Garante per la protezione dei dati personali (Italy) - 551/2026
Italy's DPA fines public sector entity €10,000 for unlawful data publication.
Italy's Garante per la protezione dei dati personali (DPA) has fined a public sector entity €10,000 for violating GDPR. The DPA found that the publication of a ranking list containing personal data of 90 individuals, including details that could infer disability and financial situations, was unlawful. The entity's defense that the publication was required by national law was rejected, as the law did not apply to ineligible candidates or the specific context of the publication.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA public sector entity in Italy was fined €10,000 after publishing a ranking list that exposed personal data of 90 individuals, including information inferring disability and financial status, without a lawful basis. The entity incorrectly assumed national law justified the publication, failing to properly assess whether that legal basis applied to ineligible candidates or the specific publication context. This case highlights that a legal mandate to publish data does not automatically extend to all personal data within a document, and organisations must conduct granular lawfulness assessments before disclosure. Sensitive categories of data — such as those revealing disability or financial hardship — carry heightened protection obligations under GDPR Articles 9 and 10, making erroneous publication particularly serious.