Garante per la protezione dei dati personali (Italy) - 471/2026
Italian DPA fines health authority €20,000 for unlawful data publication.
The Italian Data Protection Authority (Garante per la protezione dei dati personali) has fined the provincial Health Authority of Enna €20,000. The fine was issued for unlawfully publishing personal data related to a data subject's judicial records and for failing to fully remove the information from its website upon request, violating Articles 5, 6, and 10 of the GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe provincial Health Authority of Enna violated GDPR by publishing a data subject's judicial records on its public website without a lawful basis, breaching the core principles of lawfulness, fairness, and transparency under Article 5. Compounding the violation, the authority failed to fully remove the data upon the subject's request, demonstrating a breakdown in both data governance and incident response processes. Sensitive judicial data carries heightened protection requirements under Article 10 of GDPR, making unauthorized disclosure especially serious. This case highlights that public sector bodies must treat personal data publication with rigorous pre-approval controls and must be capable of responding swiftly and completely to takedown requests.