[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNoxI2MxJy7zIoHmtuh131tY_tgAFAdIs_AOqJHvauLI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"f5b528c5-d360-4914-8364-7dd62728ac3b","italian-hospital-fined-10000-for-unlawful-publication-of-candidate-data-on-public-website","e07feeb8-84f6-4201-9bf7-8c76c53a348c","Italian Hospital Fined €10,000 for Unlawful Publication of Candidate Data on Public Website","Bologna University Hospital IRCCS violated GDPR by publishing a candidate eligibility list on its public website, which was subsequently indexed by Google, exposing potentially sensitive personal data without a valid legal basis. The core failure was a lack of proper legal review before publication — national law did not authorize the disclosure of ineligible candidates' data, meaning the hospital processed personal data unlawfully under GDPR Article 6. This case highlights how routine administrative processes, such as publishing recruitment results, can become significant data protection violations when legal basis and data minimization principles are ignored. The additional harm caused by Google indexing the data amplifies the breach, as removal from search engine caches is difficult and time-consuming once public exposure occurs.","**Immediate actions:**\n- Audit all publicly accessible web pages containing personal data and remove any content lacking a clear, documented legal basis.\n- Submit removal requests to search engines (e.g., Google Search Console) for any unlawfully indexed pages containing personal data.\n\n**Data governance improvements:**\n- Establish a mandatory legal basis review process for any publication of personal data, ensuring compliance with GDPR Article 6 and applicable national law before content goes live.\n- Apply data minimization principles to recruitment publications — only publish information strictly required by law, such as eligible candidates, and never publish ineligible candidates without explicit legal authorization.\n- Implement a web content approval workflow requiring a Data Protection Officer (DPO) sign-off before any HR or administrative data is published online.\n\n**Detection & monitoring measures:**\n- Configure web crawl monitoring or Google Search Console alerts to detect when sensitive pages are indexed by search engines.\n- Conduct periodic GDPR compliance audits of all publicly facing content to identify and remediate unlawful data disclosures proactively.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 6 – Lawfulness of processing","GDPR Article 13 – Information to be provided to data subjects","GDPR Article 83(4) – Administrative fines","NIST SP 800-53 AC-22 – Publicly Accessible Content","NIST SP 800-53 RA-3 – Risk Assessment","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 A.5.33 – Protection of records","ITIL 4 – Information Security Management Practice",{},"published","2026-09-08T16:21:53.936487+00:00","2026-09-08T16:21:53.505+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_551\u002F2026&diff=52969&oldid=52963","garante-per-la-protezione-dei-dati-personali-italy-551-2026-cf9645","Garante per la protezione dei dati personali (Italy) - 551\u002F2026",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[52,56],{"slug":53,"name":54,"problem":55},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":57,"name":58,"problem":59},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]