[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgKWS5_Ljom7bhjJ5ijL4nmry37-RbP9cX3UgC58Mi90":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"4fb59a57-e758-4b53-aefc-b321bccdb65d","italian-hospital-fined-10000-for-publishing-sensitive-candidate-data-online-for-five-years","d07ae836-364f-4694-90c8-aca6a250d9bb","Italian Hospital Fined €10,000 for Publishing Sensitive Candidate Data Online for Five Years","Bologna University Hospital IRCCS published personal data of ineligible job candidates on its public website without a lawful basis, exposing sensitive information for five years before removal. The core failure was the absence of a proper legal justification under GDPR Articles 5, 6, and 9 for processing and publicly disclosing data that could infer special category (sensitive) information. This case highlights how data minimisation and purpose limitation principles are routinely overlooked when publishing administrative or HR-related documents online. The five-year exposure window also indicates a lack of periodic data audits and lifecycle management processes. Even inadvertent or administrative disclosures can constitute serious GDPR violations carrying financial and reputational consequences.","**Immediate actions:**\n- Conduct a full audit of all publicly accessible web pages to identify and remove any personal or sensitive data lacking a clear legal basis.\n- Establish an emergency takedown procedure so improperly published data can be removed within 24–48 hours of discovery.\n\n**Long-term improvements:**\n- Implement a formal data publication review process requiring Data Protection Officer (DPO) sign-off before any personal data is made publicly available.\n- Apply data minimisation principles to all HR and administrative publications, publishing only aggregated or anonymised results where individual identification is not required.\n- Define and enforce data retention schedules for all publicly posted documents, with automated expiry or periodic review triggers.\n\n**Detection & monitoring measures:**\n- Schedule quarterly web content audits to detect lingering personal data that has outlived its legal basis.\n- Deploy web-crawling or content-scanning tools to flag pages containing personal identifiers (names, ID numbers, dates of birth) on public-facing infrastructure.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 17 – Right to erasure ('right to be forgotten')","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 SI-12 – Information Management and Retention","CIS Control 3 – Data Protection (Data Classification and Minimisation)","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001 Annex A 8.12 – Data Leakage Prevention","ITIL Service Design – Information Security Management",{},"published","2026-09-08T10:22:33.99236+00:00","2026-09-08T10:22:33.886+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_551\u002F2026&diff=52933&oldid=52932","garante-per-la-protezione-dei-dati-personali-italy-551-2026-14fc7e","Garante per la protezione dei dati personali (Italy) - 551\u002F2026",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]