[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKHTCDiZNM67ijuikY1Rc8JTgV8Pxw9Uv8L-uJeojB3I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49},"7cc113be-ecbe-4441-9dae-15eb7afd9631","italian-hospital-fined-10000-for-publishing-sensitive-recruitment-data-online","289d4e86-b425-4856-891f-3d547a242895","Italian Hospital Fined €10,000 for Publishing Sensitive Recruitment Data Online","Bologna University Hospital IRCCS violated GDPR by publishing personal and sensitive data — including information potentially indicating disability — of 96 individuals on its public website during a recruitment process. The data was indexed by Google, dramatically amplifying its exposure and making removal more complex. This breach highlights the failure to apply data minimisation and purpose limitation principles before publishing documents online. The incident matters because sensitive health-related data carries the highest level of GDPR protection under Article 9, and organisations handling such data must implement rigorous review processes before any public disclosure.","**Immediate actions:**\n- Remove any publicly accessible documents containing personal or sensitive data and submit de-indexing requests to search engines immediately.\n- Conduct an emergency audit of all web-published recruitment, HR, and administrative documents to identify further exposure.\n\n**Policy & Process improvements:**\n- Establish a mandatory pre-publication review checklist that requires data minimisation and redaction of personal\u002Fsensitive data before any document is posted online.\n- Define a clear legal basis and data category assessment (including Article 9 special categories) for every type of data published as part of recruitment processes.\n- Train HR and administrative staff on GDPR obligations, specifically around lawful processing, data minimisation, and the heightened protection required for sensitive data.\n\n**Detection & Monitoring measures:**\n- Implement automated website content scanning tools to detect and alert on the presence of personal identifiers or sensitive data in publicly accessible files.\n- Set up regular scheduled reviews of all publicly indexed organisational web content to catch accidental data exposure before it is reported externally.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5 – Principles relating to processing of personal data (data minimisation, purpose limitation)","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 MP-3 – Media Marking","NIST SP 800-53 SI-12 – Information Management and Retention","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 A.5.12 – Classification of information","ISO\u002FIEC 27001:2022 A.5.13 – Labelling of information","published","2026-09-08T14:22:26.032391+00:00","2026-09-08T14:22:25.098+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_551\u002F2026&diff=52951&oldid=52933","garante-per-la-protezione-dei-dati-personali-italy-551-2026-9918c0","Garante per la protezione dei dati personali (Italy) - 551\u002F2026",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]