Italy

Monza and Brianza Local Education Authority

10,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-07-23.

Rank · Sector

#194

of 377 in Public Sector and Education

Rank · Italy

#335

of 599

Rank · All fines

#1,496

of 3,132

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-07-23
Controller / Processor: Monza and Brianza Local Education Authority
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) A) GDPR, Art. 6 (1) c), e), (2), (3) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 10,000 on the Monza and Brianza Local Education Authority. The data subject was subject to a disciplinary procedure, after which their employment was terminated. The controller shared this information with all regional education offices, all schools in the area, the teachers' and staff office and other authority bodies. The email contained the data subject's name, place of birth, date of birth, job title and the specific disciplinary action taken against them. The authority found that the controller had made a legal error when assessing their duty to inform other bodies about the dismissal and to share personal data.

Open original source Links to the regulator's original publication or another source.