><script type="text/javascript">
// <![CDATA[
AUI().use(
'aui-base',
function(A) {
var frameElement = window.frameElement;


if (frameElement && frameElement.getAttribute('id') === 'simulationDeviceIframe') {
Rome, January 14, 2021
A.getBody().addClass('lfr-has-simulation-panel');
}
}
);
// ]]>
</script><!-- inject:js --><!-- endinject --></body></html>
</pre>

Revision as of 11:30, 31 March 2021

Garante per la protezione dei dati personali - 9542096
LogoIT.png
Authority: Garante per la protezione dei dati personali (Italy)
Jurisdiction: Italy
Relevant Law: Article 12(3) GDPR
Article 15 GDPR
Article 58(2)(i) GDPR
Article 58(2) GDPR
Article 77 GDPR
Article 83 GDPR
Article 83(5) GDPR
Codice in materia di protezione dei dati personali (Testo coordinato)
Regolamento n. 1/2019. Procedure interne aventi rilevanza esterna, finalizzate allo svolgimento dei compiti e all'esercizio dei poteri demandati al Garante per la protezione dei dati personali, nonche' all'adozione dei provvedimenti correttivi e sanzionatori
Legge n. 689 del 24/11/1981
Type: Complaint
Outcome: Upheld
Started:
Decided: 14.01.2021
Published: 03.03.2021
Fine: 2000 EUR
Parties: Poliambulatorio Talenti S.r.l.
Anonymous
National Case Number/Name: 9542096
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Italian
Original Source: Garante per la Protezione dei Dati Personali (in IT)
Initial Contributor: n/a

The Italian DPA (Garante per la protezione dei dati personali) imposed a fine of €2,000 on Poliambulatorio Talenti S.r.l., an outpatient clinic, for failing to respond to a data subject's access request within the time limits imposed by Article 12(3) GDPR.

English Summary

Facts

On 19 September 2019, the data subject requested Poliambulatorio Talenti S.r.l. to access his and his two minor daughters' personal data. On 23 October 2019 he filed a complaint with the Garante as he had not received a response from the polyclinic yet. On 18 November 2019, the DPA invited Poliambulatorio Talenti to comply with the request within 20 days. Two days later, the polyclinic replied to the data subject and apologized.

Following the polyclinic’s answer, the data subject complained to the Supervisory Authority that in the forms related to one of his daughters’ consent to the processing of personal data, and to receive reports from the clinic via email, there was the name of a male individual. The Garante hence asked Poliambulatorio Talenti for clarifications, in particular concerning the possibility of a data breach, and concerning the measures implemented to ensure the accuracy and confidentiality of personal data.

In response to the request for information, the healthcare facility clarified that the reason for the incorrect name entered in the system was due to the fact that the male individual shared the same surname as the mother of the complainant's minor daughters. The polyclinic also stated that there was no communication of the personal data of the complainant’s daughters to said male individual, or to anyone, since the data is kept only in paper form and is accessible only by authorised internal personnel.

In subsequent documentation sent to the Garante, Poliambulatorio Talenti argued that the delay in replying to the data subject was due to issues with the hardware system, and that the inaccuracy in the name entered in the system was caused by “a material mistake due to the decision to copy by hand the data of the minor's mother”. During a hearing, the clinic also asked the Garante to close the case, or apply the lowest possible fine.

Holding

The Garante found that the defensive statements were not enough to overcome its initial findings and close the proceedings. On the other hand, since the access request was fulfilled 62 days after its submission, the DPA found a violation of Article 12(3) in relation to Article 15 GDPR. The Garante hence applied an administrative fine as per Article 83(5) GDPR. The amount of such fine was set at €2000, taking into account the negligent nature of the delay, the fact that the polyclinic cooperated with the Supervisory Authority, and the lack of “previous relevant infringements”, or “previous provisions” as per Article 58 GDPR, ascribed to Poliambulatorio Talenti.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more detail.

