- Date of final decision: 7 July 2022
- Cross-border case or national case: National case
- Controller: US Company – Senseonics INC
- Legal Reference: GDPR Article 5, para 1 letters a), b) and f) (lawfulness, fairness and transparency; purpose limitation; integrity e confidentiality); Article 6 (lawfulness of processing); Article 7 (conditions of consent); Article 9 (processing of special categories of personal data, including health data); Article 12 (transparent information, communication and modalities for the exercise of the rights of the data subject); Article 13 (Information to be provided where personal data are collected from the data subject) and Article 27 (Representatives of controllers or processors not established in the Union)
- Decision: finding of infringements of the GDPR (imposition of administrative fine and order to comply)
- Key words: GDPR, data breach, App, health data, lawfulness, fairness and transparency, glucose monitoring system, diabetes, consent, EU representative
Summary of the Decision
Origin of the case
Notification of data breach to the Italian SA due to an employee’s sending – as part of an information campaign – email messages with the recipients’ addresses in the ‘Cc’ field rather than in the ‘Bcc’ one. This resulted into enabling every recipient to view the other recipients’ email addresses that in this case, also contained data disclosing health data.
Taking into account the unintentional nature of the emailing activity along with the cooperation shown by the company in the course of the fact-finding activities and the company’s organization profile, the Italian SA imposed an EUR 45,000 administrative fine and an order to bring the processing into compliance with the GDPR
For further information:
decision in national language "Ordinanza ingiunzione nei confronti di Senseonics Inc."
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.