[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuM7yhFo4_X-KcLOeGntidfBfnNHGF3GP4azLHWmhpKA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"a2f2c4a4-fcc7-4747-bad2-7ac03b05959e","italian-ministry-of-justice-fined-for-excessive-public-disclosure-of-candidate-data","986acdc1-bd83-456b-88fc-f8100a790f09","Italian Ministry of Justice Fined for Excessive Public Disclosure of Candidate Data","The Italian Ministry of Justice publicly displayed the names, dates of birth, and test scores of 1,229 notary exam candidates without a valid legal basis, violating GDPR's data minimization principle. National law only permitted displaying the names of candidates advancing to the next stage, meaning the additional personal data — birth dates and scores — was disclosed unlawfully and unnecessarily. This case illustrates how public institutions can inadvertently breach data protection law through procedurally familiar actions (posting results) without reviewing what data is legally permissible to share. The financial and reputational consequences are real even when no malicious actor is involved, underscoring that privacy violations do not require a cyberattack to cause harm.","**Immediate actions:**\n- Conduct a legal basis review before any public disclosure of personal data to confirm what information is explicitly permitted by law.\n- Remove or redact any personal data from public displays that exceeds what is legally authorized (e.g., show only names of advancing candidates).\n\n**Process & governance improvements:**\n- Establish a mandatory Data Protection Impact Assessment (DPIA) or legal review checklist for all planned public data disclosures.\n- Train staff responsible for publishing results or notices on data minimization principles and the legal scope of permissible disclosure.\n- Designate a Data Protection Officer (DPO) review step before any bulk personal data is made publicly accessible.\n\n**Long-term improvements:**\n- Embed privacy-by-design requirements into standard operating procedures for exam administration and results publication.\n- Conduct periodic audits of existing public-facing disclosures to verify ongoing compliance with applicable data protection law.",[12,13,14,15,16],"GDPR Article 5","GDPR Article 6","NIST SP 800-53 AC-3: Access Enforcement","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personal identifiable information","NIST CSF 2.0 GV.PO-01: Policy",{"GDPR Article 5":18,"GDPR Article 6":19,"NIST CSF 2.0 GV.PO-01: Policy":20,"NIST SP 800-53 AC-3: Access Enforcement":21,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personal identifiable information":22},"Article 5(1)(c) mandates the data minimization principle, which the Ministry violated by displaying birth dates and test scores beyond what national law permitted.","Article 6 requires a valid legal basis for every processing activity, and the DPA found the Ministry had no lawful basis for publicly disclosing the additional personal data.","This category requires that organizational policies for data handling be established and enforced, which would have prevented disclosure of personal data beyond the legally authorized scope.","AC-3 requires enforcing approved authorizations for disclosing information, which maps to the Ministry's failure to restrict public disclosure to only what law permitted.","This control requires organizations to identify and comply with applicable legal requirements for privacy and PII protection, which the Ministry failed to apply before publishing candidate data.","published","2026-11-10T17:22:06.575421+00:00","2026-11-10T17:22:06.561+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10309500-n.761&diff=53674&oldid=53665","garante-per-la-protezione-dei-dati-personali-italy-10309500-n-761-8dd558","Garante per la protezione dei dati personali (Italy) - 10309500-n.761",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]