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN TODAY'S MEETING, which was attended by Prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and Mr. Guido Scorza, components, and Cons. Fabio Mattei, Secretary General;

HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter, "Regulation");

HAVING REGARD to Legislative Decree no. 196 of June 30, 2003, containing the "Personal Data Protection Code", with provisions for the adaptation of the national system to the Regulation (hereinafter, "Code");

HAVING REGARD to Regulation No. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved by resolution No. 98 of 4/4/2019, published in G.U. No. 106 of 8/5/2019 and at www.gpdp.it, web doc. No. 9107633 (hereinafter "Regulation of the Guarantor No. 1/2019");

Having regard to the documentation on file;

Having regard to the comments made by the Secretary General pursuant to Article 15 of the Regulation of the Guarantor No. 1/2000;

Guido Scorza, lawyer;

PREMISES

1. The Complaint

On September 19, 2019, Mr. XX exercised, against Poliambulatorio Talenti S.r.l. with registered office in Rome, via Padre Semeria, 33 C.F. 1961330584/ P.IVA 01021921000, (hereinafter the "health facility"), the right of access to personal data under Article 15 of the Regulation, in relation to the processing of both his personal data and the personal data relating to his two minor daughters.

This request was not followed by any response within the terms indicated by Article 12(3) of the Regulation and, following this, the interested party, on 23 October 2019, submitted a formal complaint to this Authority.

2. Preliminary Activity.

By memorandum no. 39690 of November 18, 2019, the health facility was formally invited by the Office to comply with the complainant's requests within 20 days of receipt of said invitation.

On November 20, 2019 this facility, provided a response apologizing to the complainant "(...) for not having processed in time the (...) request to exercise (the rights under) art. 15 of Reg. EU 2016/679 and (informing him), possibly for the future, (...) (to have) prepared, starting from the (previous) year, an internal procedure that (...) allows to respond to requests to exercise the rights of interested parties through the signing of a special form in acceptance, which (...) allows to record the request and respond promptly", and also attaching the relevant documentation. On the same date, it informed the undersigned Authority of this response.

Subsequently, on November 27, 2019, the complainant wrote to this Authority complaining that, among the documentation sent by the aforementioned structure and, precisely, in that concerning the consent to the processing of data, as well as the consent to send the reports by e-mail - both relating to the minor daughter of the complainant - appeared a name that the complainant reported to be the name of a man, " (...) but from the reverse tax code that reads in brackets after that name (...) it appears (...)" that this name was referred to a female individual.

By email dated December 9, 2019, the complainant, representing to this Authority that he had asked the Company for an explanation of this irregularity, stated that he was dissatisfied with the response received on November 28, 2019.

With a request for information sent to the healthcare facility with note prot. no. 19148 of May 26, 2020, pursuant to art. 157 of the Code, clarifications were requested regarding the aforementioned inaccuracies and whether, in particular, other parties, without any legitimacy, had become aware of information regarding the complainant's minor daughter, as well as clarifications regarding the measures implemented and used to guarantee the accuracy and confidentiality of personal data, in particular health data.

In a note dated June 4, 2020, the healthcare facility, in response to the request for information, stated that the inaccuracy of the subscriber's personal details on the documents relating to the minor child was due to the incorrect transcription on the aforementioned consent forms of the name of another patient with the same surname as the mother of the complainant's minor daughters; Furthermore, it was represented that, in a communication sent to the complainant, it had been represented that "the forms, containing the consents and information regarding the minor (...) have not been communicated in any way (to the person whose name appears on the forms) or to any other person as these are forms kept in paper format internally and to which only authorized internal subjects have access" and (...) therefore, apart from the transcription error, there has been no leakage of the minor's data".

