Data Subjects versus Comune di San Francesco al Campo (Municipality of San Francesco al Campo) – €1,200 Fine (Italy, 2025)

The Municipality of San Francesco al Campo (the controller) published a city council resolution on its institutional website. The resolution concerned the controller's legal defence in an ongoing case before the administrative court. The resolution included five attachments. Due to improper redaction, some of these attachments included the personal details and social security numbers of ten individuals (the data subjects) who brought the legal action against the controller. The resolution was available on two different pages of the controller's website: the official notice board ("albo pretorio") and the "administrative transparency" page. The data subjects reached out to the controller and requested the removal of their data from its website. In response, the controller removed the data from the notice board but not from the "transparency" page. Following this partial removal, the data subjects filed a complaint. The controller removed the remaining data after the complaint was filed. In their complaint the data subjects claimed that the controller had no legal basis to publish personal data. The controller, on the other hand, claimed that it was under a legal obligation to publish the data in its "transparency" pageSpecifically, the controller referred to d. lgs. 267/2000 and 33/2013 as the sources of the (alleged) legal obligation to process data. (but conceded that it erroneously published personal data on the notice board). The DPA held that the controller had no legal basis for publishing the data both on the notice board and the "transparency" page of its website. Overall, the DPA found the following violations: * the controller violated Articles 5(1)(a), 6(1)(c)(e), 6(2), and 6(3) GDPR, as well as 2-ter (1) and (2) d. lgs. 196/2003 by unlawfully processing personal data; * the controller violated Article 5(1)(c) by failing to ensure the minimisation of personal data; * finally, and with regards to the publication of personal data on the notice board specifically, the controller violated Art. 124(1) d. lgs. 267/2000 by exceeding the maximum publication time allowed under the ArticleThe provision is one of the alleged legal obligations to publish data which the controller invoked. However, the DPA held that the controller was under no such obligation- as mentioned above. Therefore, the finding that the provision was violated is somewhat puzzling- as it should logically not apply to begin with.. On these grounds the DPA issued a €1,200 fine.