Garante per la protezione dei dati personali (Italy) - 551/2026
Italy's DPA fines Bologna University Hospital €10,000 for GDPR violations.
The Italian DPA has fined the Bologna University Hospital IRCCS €10,000 for violating GDPR. The hospital published personal data of individuals, including their eligibility status for an income-based selection process, on its website and had it indexed by Google. The DPA found this processing unlawful as the hospital failed to identify a sufficient legal basis for the publication, especially concerning potentially sensitive data related to disability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBologna University Hospital IRCCS violated GDPR by publishing individuals' personal data — including disability-related eligibility status — on its public website without a valid legal basis, where it was subsequently indexed by Google. The root cause reflects a failure in data governance: staff responsible for publishing content did not assess whether a lawful basis existed before making sensitive data publicly accessible. This matters because health and disability-related data constitutes a special category under GDPR Article 9, attracting stricter protections and higher regulatory scrutiny. The incident demonstrates that public-sector organizations must treat web publication as a data processing activity requiring the same rigorous legal review as any other form of data sharing.