Italy

Ministero delle Imprese e del Made in Italy

15,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-02-26.

Rank · Sector

#151

of 357 in Public Sector and Education

Rank · Italy

#238

of 543

Rank · All fines

#1,224

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-02-26
Controller / Processor: Ministero delle Imprese e del Made in Italy
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 15,000 on the Ministero delle Imprese e del Made in Italy. The controller started a "Open competition, based on qualifications and examinations, to fill a total of 225 full-time, permanent non-managerial posts (...)" After the competition was closed, the ranking list of the candidates had still been effectivly online on the controllers website and could be accessed by web links. The ranking list included personal data of the candidates. The controller later took the list offline after a request to delete the data, but the list reappeared later on the website of a third party.

Open original source Links to the regulator's original publication or another source.