[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH3OnAhzPu8mykFU5VgAAmyUafEEe0_a55IVYdgJYtGs":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"d10e6f7c-6516-4354-ab3f-0d1c85e7b33e","Garante per la protezione dei dati personali (Italy) - 471\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-471-2026-f3655a","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color=background-color:#095d7e; |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=471\u002F2026 |ECLI= |Original_Source_Name_1=GPDP |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10268727 |Original_Source_Language_1=Italian |Original_Source_Language__Code_1=...\" Show changes","The Italian Data Protection Authority (Garante per la protezione dei dati personali) has fined the provincial Health Authority of Enna €20,000. The fine was issued for unlawfully publishing personal data related to a data subject's judicial records and for failing to fully remove the information from its website upon request, violating Articles 5, 6, and 10 of the GDPR.","Italian DPA fines health authority €20,000 for unlawful data publication.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_471\u002F2026&diff=52201&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-07-14T08:05:31+00:00","2026-07-14T10:00:13.567324+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"GDPR","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":21,"slug":26},null,"gdpr",[28,33,35,40],{"category":29},{"id":30,"icon":25,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":23,"icon":25,"name":21,"slug":26},{"category":36},{"id":37,"icon":25,"name":38,"slug":39},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":67},"italian-health-authority-fined-20000-for-unlawful-publication-of-judicial-records-1784028021580","Italian Health Authority Fined €20,000 for Unlawful Publication of Judicial Records","The provincial Health Authority of Enna violated GDPR by publishing a data subject's judicial records on its public website without a lawful basis, breaching the core principles of lawfulness, fairness, and transparency under Article 5. Compounding the violation, the authority failed to fully remove the data upon the subject's request, demonstrating a breakdown in both data governance and incident response processes. Sensitive judicial data carries heightened protection requirements under Article 10 of GDPR, making unauthorized disclosure especially serious. This case highlights that public sector bodies must treat personal data publication with rigorous pre-approval controls and must be capable of responding swiftly and completely to takedown requests.",[55,56,57,58,59,60,61,62,63,64,65,66],"GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 6 – Lawfulness of processing","GDPR Article 10 – Processing of criminal convictions and offences data","GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 25 – Data protection by design and by default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 SI-12 – Information Management and Retention","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001 A.18.1 – Compliance with legal and contractual requirements","ITIL Service Operation – Incident Management (data breach response)",{}]