Italy

Bologna University Hospital IRCCS

10,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-23.

Rank · Sector

#153

of 284 in Health Care

Rank · Italy

#334

of 599

Rank · All fines

#1,495

of 3,132

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-23
Controller / Processor: Bologna University Hospital IRCCS
Sector: Health Care
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fin eof EUR 10,000 on Bologna University Hospital IRCCS. The controller published a PDF document on its website containing the names of candidates who were either eligible or ineligible for a hiring procedure. Google also indexed this PDF. The list ranked candidates based on various criteria, some of which were related to income or disability status. However the controller did not provide a lawful basis for publishing the list containing personal data, which could have been published in an anonymised form.

Open original source Links to the regulator's original publication or another source.