Italy

Emiglia-Romagna Regional Employment Agency

30,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-23.

Rank · Sector

#91

of 376 in Public Sector and Education

Rank · Italy

#189

of 595

Rank · All fines

#955

of 3,127

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-23
Controller / Processor: Emiglia-Romagna Regional Employment Agency
Sector: Public Sector and Education
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 30,000 on the Emiglia-Romagna Regional Employmant Agency. In their complaint, the data subject states that, after requesting the deletion and de-indexing of an internal ranking list regarding the recruitment of a technical receptionist, the list still showed up in Google searches of her name, containing her personal data. The list was created in accordance with national equity and inclusion law, and the data subject therefore stated that being on the list could lead to conclusions being drawn about her financial circumstances or disabilities. While the creation of the list was lawful, its publication was not; an anonymised version would have met the controller's need for publication.

Open original source Links to the regulator's original publication or another source.