Italian Hospital Fined €30K for Refusing GDPR Erasure Request on Recruitment Data

Written by AI from the linked story. Not reviewed by an editor. How this works

Bologna University Hospital IRCCS published a recruitment ranking list containing candidates' personal data on its public website and then refused a legitimate erasure request, citing national transparency laws as justification. The core failure was a misapplication of the balancing test between transparency obligations and GDPR data subject rights — national transparency rules do not automatically override the right to erasure where less invasive alternatives exist. This case highlights that publishing personal data beyond what is strictly necessary for the stated purpose (e.g., including full names when anonymised rankings could suffice) constitutes an unlawful disclosure. Organisations must proactively assess whether competing legal bases are genuinely in conflict before refusing data subject requests, as regulators will not accept blanket deferrals to transparency law.

Tactical Insight

Immediate actions

Conduct a legal basis review for all publicly posted documents containing personal data to confirm proportionality and necessity.
Establish a formal triage process for data subject requests (erasure, rectification, restriction) with documented legal reasoning for any refusals.

Policy & Governance improvements

Develop a data minimisation policy for recruitment publications, replacing full names with anonymised candidate identifiers wherever transparency obligations can still be met.
Train HR, legal, and communications teams on the interaction between national transparency/FOIA laws and GDPR rights, specifically the balancing test required under Article 17(3).
Create a pre-publication checklist requiring Data Protection Officer (DPO) sign-off before personal data is posted to public-facing platforms.

Detection & Accountability measures

Implement a periodic audit of all publicly accessible web pages and documents containing personal data to identify retention or necessity violations.
Log all data subject requests and regulatory decisions centrally to enable consistent, auditable decision-making across departments.