Italy

Ministero delle Imprese e del Made in Italy

15,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-02-26.

Rank · Sector

#151

of 356 in Public Sector and Education

Rank · Italy

#241

of 543

Rank · All fines

#1,218

of 3,039

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-02-26
Controller / Processor: Ministero delle Imprese e del Made in Italy
Sector: Public Sector and Education
Quoted Articles: Art. 28 (3) GDPR
Type of violation: Insufficient data processing agreement

Summary

The Italian DPA has imposed a fine of EUR 15,000 on the Ministero delle Imprese e del Made in Italy. The controller started a "Open competition, based on qualifications and examinations, to fill a total of two hundred and twenty-five full-time, permanent non-managerial posts (...)" The controller used a data processor to publish the the ranking list, but the processor failed to act in accordance to the GDPR. There had not been a sufficient data processing agreement and the controller failed to adequatly controll the data processor.

Open original source Links to the regulator's original publication or another source.