[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frE7cj5ob6UUWiDNpbXzhUjoLNpc7y18ozet4L4QIUkA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"4bf87bfe-d2ab-474b-ac5d-bc52f4ac7daa","italian-ministry-of-justice-fined-for-publicly-displaying-notary-candidates-personal-data-without-le","bf51b15b-48d8-4e48-bc0d-865832aba35b","Italian Ministry of Justice Fined for Publicly Displaying Notary Candidates' Personal Data Without Legal Basis","The Italian Ministry of Justice publicly displayed the names, dates of birth, and test scores of 1,229 notary candidates in its entrance hall without a valid legal basis for such broad disclosure. This violated the GDPR's data minimization principle, which requires that only data strictly necessary for the stated purpose be processed and shared. Publishing excessive personal details — including birth dates and test results — went far beyond what was needed to inform candidates of their pass\u002Ffail status. This incident demonstrates that physical and administrative data handling practices carry the same legal weight as digital ones. Organizations must assess the lawfulness and proportionality of every data disclosure, regardless of its medium.","**Immediate actions:**\n- Conduct a rapid audit of all current and planned public disclosures (physical and digital) to verify they have an identified legal basis under GDPR.\n- Replace full personal data displays with minimized alternatives, such as candidate reference numbers, to announce results while protecting privacy.\n\n**Policy and governance improvements:**\n- Establish a mandatory Data Protection Impact Assessment (DPIA) process for any activity that publicly discloses personal data, including physical notice boards and printed lists.\n- Define and enforce a data minimization checklist that must be signed off by a Data Protection Officer before any candidate or personal information is published.\n- Train all staff involved in administrative and examination processes on GDPR obligations, including the principles of lawfulness, purpose limitation, and data minimization.\n\n**Long-term structural controls:**\n- Implement a formal data classification policy that flags personal data disclosures for legal review prior to publication in any format.\n- Establish periodic compliance reviews of routine administrative practices to identify legacy processes that may not align with current data protection law.",[12,13,14,15,16,17,18],"GDPR Article 5(1)(c): Data Minimisation","GDPR Article 6: Lawfulness of Processing","GDPR Article 32","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 PT-3: Personally Identifiable Information Processing Purposes",{"GDPR Article 32":20,"GDPR Article 5(1)(c): Data Minimisation":21,"GDPR Article 6: Lawfulness of Processing":22,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII":25,"NIST SP 800-53 PT-3: Personally Identifiable Information Processing Purposes":26},"Article 32 requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk, which includes governing how and what personal data is disclosed through administrative and physical channels.","The Ministry published dates of birth and test scores that were not necessary to communicate exam outcomes, directly violating the data minimisation principle that personal data must be adequate, relevant, and limited to what is necessary.","The Garante found no valid legal basis for the broad public disclosure, making the core violation one of unlawful processing — Article 6 requires a clear legal ground before any personal data is processed or disclosed.","The incident reflects a lack of staff competence regarding data protection obligations; ensuring personnel responsible for publishing exam results are trained on GDPR requirements would have prevented this breach.","Administrative staff responsible for communicating exam results lacked awareness of data privacy obligations, and a structured training programme covering data minimisation and lawful disclosure would have prevented the unnecessary exposure.","This control requires organisations to identify and meet their obligations regarding privacy and the protection of personally identifiable information, which would have prompted a legal review before publicly posting candidate data.","This control requires organisations to document and limit the processing of PII to only what is compatible with the specified purpose, which would have flagged the inclusion of birth dates and scores as disproportionate for a simple pass\u002Ffail announcement.","published","2026-11-10T10:22:27.425904+00:00","2026-11-10T10:22:27.409+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10309500-n.761&diff=53663&oldid=0","garante-per-la-protezione-dei-dati-personali-italy-10309500-n-761-184091","Garante per la protezione dei dati personali (Italy) - 10309500-n.761",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]