Italian Ministry of Justice Fined for Unlawfully Publishing Notary Candidates' Personal Data

Written by AI from the linked story. Not reviewed by an editor. How this works

The Italian Ministry of Justice exposed personal data — including names, dates of birth, and examination scores — by publishing a candidate list in a publicly accessible area without a valid legal basis. This violated the GDPR's data minimization principle, which requires that only the minimum necessary personal data be processed for a specific, legitimate purpose. The incident illustrates how even government entities can commit data protection violations through procedurally routine actions, such as publishing exam results, without adequate legal review. It matters because public exposure of personal data, even when seemingly innocuous, can harm individuals' privacy and erode public trust in state institutions.

Tactical Insight

Immediate actions

Conduct an urgent audit of all publicly accessible documents and portals to identify and remove any personal data published without a valid legal basis.
Replace full personal identifiers (e.g., dates of birth) with anonymized or pseudonymized alternatives (e.g., candidate reference numbers) where full identification is not legally required.

Policy and governance improvements

Establish a mandatory Data Protection Impact Assessment (DPIA) review process before any personal data is published or made publicly accessible.
Define and document the legal basis for every data processing activity, including routine administrative publications, in a formal data processing register.
Train all staff involved in data publication workflows on GDPR data minimization and purpose limitation principles.

Detection and accountability measures

Implement periodic reviews by the Data Protection Officer (DPO) of all public-facing information systems and published datasets.
Create an internal sign-off checklist requiring DPO approval before any list or document containing personal data is released to the public.