Italian DPA: Municipality of Rieti breached GDPR by publishing 31,000 taxpayers' waste

[Web Doc. No. 10286417] Decision of July 14, 2026 Register of Decisions No. 523 of July 14, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection, setting forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at the performance of the tasks and the exercise of the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc.

No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having reviewed the documentation on file; Having considered the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Ginevra Cerrina Feroni; WHEREAS 1. Introduction In a complaint submitted to the Authority on XX pursuant to Art. 144 of the Code, the complainant specifically alleged the disclosure of personal data on the institutional website of the Municipality of Rieti (hereinafter, the “Municipality”), including the personal data of TARI taxpayers. The aforementioned report specifically cited a news article stating that “The administration […] exposed the personal data of over 31,000 citizens, putting them at risk of identity theft and fraud. […on XX] a file of over 2,000 pages was in fact published, in which the personal data of Rieti citizens and enterprises were left fully exposed: first name, last name, tax ID number, and address, as well as land registry data, address, user category, and square meters of the properties they own and on which they pay the TARI” […the] mayor, […] did not deem it necessary to immediately inform citizens of this serious breach. […] the administration […] removed the document and the related resolution, as if nothing had happened” (see URL https://...).

In response to the aforementioned article, the Municipality, as verified by the Office on XX, issued a statement declaring that it “acted as promptly as possible,” and asserting that “there was no concealment regarding the matter, but rather the procedures outlined in protocols for similar cases were scrupulously followed. The error was detected by municipal staff, and the Administration immediately took the required action, namely removal. It should also be noted that the published document contained personal data—which was neither sensitive nor of a judicial nature—as well as data pertaining to legal entities, which do not fall within the scope of privacy regulations. We promptly took the steps required by law, activating the protocol and consequently notifying the Privacy Commissioner, in which we expressed our willingness to inform the public of the incident should the Commissioner […] indicate [to the Municipality] that it was necessary. […] There was, therefore, no reluctance or delay, but merely compliance with the provisions of the law” (see press release dated XX, URL https://...). 2.

The Preliminary Investigation 2.1. The Data Breach That Occurred Regarding the data breach that occurred, the Municipality, in a letter registered under ref. no. XX on XX, notified the Authority, pursuant to Article 33 of the Regulation, specifically that: - “On XX, Resolution No. XX of XX was erroneously published on the Municipal Notice Board along with its attachments, which were, in any case, merely part of the case file and were not intended for publication (including Service Contract XX) […] the aforementioned Service Contract XX includes, among its attachments, the list of the Company’s employees (first and last names of 50 individuals), the Business Plan, and the TARI registry (approximately 31,000 accounts, including both individuals and legal entities, with details such as tax ID number, first and last names, residence, cadastral data, and addresses of properties subject to taxation, as well as the taxable area).

Upon verifying the erroneous publication of the aforementioned document and its attachments on XX, the publication was immediately removed from both the Municipal Notice Board and the “Transparent Administration” section (Section F, Point 7); - The systems involved in the breach are the “Software for managing the Municipal Notice Board and the ‘Transparent Administration’ Section provided by the company XX […]” (Section F, Point 8); - The technical and organizational measures in place at the time of the breach consist of “Awareness-raising and training for staff involved in data processing and related control activities” (Sec. F, Point 9); - The data affected by the breach included personal identification data (first name, last name, gender, date of birth, place of birth, tax identification number), as well as data related to registration in the municipality’s TARI registry (i.e., property records and addresses of taxable properties, taxable area) of approximately 31,050 data subjects, including Users, contractors, subscribers, and current or potential customers (Sec. F, points 10, 11, and 12); specifically, the data subjects involved are “employees of XX” and “natural or legal persons required to be registered in the TARI registry” (Sec. F, point 14); - The data were disclosed beyond the scope of the privacy notice or the applicable regulations and can be linked, without unreasonable effort, to other information relating to the data subjects (Sec. G, point 1.1); - The breach resulted in unauthorized third parties gaining access to the data (Sec. G, point 2), and the severity of the potential impact on the data subjects was assessed by the Municipality as negligible (Sec. G, point 3).

In the aforementioned notification, it was also stated that on XX, the data was “removed from both the Municipal Notice Board and the ‘Transparent Administration’ Section,” and that among the technical and organizational measures adopted (or to be adopted) to prevent similar future violations, there is the “Amendment of the controller’s policies regarding data protection, including the assignment of accountability, awareness-raising, and training of staff involved in processing and related oversight activities” (Section H, points 1 and 2). In the same breach notification, the Municipality stated that the notification to data subjects required by Article 34 of the Regulation was not carried out because “the breach is not likely to pose a high risk to the rights and freedoms of natural persons,” since “The published lists do not contain personal data as referred to in Articles 9 and 10 of EU Regulation 2016/679” (Section I, point 1, and Section L, point 1). 2.2.

Responses to Requests for Information In letters dated XX and XX (ref. nos. XX and XX, respectively), the Municipality responded to the requests for information made by this Authority pursuant to Article 157 of the Code (see letters ref. nos. XX dated XX and XX dated X), providing clarifications regarding the following issues: a. Regarding how the Municipality became aware of the breach that occurred on XX, as well as the scope of the disclosure of personal data contained in Decision No. XX of XX and its annexes (hereinafter, the “Decision”), the Municipality stated, in particular, that: - “On XX, the employee […] responsible for publishing the document in question was absent […]. On XX, […] the employee checked the published documents and noticed the breach. On the same day, he reported the matter […] and removed the publication. On the morning of XX, he notified the DPO of the incident for an assessment of the breach […]” (see note dated XX); - “[…] the publication of the document in question was a mere clerical error that gave rise to the violation and was committed due to the simultaneous publication of another document” (see note dated XX); - “The total number of downloads of the decision and/or the attachments was 31 (thirty-one), all of which were made by external parties.

