Garante per la protezione dei dati personali (Italy) - 10309500-n.761
Italy's DPA fined the Ministry of Justice €20,000 for publicly displaying notary candidate data.
The Italian DPA has fined the Ministry of Justice €20,000 for publicly displaying the names, dates of birth, and test scores of 1,229 notary candidates in its entrance hall. The DPA found that the Ministry lacked a valid legal basis for this disclosure and violated data minimization principles, as national law only permitted displaying names of candidates advancing to the next stage.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Italian Ministry of Justice publicly displayed the names, dates of birth, and test scores of 1,229 notary exam candidates without a valid legal basis, violating GDPR's data minimization principle. National law only permitted displaying the names of candidates advancing to the next stage, meaning the additional personal data — birth dates and scores — was disclosed unlawfully and unnecessarily. This case illustrates how public institutions can inadvertently breach data protection law through procedurally familiar actions (posting results) without reviewing what data is legally permissible to share. The financial and reputational consequences are real even when no malicious actor is involved, underscoring that privacy violations do not require a cyberattack to cause harm.