Garante per la protezione dei dati personali (Italy) - 553/2026

Summary

Italy's data protection authority, the Garante, has fined the Ministry of Education and Merit €10,000 for unlawfully processing an employee's personal data. The ministry notified various administrative branches about the employee's dismissal, including details like name, birth information, and the disciplinary sanction. The Garante found no sufficient legal basis for this broad notification, stating that national law requires individuals to declare they haven't been dismissed, a claim that is verifiable.

Full text

Help Garante per la protezione dei dati personali (Italy) - 553/2026: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 10:15, 9 September 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators59 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 10:15, 9 September 2026 Garante per la protezione dei dati personali - 553/2026 Authority: Garante per la protezione dei dati personali (Italy) Jurisdiction: Italy Relevant Law: Article 5(1)(a) GDPR Article 6(1)(c) GDPR Article 6(1)(e) GDPR Article 6(2) GDPR Article 6(3) GDPR Type: Complaint Outcome: n/a Started: Decided: Published: Fine: 10000.0 EUR Parties: n/a National Case Number/Name: 553/2026 European Case Law Identifier: n/a Appeal: n/a Original Language(s): Italian Original Source: Garante per la protezione dei dati personali (in IT) Initial Contributor: sf The DPA fined the Ministry of Education and Merit €10.000 for unlawfully processing the data subject’s personal data concerning her dismissal by notifying various administrative branches. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The data subject, an employee of the Ministry of Education and Merit (the controller), filed a complaint with the DPA after the controller notified various administrative branches of her dismissal. The DPA started an investigation and found that the controller had notified all public schools within the Monza and Brianza Territorial Area, the Teacher and ATA Ranking Offices and the Pensions Office of the data subject’s name, place and date of birth, job title, and disciplinary sanction imposed following disciplinary proceedings. The controller underscored that the Regional School Offices and Territorial Offices which lack legal autonomy and the Educational Institutions which has autonomy, are branches and subordinate of the same singular school administration of the controller. The controller deemed the notice of termination as necessary, and the only way to ensure that dismissed employees are prevented from entering into employment contracts within the school administration. Particularly, the controller emphasised that pursuant to national law, giving notice of termination without reference to the disciplinary dismissal does not suffice to preclude the data subject from being rehired. Especially as a prevention mechanism against fraudulent inclusion of dismissed personnel where individuals who have been dismissed fail to disclose the reasons for termination. Holding The DPA held that the controller did not sufficiently identify a legal obligation within national regulations which provides the notification to other branches of the school administration, of the imposition of disciplinary measures. Especially because national law imposes the obligation on individuals participating in a selection procedure to declare that they have not been dismissed before, and this declaration is verifiable. Additionally, the DPA found the mere possibility that a dismissed employee may apply for another selection procedure is hypothetical, and thus the processing as in the case of the data subject was undertaken by the controller in absence of a legal basis. In reference to the declaration by the controller that the Regional School Offices, Territorial Offices and the Educational Institutions are branches and subordinates and thus notification of the data subject’s dismissal was permitted, was not accepted by the DPA. Namely, as the DPA maintained that as a general rule the personal data of employees pertaining to their employment relationship may not be disclosed to parties other than those involved in the employment relationship. Moreover, as independent controllers they were not authorised to process such data and thus are third parties for the purposes of personal data protection. Furthermore, the DPA found that in light of the principles of necessity and data minimisation it would have been sufficient if the controller provided only notice of the termination without details on the proceedings which led to the data subject’s dismissal. This was considered in light of the fact that the information made available to various recipients could have had significant adverse effects on the data subject. Thus, the DPA found the controller in violation of Article 5(1)(a) GDPR and Article 6(1)(c), (e), 6(2) and 6(3) GDPR and correspondingly imposed a €10.000 fine on the controller. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details. [Web Doc. No. 10287373] Decision of July 23, 2026 Register of Decisions No. 553 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (hereinafter “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having regard to the documentation on file; Having regard to the observations made by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Pasquale Stanzione; PREAMBLE 1. Introduction. In a complaint filed pursuant to Article 77 of the Regulation, Ms. XX, an employee of the Ministry of Education and Merit classified in the ATA staff category, alleged a violation of the regulations governing data protection. Specifically, it was alleged that, after being the recipient of a disciplinary dismissal decision issued by the Disciplinary Proceedings Office (UPD) of the Monza and Brianza Territorial School Office, numerous branches of the Administration (namely, all regional school offices; all schools within the territorial area; the teacher and ATA ranking office; the teacher and ATA appointment office; and the pension office) had been notified of the dismissal via email. 2. The Preliminary Investigation. In response to a request for information made pursuant to Art. 157 of the Code (see note ref. no. XX dated XX), the Ministry of Education and Merit—Regional School Office for Lombardy, in a letter dated XX (Ref. No. XX), stated, in particular, that: - “the [UPD], by order Ref. No. XX dated XX, imposed on the [complainant…] the penalty of dismissal with notice pursuant to Article 25, paragraph 9, Chapter I, subparagraphs (a) and (g) of the National Collective Bargaining Agreement for the Education and Research Sector for the 2019–2021 three-year period”; - t

Entities