Garante per la protezione dei dati personali (Italy) - 10254256
Italy's DPA fines Ministry of Justice €12,000 for posting employee's medical details publicly.
Italy's Garante per la protezione dei dati personali has fined the Ministry of Justice €12,000 for unlawfully disclosing an employee's health data. The data subject's service order, which included references to their physical conditions and need for posture alternation, was posted on a canteen bulletin board accessible to all staff. The DPA ruled this constituted a violation of GDPR, classifying the information as health data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ministry of Justice?
Get an email when a new story names Ministry of Justice, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Italian Ministry of Justice violated GDPR by posting a service order containing an employee's health-related information — specifically references to physical conditions and the need for posture alternation — on a canteen bulletin board visible to all staff. Health data is classified as a 'special category' of personal data under GDPR Article 9, requiring a much higher standard of protection and a lawful basis for processing. The root failure was a lack of staff awareness and internal procedures governing how sensitive personal data should be communicated and displayed. This case illustrates that data breaches do not require digital systems — physical handling of personal data carries the same legal obligations and risks. Even a low-tech disclosure can result in regulatory fines, reputational damage, and harm to the affected individual.