Istituto nazionale della previdenza sociale – €20,000 Fine (Italy, 2024)

The National Social Security Institute of Italy (Istituto Nazionale della Previdenza Sociale – INPS) intended to hire public servants through a public competition. For the purposes of this competition, it published on its website the rankings of the candidates, both the one that successfully passed the competition and also the excluded one. This ranking showed the name and surname of more than 5000 candidates and their score. Moreover, also other documents were published online, such as the schedule of the oral test. One of the participants filed a complaint with the DPA. He argued that the controller had published his personal data on the website without an adequate legal basis. Following the DPA’s request, the controller removed those documents from its website. The controller presented several arguments to support the lawfulness of its processing. Firstly, it pointed out that the publication of the list of the candidates who had been successfully admitted to the oral stage of the competition was a legal obligation, as the call for competition provided for it. Secondly, it highlighted the fact that the applicants had given their consent for the processing of personal data while filling in the application form. Moreover, the controller stressed the fact that, according to [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=2&atto.articolo.sottoArticolo=3&atto.articolo.sottoArticolo1=0&qId=&tabID=0.767966568760458&title=lbl.dettaglioAtto Article 2-ter of the Italian Data Protection Code], the legal basis for the processing can be found not only on a legislative act, but also on an administrative act of general applicability, such as a call for competition. Additionally, it argued that it had a legitimate interest in this processing as per Article 6(1)(f) GDPR. Firstly, the DPA observed that the relevant legal basis for the processing of personal data by a public author