Istituto di Istruzione Superiore “G. Renda” di Polistena, Reggio Calabria – €900 Fine (Italy, 2022)
An Italian school was fined for posting a teacher's dismissal notice on its website without proper legal grounds. The data protection authority found that the school didn't have a valid reason to share personal information publicly. This case highlights the importance of ensuring that any personal data shared online by schools or businesses complies with privacy laws.
What happened
The school published a teacher's dismissal notice on its website without a valid legal basis.
Who was affected
The teacher whose dismissal notice was posted online without proper justification.
What the authority found
The Italian data protection authority ruled that the school violated privacy rules by not verifying a legal requirement to publish personal data.
Why this matters
This decision emphasizes that organizations must verify legal requirements before publishing personal data online. Schools and businesses should ensure they have a valid legal basis for any data they share publicly.
GDPR Articles Cited
A teacher lodged a complaint against his employing institute for publishing on its institutional website the termination of the complainant's permanent employment contract, with measures adopted by the Ministry of Education attached. During a preliminary investigation, the Institute defended itself by explaining that it had acted in accordance with the requests of the Ministry of Education and Article 23 of Legislative Decree no. 33/2013 by publishing summary information containing data strictly necessary to identify the teacher without referring to the reasons for the dismissal. The Institute considered that the disputed publication was in the legitimate interest of third parties and students. It would make it possible to avoid recruiting the same unfit teacher as a temporary replacement, thereby enabling third parties to conclude a new fixed-term employment contract and guaranteeing continuity of teaching for pupils, which is why the publication was not anonymized. He also pointed to the troubled context of the Covid pandemic to justify the treatment. Although the Institute withdrew the publication at the DPA’s request, it did not appear at the hearing scheduled. The DPA considered that the controller has not verified the existence of a specific provision requiring the mandatory publication of a measure containing information on the termination of an employment contract. The Personal Data Protection Code specified that the publication of personal data by public bodies is only authorised where it is provided for by a legislative provision or, in the cases provided for by law, by a regulatory provision, in compliance with the principles of data protection [https://gdpr-info.eu/art-5-gdpr/ (article 5 (1) a) and c) GDPR)]. In addition, the DPA considered that the controller did not check the data and information that it was entitled to publish under the principles of relevance and non-excess. The GDPR reiterates the obligation to implement appropriate measures t
Violations (1)
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Related Enforcement Actions (0)
No other enforcement actions found for Istituto di Istruzione Superiore “G. Renda” di Polistena, Reggio Calabria in IT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
Fine Date
20 October 2022
Authority
Garante per la protezione dei dati personali
Fine Amount
€900
GDPRhub ID
gdprhub-6018About this data
Cite as: Cookie Fines. Istituto di Istruzione Superiore “G. Renda” di Polistena, Reggio Calabria - Italy (2022). Retrieved from cookiefines.eu
Last updated: