[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzNvRtyDekH2Rtoy9d55fbdutFi268vbSLfREsD-2G4Y":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":106},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"e07feeb8-84f6-4201-9bf7-8c76c53a348c","Garante per la protezione dei dati personali (Italy) - 551\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-551-2026-cf9645","← Older revision Revision as of 14:47, 8 September 2026 Line 92: Line 92: }} }} The DPA found the Bologna University Hospital IRCCS in violation of Articles 5, 6, and 9 GDPR for disclosing the personal data of the data subject’s and 95 other individuals on their institutional website. The DPA found the Bologna University Hospital IRCCS in violation of [[Article 5 GDPR|Articles 5]], [[Article 6 GDPR|6]], and [[Article 9 GDPR|9 GDPR]] for disclosing the personal data of the data subject’s and 95 other individuals on their institutional website. == English Summary == == English Summary ==","Italy's Garante per la protezione dei dati personali has fined the Bologna University Hospital IRCCS €10,000 for violating GDPR. The hospital published a list of candidates, including their eligibility status and potentially sensitive data, on its website and it was indexed by Google. The DPA found the publication of ineligible candidates was not covered by national law and lacked a sufficient legal basis.","Italy's DPA fines Bologna University Hospital €10,000 for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_551\u002F2026&diff=52969&oldid=52963","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-08T14:47:18+00:00","2026-09-08T16:00:15.186474+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"Google","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":105},[50,79],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":80,"name":81,"problem":82,"products":83},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[84,89,97],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":85,"product_name":86,"url":87,"description":88},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":107,"title":108,"body":109,"framework_refs":110,"framework_notes":122},"italian-hospital-fined-10000-for-unlawful-publication-of-candidate-data-on-public-website","Italian Hospital Fined €10,000 for Unlawful Publication of Candidate Data on Public Website","Bologna University Hospital IRCCS violated GDPR by publishing a candidate eligibility list on its public website, which was subsequently indexed by Google, exposing potentially sensitive personal data without a valid legal basis. The core failure was a lack of proper legal review before publication — national law did not authorize the disclosure of ineligible candidates' data, meaning the hospital processed personal data unlawfully under GDPR Article 6. This case highlights how routine administrative processes, such as publishing recruitment results, can become significant data protection violations when legal basis and data minimization principles are ignored. The additional harm caused by Google indexing the data amplifies the breach, as removal from search engine caches is difficult and time-consuming once public exposure occurs.",[111,112,113,114,115,116,117,118,119,120,121],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 6 – Lawfulness of processing","GDPR Article 13 – Information to be provided to data subjects","GDPR Article 83(4) – Administrative fines","NIST SP 800-53 AC-22 – Publicly Accessible Content","NIST SP 800-53 RA-3 – Risk Assessment","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 A.5.33 – Protection of records","ITIL 4 – Information Security Management Practice",{}]