Garante per la protezione dei dati personali (Italy) - 491/2026

The newspaper Il Fatto Quotidiano published an article containing sensitive personal and health data of an individual involved in a cable car accident, violating GDPR principles of lawfulness, fairness, and data minimisation. The core failure was a lack of editorial controls and data protection awareness, leading to the disproportionate disclosure of health information that was neither necessary nor proportionate to the journalistic purpose. Even after the article was de-indexed, the DPA determined the initial dissemination had already caused harm, resulting in a €23,750 fine. This case underscores that media organisations are not exempt from GDPR obligations and must carefully evaluate the necessity and proportionality of publishing sensitive personal data. The reputational and legal consequences of such violations highlight why robust data handling policies are essential even in editorial environments.