Italian Ministry of Justice Fined for Excessive Public Disclosure of Candidate Data
Written by AI from the linked story. Not reviewed by an editor. How this works
The Italian Ministry of Justice publicly displayed the names, dates of birth, and test scores of 1,229 notary exam candidates without a valid legal basis, violating GDPR's data minimization principle. National law only permitted displaying the names of candidates advancing to the next stage, meaning the additional personal data — birth dates and scores — was disclosed unlawfully and unnecessarily. This case illustrates how public institutions can inadvertently breach data protection law through procedurally familiar actions (posting results) without reviewing what data is legally permissible to share. The financial and reputational consequences are real even when no malicious actor is involved, underscoring that privacy violations do not require a cyberattack to cause harm.
Tactical Insight
Immediate actions
- Conduct a legal basis review before any public disclosure of personal data to confirm what information is explicitly permitted by law.
- Remove or redact any personal data from public displays that exceeds what is legally authorized (e.g., show only names of advancing candidates).
Process & governance improvements
- Establish a mandatory Data Protection Impact Assessment (DPIA) or legal review checklist for all planned public data disclosures.
- Train staff responsible for publishing results or notices on data minimization principles and the legal scope of permissible disclosure.
- Designate a Data Protection Officer (DPO) review step before any bulk personal data is made publicly accessible.
Long-term improvements
- Embed privacy-by-design requirements into standard operating procedures for exam administration and results publication.
- Conduct periodic audits of existing public-facing disclosures to verify ongoing compliance with applicable data protection law.