Italy

Ministry of Justice

12,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-04-29.

Rank · Sector

#176

of 385 in Public Sector and Education

Rank · Italy

#279

of 604

Rank · All fines

#1,350

of 3,170

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-04-29
Controller / Processor: Ministry of Justice
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 12,000 on the Ministry of Justice. In its capacity as data controller for Sergio Cosmai prison, the Ministry of Justice displayed personal data in the form of information about an inmate's health on a noticeboard. This service order contained references to the physical condition and health requirements of the data subject, in accordance with a diagnosis made by an occupational health doctor. According to the DPA, the posting of data regarding the data subject's health was not necessary for this service order.

Open original source Links to the regulator's original publication or another source.