Italy

Fondazione Rome Technopole

8,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-09-23.

Rank · Sector

#213

of 391 in Public Sector and Education

Rank · Italy

#355

of 613

Rank · All fines

#1,622

of 3,223

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-09-23
Controller / Processor: Fondazione Rome Technopole
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e), (2), (3) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 8,000 on Fondazione Rome Technopole. The foundation published an Excel file containing the names and ranks of 480 scholarship winners. A data subject discovered that the home addresses, ID documents, tax codes, dates of birth, email addresses, universities, grades and IBANs of the winners could be accessed in hidden columns in the document. The foundation published the information due to a transparency act. However, the Garante found that publishing the scholars' details was not necessary under said act, and that even if it were, only names, ranks and dates of birth could legally have been published.

Open original source Links to the regulator's original publication or another source.