[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3bmTMYE9Xqctrlrm8ypBXiMfH-biAIUdUwvpknyga5c":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"16e00870-a13d-42f0-bccf-b704c09768c6","Garante per la protezione dei dati personali (Italy) - 551\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-551-2026-450168","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color= |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=551\u002F2026 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10287326 |Original_Source_Language_1=Italian |Original_Source_L...\" Show changes","The Italian DPA has fined the Bologna University Hospital IRCCS €10,000 for violating GDPR. The hospital published personal data of individuals, including their eligibility status for an income-based selection process, on its website and had it indexed by Google. The DPA found this processing unlawful as the hospital failed to identify a sufficient legal basis for the publication, especially concerning potentially sensitive data related to disability.","Italy's DPA fines Bologna University Hospital €10,000 for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_551\u002F2026&diff=52932&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-08T08:38:58+00:00","2026-09-08T10:00:13.925103+00:00",7,[17,20],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Bologna University Hospital IRCCS","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":67},"italian-hospital-fined-10000-for-unlawfully-publishing-sensitive-personal-data-online","Italian Hospital Fined €10,000 for Unlawfully Publishing Sensitive Personal Data Online","Bologna University Hospital IRCCS violated GDPR by publishing individuals' personal data — including disability-related eligibility status — on its public website without a valid legal basis, where it was subsequently indexed by Google. The root cause reflects a failure in data governance: staff responsible for publishing content did not assess whether a lawful basis existed before making sensitive data publicly accessible. This matters because health and disability-related data constitutes a special category under GDPR Article 9, attracting stricter protections and higher regulatory scrutiny. The incident demonstrates that public-sector organizations must treat web publication as a data processing activity requiring the same rigorous legal review as any other form of data sharing.",[56,57,58,59,60,61,62,63,64,65,66],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 35 – Data Protection Impact Assessment","NIST SP 800-53 AC-22 (Publicly Accessible Content)","NIST SP 800-53 RA-3 (Risk Assessment)","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 Annex A 5.12 – Classification of Information","ISO\u002FIEC 27701 – Privacy Information Management",{}]