Garante per la protezione dei dati personali (Italy) - 471/2026

The provincial Health Authority of Enna published a resolution containing a data subject's judicial records without a lawful basis, violating GDPR's core principles of lawfulness and data minimisation. Compounding the breach, the authority failed to adequately fulfil the data subject's right to erasure, demonstrating weak internal processes for handling sensitive personal data. This case highlights that public bodies handling health and judicial data must apply strict controls over what is published in official documents and maintain clear, enforceable procedures for responding to erasure requests. The financial and reputational consequences of such failures underscore the importance of embedding privacy-by-design practices into document management workflows.