Italy

Ancel Keys Comprehensive School Castelnuovo Cilento

2,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-23.

Rank · Sector

#350

of 376 in Public Sector and Education

Rank · Italy

#546

of 595

Rank · All fines

#2,492

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-23
Controller / Processor: Ancel Keys Comprehensive School Castelnuovo Cilento
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 (1) c), e), (2), (3) GDPR, Art. 9 (1), (2) g), (4) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 2,000 on the Ancel Keys Comprehensive School in Castelnuovo Cilento. The complainant's child is enrolled at the nursery school run by the controller. The parent received a formal notice excluding their child from enrolment at the nursery school due to compulsory vaccination requirements. This information was also given to the mayor of the municipality, who informed the complainant's spouse about their child's exclusion. Information about data subjects' vaccination status is health data and therefore a category of special personal data. Although the school believed that they had informed the mayor of this information in their capacity as a local health authority, there was no legal basis for disclosing the data subjects' personal data to them.

Open original source Links to the regulator's original publication or another source.