Garante per la protezione dei dati personali (Italy) - 551/2026

Bologna University Hospital IRCCS violated GDPR by publishing a candidate eligibility list on its public website, which was subsequently indexed by Google, exposing potentially sensitive personal data without a valid legal basis. The core failure was a lack of proper legal review before publication — national law did not authorize the disclosure of ineligible candidates' data, meaning the hospital processed personal data unlawfully under GDPR Article 6. This case highlights how routine administrative processes, such as publishing recruitment results, can become significant data protection violations when legal basis and data minimization principles are ignored. The additional harm caused by Google indexing the data amplifies the breach, as removal from search engine caches is difficult and time-consuming once public exposure occurs.