Italy

Ministry of Justice

12,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-04-29.

Rank · Sector

#171

of 362 in Public Sector and Education

Rank · Italy

#259

of 555

Rank · All fines

#1,314

of 3,085

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-04-29
Controller / Processor: Ministry of Justice
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 12,000 on the Ministry of Justice. In its capacity as data controller for Sergio Cosmai prison, the Ministry of Justice displayed personal data in the form of information about an inmate's health on a noticeboard. This service order contained references to the physical condition and health requirements of the data subject, in accordance with a diagnosis made by an occupational health doctor. According to the DPA, the posting of data regarding the data subject's health was not necessary for this service order.

Open original source Links to the regulator's original publication or another source.