Garante per la protezione dei dati personali (Italy) - 550/2026
Italy's Garante fines Bologna University Hospital €30,000 for unlawfully publishing personal data.
Italy's Garante per la protezione dei dati personali has fined the Bologna University Hospital IRCCS €30,000 for unlawfully disclosing the personal data of approximately 700 individuals. The hospital published a ranking list as part of a recruitment procedure on its website, which included the names of candidates. Despite a data subject's request for erasure, the hospital refused, citing national transparency requirements and a 5-year disclosure period.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Bologna University Hospital IRCCS?
Get an email when a new story names Bologna University Hospital IRCCS, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBologna University Hospital IRCCS published a recruitment ranking list containing candidates' personal data on its public website and then refused a legitimate erasure request, citing national transparency laws as justification. The core failure was a misapplication of the balancing test between transparency obligations and GDPR data subject rights — national transparency rules do not automatically override the right to erasure where less invasive alternatives exist. This case highlights that publishing personal data beyond what is strictly necessary for the stated purpose (e.g., including full names when anonymised rankings could suffice) constitutes an unlawful disclosure. Organisations must proactively assess whether competing legal bases are genuinely in conflict before refusing data subject requests, as regulators will not accept blanket deferrals to transparency law.