[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fT8P1pRBNirOkUjbQ8Q3jDRxW5e3wSwA00N1Gp1xLIiU":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"bf51b15b-48d8-4e48-bc0d-865832aba35b","Garante per la protezione dei dati personali (Italy) - 10309500-n.761","garante-per-la-protezione-dei-dati-personali-italy-10309500-n-761-184091","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=10309500-n.761 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10309500 |Original_Source_Language_1=Italian |Original_So...\" Show changes","The Italian Garante per la protezione dei dati personali has fined the Ministry of Justice €20,000 for publicly displaying the names and test results of 1,229 notary candidates in the Ministry's entrance hall. The authority found the Ministry lacked a legal basis for this broad disclosure and violated data minimization principles by including dates of birth and test scores, which were not necessary for announcing successful candidates.","Italy's Garante fines Ministry of Justice €20,000 for public data display.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10309500-n.761&diff=53663&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-11-10T09:32:40+00:00","2026-11-10T10:00:45.122667+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":62},"italian-ministry-of-justice-fined-for-publicly-displaying-notary-candidates-personal-data-without-le","Italian Ministry of Justice Fined for Publicly Displaying Notary Candidates' Personal Data Without Legal Basis","The Italian Ministry of Justice publicly displayed the names, dates of birth, and test scores of 1,229 notary candidates in its entrance hall without a valid legal basis for such broad disclosure. This violated the GDPR's data minimization principle, which requires that only data strictly necessary for the stated purpose be processed and shared. Publishing excessive personal details — including birth dates and test results — went far beyond what was needed to inform candidates of their pass\u002Ffail status. This incident demonstrates that physical and administrative data handling practices carry the same legal weight as digital ones. Organizations must assess the lawfulness and proportionality of every data disclosure, regardless of its medium.",[55,56,57,58,59,60,61],"GDPR Article 5(1)(c): Data Minimisation","GDPR Article 6: Lawfulness of Processing","GDPR Article 32","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 PT-3: Personally Identifiable Information Processing Purposes",{"GDPR Article 32":63,"GDPR Article 5(1)(c): Data Minimisation":64,"GDPR Article 6: Lawfulness of Processing":65,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":66,"CIS Control 14: Security Awareness and Skills Training":67,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII":68,"NIST SP 800-53 PT-3: Personally Identifiable Information Processing Purposes":69},"Article 32 requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk, which includes governing how and what personal data is disclosed through administrative and physical channels.","The Ministry published dates of birth and test scores that were not necessary to communicate exam outcomes, directly violating the data minimisation principle that personal data must be adequate, relevant, and limited to what is necessary.","The Garante found no valid legal basis for the broad public disclosure, making the core violation one of unlawful processing — Article 6 requires a clear legal ground before any personal data is processed or disclosed.","The incident reflects a lack of staff competence regarding data protection obligations; ensuring personnel responsible for publishing exam results are trained on GDPR requirements would have prevented this breach.","Administrative staff responsible for communicating exam results lacked awareness of data privacy obligations, and a structured training programme covering data minimisation and lawful disclosure would have prevented the unnecessary exposure.","This control requires organisations to identify and meet their obligations regarding privacy and the protection of personally identifiable information, which would have prompted a legal review before publicly posting candidate data.","This control requires organisations to document and limit the processing of PII to only what is compatible with the specified purpose, which would have flagged the inclusion of birth dates and scores as disproportionate for a simple pass\u002Ffail announcement."]