[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOecIKdNT4zo0Ql9inRRtoOzKf7lF5bLh6javEszbkhk":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"986acdc1-bd83-456b-88fc-f8100a790f09","Garante per la protezione dei dati personali (Italy) - 10309500-n.761","garante-per-la-protezione-dei-dati-personali-italy-10309500-n-761-8dd558","← Older revision Revision as of 16:09, 10 November 2026 Line 92: Line 92: }} }} The DPA fined the Ministry of Justice €20.000 for publicly displaying the names and test results of notary candidates on a desk in the Ministries entrance hall. According to the DPA, the Ministry lacked a valid legal basis and acted contrary to the principle of data minimisation. The DPA fined the Ministry of Justice €20.000 for publicly displaying the names and test results of notary candidates on a desk in the Ministry's entrance hall. According to the DPA, the Ministry lacked a valid legal basis and acted contrary to the principle of data minimisation. == English Summary == == English Summary ==","The Italian DPA has fined the Ministry of Justice €20,000 for publicly displaying the names, dates of birth, and test scores of 1,229 notary candidates in its entrance hall. The DPA found that the Ministry lacked a valid legal basis for this disclosure and violated data minimization principles, as national law only permitted displaying names of candidates advancing to the next stage.","Italy's DPA fined the Ministry of Justice €20,000 for publicly displaying notary candidate data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10309500-n.761&diff=53674&oldid=53665","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-11-10T16:09:28+00:00","2026-11-10T17:00:29.859024+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"Ministry of Justice","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":56},"italian-ministry-of-justice-fined-for-excessive-public-disclosure-of-candidate-data","Italian Ministry of Justice Fined for Excessive Public Disclosure of Candidate Data","The Italian Ministry of Justice publicly displayed the names, dates of birth, and test scores of 1,229 notary exam candidates without a valid legal basis, violating GDPR's data minimization principle. National law only permitted displaying the names of candidates advancing to the next stage, meaning the additional personal data — birth dates and scores — was disclosed unlawfully and unnecessarily. This case illustrates how public institutions can inadvertently breach data protection law through procedurally familiar actions (posting results) without reviewing what data is legally permissible to share. The financial and reputational consequences are real even when no malicious actor is involved, underscoring that privacy violations do not require a cyberattack to cause harm.",[51,52,53,54,55],"GDPR Article 5","GDPR Article 6","NIST SP 800-53 AC-3: Access Enforcement","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personal identifiable information","NIST CSF 2.0 GV.PO-01: Policy",{"GDPR Article 5":57,"GDPR Article 6":58,"NIST CSF 2.0 GV.PO-01: Policy":59,"NIST SP 800-53 AC-3: Access Enforcement":60,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personal identifiable information":61},"Article 5(1)(c) mandates the data minimization principle, which the Ministry violated by displaying birth dates and test scores beyond what national law permitted.","Article 6 requires a valid legal basis for every processing activity, and the DPA found the Ministry had no lawful basis for publicly disclosing the additional personal data.","This category requires that organizational policies for data handling be established and enforced, which would have prevented disclosure of personal data beyond the legally authorized scope.","AC-3 requires enforcing approved authorizations for disclosing information, which maps to the Ministry's failure to restrict public disclosure to only what law permitted.","This control requires organizations to identify and comply with applicable legal requirements for privacy and PII protection, which the Ministry failed to apply before publishing candidate data."]