Istituto Statale "Duca degli Abruzzi" – Complaint Upheld (Italy, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Garante upheld a complaint against a school for improperly sharing a student's health information. This ruling is significant as it emphasizes the need for schools to protect student privacy and handle sensitive information carefully.
What happened
A teacher at Istituto Statale 'Duca degli Abruzzi' unlawfully shared a health certificate about a student with others in the school community.
Who was affected
The student who tested positive for Covid-19 and their family were affected by the unauthorized sharing of health information.
What the authority found
The authority found that the school violated privacy rules by allowing the teacher to share the student's health information without proper authorization.
Why this matters
This case highlights the importance of confidentiality in schools and serves as a warning for educational institutions to safeguard student data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 9 April 2026.
Processing notes: articles corrected, national law identified, scope corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The father of the data subject filed a complaint with the DPA against the school attended by his son (the controller). He complained that a teacher had unlawfully sent to the other students and their parents a certificate issued by the health authority stating that the data subject had been tested positive for Covid-19. The controller argued that it was not aware of this incident and that, after becoming aware, it had started a disciplinary procedure against the teacher. Moreover, it highlighted that this incident did not have any negative consequence on the data subject and that the certificate was only sent to a closed group of members of the school community. Finally, it pointed out that the teacher was undergoing a really stressful time due to the spreading of Covid-19. First of all, the DPA noted that a public authority is allowed to process personal data under the legal bases provided for by Article 6(1)(c) and 6(1)(e) GDPR. Moreover, the national law implementing Article 6(2) GDPR, [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter(1)] and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter 2-ter(3) of the Italian Data Protection Code], states that public administration might “disseminate” or “communicate” personal data to third parties only when a piece of legislation authorises to do so. Secondly, the DPA noted that the definition of “communication” set by [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter(4)(a) of the Italian Data Protection Code] does not require that personal data is shared with an undetermined amount of people. On the contrary, just sharing the certificate with a closed group of students is enough to fall into the scope of this definition. Therefore, it found a violation of Article 5(1)(a) and 6 GDPR and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter of the Italian Data Protection Code]. Thirdly, it pointed out that informatio
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Istituto Statale "Duca degli Abruzzi" in IT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Istituto Statale "Duca degli Abruzzi" - Italy (2024). Retrieved from cookiefines.eu
Last updated: