Italy

Agenzia per l'Italia Digitale (AgID)

15,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-10-07.

Rank · Sector

#158

of 391 in Public Sector and Education

Rank · Italy

#267

of 613

Rank · All fines

#1,297

of 3,223

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-10-07
Controller / Processor: Agenzia per l'Italia Digitale (AgID)
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 15,000 on the Agenzia per l'Italia Digitale (AgID). During the recruitment process in 2021, the controller published a list of the 15 candidates admitted to the oral exams, along with their names and test scores. The document remained online until 23 January 2026. The controller incorrectly believed that they had replaced the list with a pseudonymised version in 2025. The authority stated that only the final candidate ranking could be made public, and that interim lists had to remain internal.

Open original source Links to the regulator's original publication or another source.