In addition, the health facility represented that (...) the staff has been adequately informed on how to proceed and, above all, consent forms have been prepared and made available (distinct for: consents to the processing of data for the purposes indicated in the informative report / consent to the sending of reports by e-mail / consents to the venous sampling) through which it is clearly possible to enter the data of the minor/guardian and of the parent/guardian who will have to sign on his behalf", illustrating, finally, the technical-organizational security measures adopted within the Outpatient Clinic and attaching the documentation certifying the appointment of the person responsible for data protection and the relative communication to the Guarantor.

With memorandum no. 22936 of June 22, 2020, the Office, on the basis of the elements acquired, notified the health facility, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, paragraph 2, of the Regulations, inviting the aforesaid owner to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (art. 166, paragraphs 6 and 7, of the Code; as well as art. 18, paragraph 1, of law no. 689 of November 24, 1981).

With the above-mentioned note, the Office stated that it had ascertained that the healthcare facility had only responded to the request for access to the data made by the interested party following the invitation made by the Office as part of the procedure relating to the claim submitted by the latter, pursuant to art. 77 of the Regulation, i.e. after 62 days from the date on which the interested party had exercised his or her right; this, in violation of art. 12, par. 3, in relation to art. 15 of the Regulation.

With regard to the notified violation, the health care facility sent its defensive memoranda with a note dated June 25, 2020, representing that "the critical profiles that involved Poliambulatorio Talenti Srl as Data Controller concerned the failure to comply with the provisions of art. 12, paragraph 3, which requires the Owner to provide the interested party with information about the right exercised within one month; this deadline was not met due to problems with the hardware system that (...) led to the change of the PC (so) it was not possible to view the email [relating to the request for access submitted by the interested party] within the prescribed time" and asking to be heard by the Authority.

With regard to the inaccuracy "of the personal data concerning the subscriber of the documents relating to the minor (...), it was a material error due to the decision to copy by hand the data of the minor's mother (...) on the consent document generated by the management software. The problem arose from the impossibility of inserting in this software the personal data of the minor and the personal data of the signatory parent separately. In manually reporting this data on the consent form, a material error was made, which led to the data being copied from the top line of the management software, relating to Mr. XXX (having the same surname as the mother of the minor daughter of the complainant). There was no communication of the data of the minor (...) to Mr. XXX."

On November 11, 2020 a hearing was held pursuant to art. 166, paragraphs 6 and 7, of the Code and art. 18, paragraph 1, of law no. 689 of November 24, 1981. On this occasion, the health facility reiterated what had already been represented in the defense briefs, requesting that the proceedings be archived or, alternatively, that a penalty be applied to the lowest possible extent.

3. Personal data protection regulations

Articles 12 et seq. of the Regulation, concerning the "rights of the data subject", provide for the data subject's right to obtain from the data controller the information requested pursuant to articles 15 to 22 of the Regulation itself (in this specific case, pursuant to article 15 and Recital 63), without undue delay and, in any case, within one month of receiving the request at the latest. This, unless there is one of the cases of limitation of the rights of the interested party, exhaustively indicated in art. 23 of the Regulation and 2-undecies of the Code, which are not relevant to the case in question.

4. Outcome of the preliminary investigation

In the light of the above evaluations, it is noted that the statements made by the data controller in the defensive writings ˗ for the truthfulness of which one may be called to account pursuant to art. 168 of the Code ˗ although worthy of consideration, do not allow to overcome the findings notified by the Office with the act of initiation of the proceedings and are insufficient to allow the dismissal of these proceedings, not occurring, moreover, any of the cases provided for by art. 11 of the Regulation of the Guarantor No 1/2019.

In the case complained of, since the healthcare facility provided feedback to the exercise of the right of access to personal data - made by the complainant on September 19, 2019 - on November 20, 2019, i.e. after 62 days from the date of submission of such request for access and, therefore, well beyond the one-month period provided for by Article 12 of the Regulation, the Office's preliminary assessments regarding the ascertained violation of Article 12, paragraph 3, in relation to Article 15 of the same Regulation are confirmed.

