[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fav4BrP3Py8hPXEGImH-y8BXw_nx04BaMuHLm48buV7I":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"052eb943-8a7d-419b-861a-c620c0446e7b","Garante per la protezione dei dati personali (Italy) - 550\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-550-2026-4cfb96","Facts: found a typo ← Older revision Revision as of 09:22, 29 September 2026 Line 101: Line 101: The data subject is on complainant amongst approximately 700 individuals whose names got published. The data subject is on complainant amongst approximately 700 individuals whose names got published. The controller responded in time, however refused erasure. This was justified by the necessary transparency requirements embedded in national law. In accordance with the law, the controller had established a 5-year disclosure period of the rankings of candidates which were admitted to the recruitment procedure. The controller responded in time, however it refused erasure. This was justified by the necessary transparency requirements embedded in national law. In accordance with the law, the controller had established a 5-year disclosure period of the rankings of candidates which were admitted to the recruitment procedure. The controller emphasised that this procedure did not include the assessment of worker’s suitability to perform the duties. Rather the procedure consisted of a comparative assessment of qualifications. The controller emphasised that this procedure did not include the assessment of worker’s suitability to perform the duties. Rather the procedure consisted of a comparative assessment of qualifications.","Italy's Garante per la protezione dei dati personali has fined the Bologna University Hospital IRCCS €30,000 for unlawfully disclosing the personal data of approximately 700 individuals. The hospital published a ranking list as part of a recruitment procedure on its website, which included the names of candidates. Despite a data subject's request for erasure, the hospital refused, citing national transparency requirements and a 5-year disclosure period.","Italy's Garante fines Bologna University Hospital €30,000 for unlawfully publishing personal data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_550\u002F2026&diff=53206&oldid=53130","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-29T09:22:58+00:00","2026-09-29T10:00:17.645822+00:00",7,[17],{"name":18,"type":19},"Bologna University Hospital IRCCS","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":22,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":66},"italian-hospital-fined-30k-for-refusing-gdpr-erasure-request-on-recruitment-data","Italian Hospital Fined €30K for Refusing GDPR Erasure Request on Recruitment Data","Bologna University Hospital IRCCS published a recruitment ranking list containing candidates' personal data on its public website and then refused a legitimate erasure request, citing national transparency laws as justification. The core failure was a misapplication of the balancing test between transparency obligations and GDPR data subject rights — national transparency rules do not automatically override the right to erasure where less invasive alternatives exist. This case highlights that publishing personal data beyond what is strictly necessary for the stated purpose (e.g., including full names when anonymised rankings could suffice) constitutes an unlawful disclosure. Organisations must proactively assess whether competing legal bases are genuinely in conflict before refusing data subject requests, as regulators will not accept blanket deferrals to transparency law.",[56,57,58,59,60,61,62,63,64,65],"GDPR Article 5(1)(c) — Data Minimisation","GDPR Article 17 — Right to Erasure","GDPR Article 17(3) — Exceptions to Erasure","GDPR Article 6(1) — Lawfulness of Processing","GDPR Article 58(2)(i) — Supervisory Authority Power to Impose Fines","NIST SP 800-53 IP-1 (Individual Access)","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 3 — Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.34 — Privacy and Protection of PII","ITIL Service Design — Information Security Management",{}]