Italian Health Authority Fined €20,000 for Unlawful Publication of Judicial Records
Written by AI from the linked story. Not reviewed by an editor. How this works
The provincial Health Authority of Enna violated GDPR by publishing a data subject's judicial records on its public website without a lawful basis, breaching the core principles of lawfulness, fairness, and transparency under Article 5. Compounding the violation, the authority failed to fully remove the data upon the subject's request, demonstrating a breakdown in both data governance and incident response processes. Sensitive judicial data carries heightened protection requirements under Article 10 of GDPR, making unauthorized disclosure especially serious. This case highlights that public sector bodies must treat personal data publication with rigorous pre-approval controls and must be capable of responding swiftly and completely to takedown requests.
Tactical Insight
Immediate actions
- Audit all publicly accessible web content for unlawfully published personal or sensitive data and remove any non-compliant records immediately.
- Establish a clear, documented takedown procedure with defined SLAs for responding to data subject removal requests.
Long-term improvements
- Implement a mandatory Data Protection Impact Assessment (DPIA) process before publishing any document containing personal data on public-facing platforms.
- Designate a trained Data Protection Officer (DPO) with authority to review and approve all public content releases involving personal data.
- Create a content lifecycle policy that schedules regular reviews and automatic expiration of published documents containing personal data.
Detection & Monitoring measures
- Deploy automated web crawling tools to periodically scan public websites for inadvertent exposure of personal or sensitive data categories.
- Establish a logging and audit trail for all content published to and removed from public-facing systems to ensure accountability and verifiability.