[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU1wFAuITySbvpsSr-qh9aRmHTA5FhoIwbUdv-V9_tdU":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"c937c23d-62ea-483f-9b4c-e2b24180bc40","Garante per la protezione dei dati personali (Italy) - 10309500-n.761","garante-per-la-protezione-dei-dati-personali-italy-10309500-n-761-b4a71e","← Older revision Revision as of 09:38, 10 November 2026 Line 107: Line 107: === Holding === === Holding === The DPA held that public authorities could process personal data when necessary to comply with a legal obligation or perform a task in the public interest under Article 6(1)(c) or (e) GDPR and that under Article 6(2) and (3) GDPR, the legal basis should be laid down in national or EU law. The applicable national law authorised the publication of names of candidates admitted to the oral examination but not the disclosure of personal data of unsuccessful candidates. Therefore, the controller made the personal data of data subjects available without a legal basis. The DPA held that public authorities could process personal data when necessary to comply with a legal obligation or perform a task in the public interest under [[Article 6 GDPR|Article 6(1)(c) or (e) GDPR]] and that under [[Article 6 GDPR|Article 6(2) and (3) GDPR]], the legal basis should be laid down in national or EU law. The applicable national law authorised the publication of names of candidates admitted to the oral examination but not the disclosure of personal data of unsuccessful candidates. Therefore, the controller made the personal data of data subjects available without a legal basis. The DPA also held that candidates' date of birth and examination scores were not necessary to announce which candidates had been successful. Therefore, the controller infringed the principle of lawfulness, fairness and transparency ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) and the principle of data minimisation (Article 5(1)(c). The DPA also held that candidates' date of birth and examination scores were not necessary to announce which candidates had been successful. Therefore, the controller infringed the principle of lawfulness, fairness and transparency ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) and the principle of data minimisation [[Article 5 GDPR|(Article 5(1)(c) GDPR)]] . The DPA fined the Ministry of Justice €20.000. The DPA fined the Ministry of Justice €20.000.","The Italian Data Protection Authority (Garante) fined the Ministry of Justice €20,000 for unlawfully processing personal data of notary candidates. The Ministry published a list with candidates' names, dates of birth, and examination scores in a public area, lacking a legal basis and violating data minimization principles.","Italian DPA fines Ministry of Justice €20,000 for unlawful processing of candidate data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10309500-n.761&diff=53665&oldid=53663","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-11-10T09:38:14+00:00","2026-11-10T10:00:45.122667+00:00",7,[17],{"name":18,"type":19},"Ministry of Justice","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":41,"vendors":42},[],[],{"slug":44,"title":45,"body":46,"framework_refs":47,"framework_notes":54},"italian-ministry-of-justice-fined-for-unlawfully-publishing-notary-candidates-personal-data","Italian Ministry of Justice Fined for Unlawfully Publishing Notary Candidates' Personal Data","The Italian Ministry of Justice exposed personal data — including names, dates of birth, and examination scores — by publishing a candidate list in a publicly accessible area without a valid legal basis. This violated the GDPR's data minimization principle, which requires that only the minimum necessary personal data be processed for a specific, legitimate purpose. The incident illustrates how even government entities can commit data protection violations through procedurally routine actions, such as publishing exam results, without adequate legal review. It matters because public exposure of personal data, even when seemingly innocuous, can harm individuals' privacy and erode public trust in state institutions.",[48,49,50,51,52,53],"GDPR Article 32","GDPR Article 5","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 5":55,"GDPR Article 32":56,"NIST SP 800-53 SI-2: Flaw Remediation":57,"CIS Control 14: Security Awareness and Skills Training":58,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":59,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":60},"Article 5's data minimization and purpose limitation principles directly prohibit publishing more personal data than necessary — in this case, dates of birth and scores were excessive for a public notice.","Article 32 requires appropriate technical and organisational measures to ensure data security; a formal review process before public publication would have prevented the unlawful disclosure of candidates' personal data.","The absence of a pre-publication data review process represents a procedural flaw; a systematic remediation framework would mandate corrective controls before any personal data is made publicly accessible.","Staff responsible for publishing the candidate list lacked awareness of GDPR data minimization requirements; targeted training would have prevented the unlawful publication.","While procedural rather than technical, this control's spirit of identifying and remediating weaknesses in information handling applies — a governance gap in publication procedures allowed unlawful data exposure.","Proper access control governance — restricting who can authorize public release of personal data and requiring DPO sign-off — would have served as a safeguard against this unauthorized disclosure."]