[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f526ji-ZCa7kYkMCpf_0FyNM__iYDTgluYyW5IB-D9lc":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":67},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"bc29e5ae-a22a-48c2-8ac6-3c6743cbf88a","Garante per la protezione dei dati personali (Italy) - 471\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-471-2026-efe0b0","← Older revision Revision as of 08:07, 14 July 2026 Line 7: Line 7: |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=471\u002F2026 |Case_Number_Name=Case number: 471\u002F2026 Internal number (from the DPA): 10268727 |ECLI= |ECLI= Line 81: Line 82: === Holding === === Holding === The DPA found a violation of Articles 5, 6 and 10 GDPR. The DPA first clarified that the controller processed data related to the commission of crimes or pending criminal proceedings involving the data subject. This data fell under the scope of [[Article 10 GDPR|Article 10 GDPR]], meaning the controller had specific obligations for the processing activity to be lawful. The DPA considered that the controller had processed this data unlawfully by publishing it, and had failed to comply with the principle of lawfulness (Article 5(1)(a) GDPR) and data minimisation (Article 5(1)(c) GDPR). The DPA found a violation of [[Article 5 GDPR|Articles 5]], [[Article 6 GDPR|6]] and [[Article 10 GDPR|10 GDPR]]. The DPA first clarified that the controller processed data related to the commission of crimes or pending criminal proceedings involving the data subject. This data fell under the scope of [[Article 10 GDPR]], meaning the controller had specific obligations for the processing activity to be lawful. The DPA considered that the controller had processed this data unlawfully by publishing it, and had failed to comply with the principle of lawfulness ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) and data minimisation ([[Article 5 GDPR|Article 5(1)(c) GDPR]]). The DPA also found a violation of [[Article 17 GDPR|Article 17 GDPR]]. The DPA stated that the controller failed to adequately respond to the data subject’s request for erasure by not recognising that the data remained visible in a different section of its website. The DPA also found a violation of [[Article 17 GDPR]]. The DPA stated that the controller failed to adequately respond to the data subject’s request for erasure by not recognising that the data remained visible in a different section of its website. The DPA fined the controller €20,000. The DPA fined the controller €20,000.","Italy's Garante per la protezione dei dati personali has fined the provincial Health Authority of Enna €20,000 for violating GDPR. The authority unlawfully published a resolution containing a data subject's judicial records and failed to adequately remove the data upon request, breaching principles of lawfulness, data minimisation, and the right to erasure.","Italian DPA fines health authority €20,000 for unlawful data publication.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_471\u002F2026&diff=52202&oldid=52201","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-07-14T08:07:32+00:00","2026-07-14T10:00:13.567324+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":66},[49],{"slug":50,"name":51,"problem":52,"products":53},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[54,60],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":55,"product_name":56,"url":58,"description":59},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":61,"product_name":62,"url":64,"description":65},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":68,"title":69,"body":70,"framework_refs":71,"framework_notes":83},"italian-health-authority-fined-20000-for-unlawful-publication-of-judicial-records","Italian Health Authority Fined €20,000 for Unlawful Publication of Judicial Records","The provincial Health Authority of Enna published a resolution containing a data subject's judicial records without a lawful basis, violating GDPR's core principles of lawfulness and data minimisation. Compounding the breach, the authority failed to adequately fulfil the data subject's right to erasure, demonstrating weak internal processes for handling sensitive personal data. This case highlights that public bodies handling health and judicial data must apply strict controls over what is published in official documents and maintain clear, enforceable procedures for responding to erasure requests. The financial and reputational consequences of such failures underscore the importance of embedding privacy-by-design practices into document management workflows.",[72,73,74,75,76,77,78,79,80,81,82],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 10 – Processing of personal data relating to criminal convictions","GDPR Article 37–39 – Data Protection Officer obligations","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","NIST SP 800-53 SI-12 – Information Management and Retention","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and protection of PII","ITIL Service Management – Continual Improvement (audit and review cycles)",{}]