Garante per la protezione dei dati personali (Italy) - 10254256
Italian DPA finds Ministry of Justice violated GDPR by improperly disclosing employee health data.
The Italian Data Protection Authority (Garante) ruled that the Ministry of Justice violated GDPR by publicly posting a service order that contained sensitive health information about an employee. The order, which detailed the employee's need for posture alternation due to physical conditions, was displayed on a noticeboard accessible to all staff and sent to trade unions, exposing the data to unauthorized individuals. The DPA found this to be a breach of Articles 5(1)(a), 6, and 9 of GDPR, as well as Article 2-ter of the Italian Data Protection Code, emphasizing that such health data requires a specific legal basis for processing and should only be accessible to authorized personnel.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Italian Ministry of Justice?
Get an email when a new story names Italian Ministry of Justice, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Italian Ministry of Justice violated GDPR by posting a service order containing an employee's sensitive health information on a publicly visible noticeboard and distributing it to trade unions without a valid legal basis. Health data is classified as a 'special category' under GDPR Article 9, requiring explicit justification and strict access controls that were clearly absent here. The failure stems from a lack of data classification awareness among staff who handled the document, combined with inadequate procedures for reviewing what information can be shared and with whom. This case illustrates that GDPR breaches do not require a cyberattack — routine administrative processes can expose sensitive data just as harmfully. Organizations must treat physical and procedural data handling with the same rigor as digital security controls.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.