Italian Energy Giant Fined €96K for Publishing Personal Data in Legal Documents

Eni S.p.A. was fined for publishing unredacted personal information including names, addresses, and social security numbers in a public lawsuit statement without legal basis. The company's claim of 'human error' and legitimate interest in protecting its reputation was rejected by Italy's Data Protection Authority. This case demonstrates that even inadvertent disclosure of personal data can result in significant penalties, and that business interests rarely justify exposing sensitive personal information. Organizations must implement proper data handling procedures and systematic redaction processes before publishing any documents publicly.

Tactical Insight

Immediate actions

Establish mandatory document review procedures requiring redaction of personal data before public disclosure
Train legal and communications teams on GDPR requirements for data processing and publication
Create standardized redaction checklists for all external document releases

Process improvements

Implement dual-approval workflows for publishing any documents containing potential personal data
Develop clear data minimization guidelines for legal proceedings and public communications
Establish data protection impact assessments for all public disclosure activities

Oversight measures

Designate data protection officers to review high-risk document publications
Conduct regular audits of published materials to identify potential data exposure
Monitor regulatory guidance on legitimate interests versus data subject rights