Italian Hospital Fined €10,000 for Unlawful Publication of Candidate Data on Public Website
Written by AI from the linked story. Not reviewed by an editor. How this works
Bologna University Hospital IRCCS violated GDPR by publishing a candidate eligibility list on its public website, which was subsequently indexed by Google, exposing potentially sensitive personal data without a valid legal basis. The core failure was a lack of proper legal review before publication — national law did not authorize the disclosure of ineligible candidates' data, meaning the hospital processed personal data unlawfully under GDPR Article 6. This case highlights how routine administrative processes, such as publishing recruitment results, can become significant data protection violations when legal basis and data minimization principles are ignored. The additional harm caused by Google indexing the data amplifies the breach, as removal from search engine caches is difficult and time-consuming once public exposure occurs.
Tactical Insight
Immediate actions
- Audit all publicly accessible web pages containing personal data and remove any content lacking a clear, documented legal basis.
- Submit removal requests to search engines (e.g., Google Search Console) for any unlawfully indexed pages containing personal data.
Data governance improvements
- Establish a mandatory legal basis review process for any publication of personal data, ensuring compliance with GDPR Article 6 and applicable national law before content goes live.
- Apply data minimization principles to recruitment publications — only publish information strictly required by law, such as eligible candidates, and never publish ineligible candidates without explicit legal authorization.
- Implement a web content approval workflow requiring a Data Protection Officer (DPO) sign-off before any HR or administrative data is published online.
Detection & monitoring measures
- Configure web crawl monitoring or Google Search Console alerts to detect when sensitive pages are indexed by search engines.
- Conduct periodic GDPR compliance audits of all publicly facing content to identify and remediate unlawful data disclosures proactively.