Violation of the above provisions makes the administrative penalty provided for by art. 83, paragraph 5 of the Regulations applicable, as also referred to in art. 166, paragraph 2, of the Code.

In this context, considering, in any case, that the conduct has exhausted its effects, the conditions for the adoption of the corrective measures pursuant to art. 58, paragraph 2, of the Regulations do not apply.

5. Adoption of the injunction order for the application of the pecuniary administrative sanction and accessory sanctions (art. 58, paragraph 2, letter i), and 83 of the Regulations; art. 166, paragraph 7, of the Code).

The Supervisory Authority, pursuant to articles 58, paragraph 2, letter i), and 83 of the Regulations as well as art. 166 of the Code, has the power to "impose a pecuniary administrative sanction pursuant to article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each case" and, within this framework, "the Board [of the Supervisory Authority] adopts the injunction, with which it also orders the application of the accessory administrative sanction of its publication, in full or in extracts, on the website of the Supervisory Authority pursuant to article 166, paragraph 7, of the Code" (art. 16, paragraph 1, of the Regulation of the Garante).

In this regard, the violation of the cited provisions is subject to the application of the pecuniary administrative sanction provided by Article 83, paragraph 5, of the Regulation.

The amount of the fine imposed must be determined on the basis of the circumstances of each individual case, taking into account the principles of effectiveness, proportionality and dissuasiveness set out in art. 83, paragraph 1 of the Regulations, in the light of the factors set out in art. 83, paragraph 2 of the Regulations in relation to which the infringement is to be punished. 2, of the Regulation, in relation to which the culpable nature of the untimely response provided by the healthcare facility is taken into account, caused by technical problems with the hardware system, as well as the fact that the facility has cooperated with the Authority during the preliminary investigation of the present procedure and that there are no previous relevant violations committed by the facility itself or previous measures referred to in art. 58 of the Regulation against the same.

On the basis of the above elements, taken as a whole, the amount of the fine should be set at 2,000.00 (two thousand) euros for the violation of art. 12, paragraph 3, in relation to art. 15 of the Regulations.

It is also considered that the ancillary sanction of the publication on the website of the Guarantor of this measure, provided for in art. 166, paragraph 7, of the Code and art. 16 of the Regulation of the Guarantor n. 1/2019 should be applied.

It should be noted, finally, that the requirements of art. 17 of Regulation no. 1/2019 concerning the internal procedures having external relevance, aimed at the performance of tasks and the exercise of powers delegated to the Guarantor.

ALL THIS PREMISED THE SUPERVISOR

noted the violation of art. 12, par. 3, in relation to art. 15 of the Regulation by Poliambulatorio Talenti S.r.l. in the terms set out in the grounds;

ORDERS

Poliambulatorio Talenti S.r.l. in the person of its pro-tempore legal representative, with registered office in Rome, via Padre Semeria, no. 33 C.F. 1961330584/ P.IVA 01021921000 in accordance with art. 58, par. 2, lett. i), and 83, par. 5, of the Regulations and 166, paragraph 2, of the Code, to pay the sum of €2000.00 (two thousand) as a fine for the violation indicated in the grounds; it should be noted that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half the fine imposed;

URGES

the same health facility to pay the sum of € 2,000.00 (two thousand), in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, according to the procedures indicated in the annex, within 30 days of notification of this measure, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of law no. 689/1981;

PROVISIONS

the publication of this measure on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code;

the annotation of this measure in the internal register of the Authority, provided for by art. 57, par. 1, letter u), of the Regulation, of the violations and of the measures adopted in compliance with art. 58, par. 2, of the Regulation.

Pursuant to art. 78 of the Regulations, art. 152 of the Code and 10 of Legislative Decree no. 150 of September 1, 2011, an appeal against this measure may be lodged with the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of communication of the measure itself, or within sixty days if the appellant resides abroad.

Rome, January 14, 2021