Garante per la protezione dei dati personali (Italy) - 10309500-n.761
Italian DPA fines Ministry of Justice €20,000 for unlawful processing of candidate data.
The Italian Data Protection Authority (Garante) fined the Ministry of Justice €20,000 for unlawfully processing personal data of notary candidates. The Ministry published a list with candidates' names, dates of birth, and examination scores in a public area, lacking a legal basis and violating data minimization principles.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ministry of Justice?
Get an email when a new story names Ministry of Justice, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Italian Ministry of Justice exposed personal data — including names, dates of birth, and examination scores — by publishing a candidate list in a publicly accessible area without a valid legal basis. This violated the GDPR's data minimization principle, which requires that only the minimum necessary personal data be processed for a specific, legitimate purpose. The incident illustrates how even government entities can commit data protection violations through procedurally routine actions, such as publishing exam results, without adequate legal review. It matters because public exposure of personal data, even when seemingly innocuous, can harm individuals' privacy and erode public trust in state institutions.