Italy

Montelibretti State Comprehensive School

4,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-04-29.

Rank · Sector

#273

of 359 in Public Sector and Education

Rank · Italy

#411

of 546

Rank · All fines

#1,965

of 3,072

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-04-29
Controller / Processor: Montelibretti State Comprehensive School
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) (2), (3) GDPR, Art. 9 (1), (2) g), (4) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 4,000 on Montelibretti State Comprehensive School. The controller published a circular regarding the selection of external teaching staff. This circular contained the complainant's son's initials. As stated by the DPA it is said that initials are a form of personal data and that their processing therefore requires an adequate legal basis. The controller did not have a legal basis to publish the pseudonymised personal data of the complaintant's son.

Open original source Links to the regulator's original publication or another source.