[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0gEgl7F68DC0M6fxTX5yPnrH2lce4h__i4hAYaSG7b4":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"c37f877f-bc06-4751-b12b-dcbf2e3b3352","Garante per la protezione dei dati personali (Italy) - 551\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-551-2026-d3529f","← Older revision Revision as of 13:55, 8 September 2026 Line 101: Line 101: A data subject who was deemed ineligible lodged a complaint with the DPA. A data subject who was deemed ineligible lodged a complaint with the DPA. The DPA initiated an investigation and found that the publication was part of the recruitment procedure used in the public sector, within which staff is hired from employment centers into civil service. The procedure was organised according to national provisions which included a provision relating to the publication of the selected candidates. The The DPA initiated an investigation and found that the publication was part of the recruitment procedure used in the public sector, within which staff is hired from employment centers into civil service. The procedure was organised according to national provisions which included a provision relating to the publication of the selected candidates. The selection procedure included questions regarding the disability status and financial situations of the applicants. Pursuant to the investigation, the DPA informed the controller that their processing operations were in violation of Articles 5, 6 and 9 GDPR, particularly that the selection process could associate the data subjects with a general condition of disability, potentially revealing sensitive personal data. The controller emphasised that the eligibility requirements allowed individuals who did not have a disability or face any financial hardship to participate, and that the selection results were published pursuant to national law, which required the publication of competitive examinations. However, in response to the DPA’s notice, the controller deleted the ranking list containing the personal data of the individuals who passed the selection procedure. The controller emphasised that the eligibility requirements allowed individuals who did not have a disability or face any financial hardship to participate, and that the selection results were published pursuant to national law, which required the publication of competitive examinations. However, in response to the DPA’s notice, the controller deleted the ranking list containing the personal data of the individuals who passed the selection procedure. The controller further clarified that the data processed did not fall within the special category nature of [[Article 9 GDPR]], claiming that it did not indicate any sensitive data about the data subject and other participants. Finally, the controller stated that it had taken measures to prevent such unlawful processing from happening again. The controller further clarified that the data processed did not fall within the special category nature of [[Article 9 GDPR]], claiming that it did not indicate any sensitive data about the data subject and other participants. Finally, the controller stated that they have taken measures to prevent such unlawful processing from happening again. === Holding === === Holding === The DPA held that the controller’s reference to national law was irrelevant given the fact that the requirement does not apply to the publishing of ineligible candidates carried out through the placement of individuals registered on employment lists. The DPA clarified that this law applies to the final rankings of the eligible candidates who were not selected as part of a competitive selection procedure, which was not the case. Therefore, the DPA held that the controller did not identify a sufficient legal basis which allowed for this publication on its institutional website, let alone for five years. The DPA held that the national law did not apply to the publishing of ineligible candidates but only of selected candidates.Therefore, the DPA held that the controller did not identify a sufficient legal basis which allowed for this publication on its institutional website, let alone for five years. The DPA also found that the data, together with the selection criteria which included a \"degree of invalidity\" and questions on financial situations, could infer a general condition of disability, potentially revealing sensitive personal data and information on the financial situation of the applicants. The mere participation to the selection procedure could therefore already reveal certain data, in violation of [[Article 9 GDPR]]. The DPA further held that the controller could have implemented measures to anonymise the personal data present on the ranking lists. The DPA found that the mere fact that participating in such a procedure could lead to inference of special category data which may have adverse effects on the data subject, makes the publication of such unlawful in light of [[Article 9 GDPR]]. The DPA further held that the controller could have implemented measures to anonymise the personal data present on the ranking lists. The DPA imposed a €10.000 fine on the controller for publishing the personal data of 90 individuals in violation of [[Article 5 GDPR]], [[Article 6 GDPR]] and [[Article 9 GDPR]]. The DPA imposed a €10.000 fine on the controller for publishing the personal data of 90 individuals in violation of [[Article 5 GDPR|Articles 5]], [[Article 6 GDPR|6]] and [[Article 9 GDPR|9 GDPR]]. == Comment == == Comment ==","Italy's Garante per la protezione dei dati personali (DPA) has fined a public sector entity €10,000 for violating GDPR. The DPA found that the publication of a ranking list containing personal data of 90 individuals, including details that could infer disability and financial situations, was unlawful. The entity's defense that the publication was required by national law was rejected, as the law did not apply to ineligible candidates or the specific context of the publication.","Italy's DPA fines public sector entity €10,000 for unlawful data publication.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_551\u002F2026&diff=52963&oldid=52956","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-08T13:55:42+00:00","2026-09-08T14:00:23.156315+00:00",7,[17],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":63},"italian-dpa-fines-public-entity-for-unlawful-publication-of-sensitive-personal-data","Italian DPA Fines Public Entity for Unlawful Publication of Sensitive Personal Data","A public sector entity in Italy was fined €10,000 after publishing a ranking list that exposed personal data of 90 individuals, including information inferring disability and financial status, without a lawful basis. The entity incorrectly assumed national law justified the publication, failing to properly assess whether that legal basis applied to ineligible candidates or the specific publication context. This case highlights that a legal mandate to publish data does not automatically extend to all personal data within a document, and organisations must conduct granular lawfulness assessments before disclosure. Sensitive categories of data — such as those revealing disability or financial hardship — carry heightened protection obligations under GDPR Articles 9 and 10, making erroneous publication particularly serious.",[53,54,55,56,57,58,59,60,61,62],"GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 6 – Lawfulness of Processing","GDPR Article 9 – Processing of Special Categories of Personal Data","GDPR Article 10 – Processing Relating to Criminal Convictions","NIST SP 800-53 PL-4 (Rules of Behaviour)","NIST SP 800-53 RA-3 (Risk Assessment)","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ITIL – Information Security Management (Confidentiality Controls)","ISO\u002FIEC 27001 Annex A.8.2 – Information Classification",{}]