[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW452lftbBYblBJ4Q7UtPgwb9eb0O2yoc8-hTCwbjjKc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":46},"2bf20826-cfe6-480b-931f-d3f0df61065d","italian-ministry-of-justice-fined-for-unlawfully-publishing-notary-candidates-personal-data","c937c23d-62ea-483f-9b4c-e2b24180bc40","Italian Ministry of Justice Fined for Unlawfully Publishing Notary Candidates' Personal Data","The Italian Ministry of Justice exposed personal data — including names, dates of birth, and examination scores — by publishing a candidate list in a publicly accessible area without a valid legal basis. This violated the GDPR's data minimization principle, which requires that only the minimum necessary personal data be processed for a specific, legitimate purpose. The incident illustrates how even government entities can commit data protection violations through procedurally routine actions, such as publishing exam results, without adequate legal review. It matters because public exposure of personal data, even when seemingly innocuous, can harm individuals' privacy and erode public trust in state institutions.","**Immediate actions:**\n- Conduct an urgent audit of all publicly accessible documents and portals to identify and remove any personal data published without a valid legal basis.\n- Replace full personal identifiers (e.g., dates of birth) with anonymized or pseudonymized alternatives (e.g., candidate reference numbers) where full identification is not legally required.\n\n**Policy and governance improvements:**\n- Establish a mandatory Data Protection Impact Assessment (DPIA) review process before any personal data is published or made publicly accessible.\n- Define and document the legal basis for every data processing activity, including routine administrative publications, in a formal data processing register.\n- Train all staff involved in data publication workflows on GDPR data minimization and purpose limitation principles.\n\n**Detection and accountability measures:**\n- Implement periodic reviews by the Data Protection Officer (DPO) of all public-facing information systems and published datasets.\n- Create an internal sign-off checklist requiring DPO approval before any list or document containing personal data is released to the public.",[12,13,14,15,16,17],"GDPR Article 32","GDPR Article 5","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 5":19,"GDPR Article 32":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 14: Security Awareness and Skills Training":22,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":23,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":24},"Article 5's data minimization and purpose limitation principles directly prohibit publishing more personal data than necessary — in this case, dates of birth and scores were excessive for a public notice.","Article 32 requires appropriate technical and organisational measures to ensure data security; a formal review process before public publication would have prevented the unlawful disclosure of candidates' personal data.","The absence of a pre-publication data review process represents a procedural flaw; a systematic remediation framework would mandate corrective controls before any personal data is made publicly accessible.","Staff responsible for publishing the candidate list lacked awareness of GDPR data minimization requirements; targeted training would have prevented the unlawful publication.","While procedural rather than technical, this control's spirit of identifying and remediating weaknesses in information handling applies — a governance gap in publication procedures allowed unlawful data exposure.","Proper access control governance — restricting who can authorize public release of personal data and requiring DPO sign-off — would have served as a safeguard against this unauthorized disclosure.","published","2026-11-10T10:22:06.654452+00:00","2026-11-10T10:22:06.628+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10309500-n.761&diff=53665&oldid=53663","garante-per-la-protezione-dei-dati-personali-italy-10309500-n-761-b4a71e","Garante per la protezione dei dati personali (Italy) - 10309500-n.761",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]