Italian Ministry of Justice Fined for Publicly Displaying Notary Candidates' Personal Data Without Legal Basis
Written by AI from the linked story. Not reviewed by an editor. How this works
The Italian Ministry of Justice publicly displayed the names, dates of birth, and test scores of 1,229 notary candidates in its entrance hall without a valid legal basis for such broad disclosure. This violated the GDPR's data minimization principle, which requires that only data strictly necessary for the stated purpose be processed and shared. Publishing excessive personal details — including birth dates and test results — went far beyond what was needed to inform candidates of their pass/fail status. This incident demonstrates that physical and administrative data handling practices carry the same legal weight as digital ones. Organizations must assess the lawfulness and proportionality of every data disclosure, regardless of its medium.
Tactical Insight
Immediate actions
- Conduct a rapid audit of all current and planned public disclosures (physical and digital) to verify they have an identified legal basis under GDPR.
- Replace full personal data displays with minimized alternatives, such as candidate reference numbers, to announce results while protecting privacy.
Policy and governance improvements
- Establish a mandatory Data Protection Impact Assessment (DPIA) process for any activity that publicly discloses personal data, including physical notice boards and printed lists.
- Define and enforce a data minimization checklist that must be signed off by a Data Protection Officer before any candidate or personal information is published.
- Train all staff involved in administrative and examination processes on GDPR obligations, including the principles of lawfulness, purpose limitation, and data minimization.
Long-term structural controls
- Implement a formal data classification policy that flags personal data disclosures for legal review prior to publication in any format.
- Establish periodic compliance reviews of routine administrative practices to identify legacy processes that may not align with current data protection law.