The total number of views of the decision and/or its attachments was 57 (fifty-seven), of which 13 (thirteen) were by employees of this municipality and 44 (forty-four) were by external parties” (see note XX); b. With regard to the legal basis and processing purpose carried out through the publication of the Decision on the Municipal Notice Board and in the “Transparent Administration” Section of its institutional website, the Municipality stated that “The legal basis for the processing is found in Art. 6(1)(c) of the Regulation, for the purposes of the legal obligations incumbent upon the Data Controller as imposed by Law No. 18 of June 18, 2009, 69 for the Municipal Bulletin and by Legislative Decree No. 33 of March 14, 2013, for the “Transparent Administration” Section of the institutional website” (see note XX); c. With regard, however, to the legal basis and processing purpose carried out by the Municipality in relation to the personal data of XX’s employees (hereinafter “XX”), including in connection with the publication of the Resolution “XX […] is a company wholly owned by the Municipality […] operating in the following public utility sectors […including] Waste management, Public sanitation, […] Based on the Economic and Financial Plan for the year XX (also referred to in Resolution No. XX of XX), please refer to the contract between the Municipality of Rieti and its subsidiary […] included among the annexes to Resolution No. XX of XX […].

As part of the routine exchange of information between the Administration and its subsidiary, notice was given regarding the violation that occurred, requesting due notice of any reports or complaints. As of today, nothing has been communicated in this regard” (see note dated XX); d. Regarding the categories of legal entities involved in the violation in question, the Municipality has clarified that: - “The legal entities involved are enterprises, professional partnerships, and partnerships or corporations, including consortia and cooperatives, […] Among these, sole enterprises and partnerships may have one or more natural persons identified in their name, as per the official Chamber of Commerce database, which can be consulted upon request” (see note XX); - “[…] the number of data subjects indicated in the data breach notification […] ref. no. XX dated XX also includes legal entities (e.g., sole enterprises, etc.), from whose business names one or more natural persons can be identified”; furthermore, “the published data concerning real estate owned by natural and/or legal persons is easily accessible to anyone with an account on the Revenue Agency’s SISTER platform, which is intended in particular for both independent professionals (engineers, accountants, etc.) and public entities” (see note XX); e. With regard to the other parties involved in the processing of the personal data subject to a data breach and the role they play under data protection regulations, the Municipality stated that “Company XX is the economic operator entrusted with managing the Municipal Register and the ‘Transparent Administration’ Section of the institutional website, designated as the processor (Art. 28 of the Regulation) […]” (see note XX); f. With regard, however, to the specific technical measures, as well as the organizational measures (in addition to those already indicated in the notification pursuant to Article 33 of the Regulation) in place at the time of the breach, the Municipality stated that: - “The persons entrusted with processing during the period from XX to XX were informed and trained—including through operational instructions—on the obligations regarding data protection imposed by the Regulation, the Code, and the relevant provisions of the Data Protection Authority, as amended in conjunction with the provisions on transparency in administrative acts and anti-corruption […]” (see note dated XX);Following the data breach […], the instructions contained in the document […] dated XX […] were deemed current and applicable, and the “XX” document, in edition XX, revision XX, dated XX, was prepared and distributed to managers […]” (see note dated XX); - “During the period from XX to XX, employees involved in data processing and related oversight activities (Art. 29 of the Regulation) […] were trained and made aware of these matters,” including those from the office responsible for publishing the Determination (see note XX); - Regarding the operational logic of the software for managing the Municipal Bulletin provided by the company XX (hereinafter, the “Supplier”) in relation to the document publication process: “The software is configured by default to publish attachments.

Therefore, if a document is not to be published, the operator must remove the “Publish” flag. In this way, the attachment will not be visible either on the bulletin board or in the online services” (see Annex XX “Report XX” attached to Note XX); g. Finally, regarding the risk assessment conducted by the Municipality concerning the severity of the breach that occurred and the reasons why it decided not to notify the data subjects pursuant to Article 34 of the Regulation, as well as any additional risk mitigation measures adopted, the Municipality stated that: - “On XX, the data breach was analyzed […] and on the same date, a formal report was submitted to the Data Protection Authority. The report indicated that, despite the high number of data subjects affected by the data breach, since the published personal data did not fall within the categories referred to in Articles 9 and 10 of the Regulation, it was decided, initially, not to notify the data subjects as required by Article 34 of the Regulation, deferring the decision to any guidance the Data Protection Authority might provide on the matter (Article 34(4) of the Regulation).

Nevertheless, on XX, in response to the news article published in the online newspaper RietiLife […] the Municipality issued a Press Release reporting the incident and the actions taken, both to the councilwoman and to the data subjects involved in the data breach (in compliance with Art. 34(1) of the Regulation) through the same online news outlet and the institutional website […]” (see note dated XX); - “Following the data breach and the initiation of the investigation […] further clarifications were requested regarding the configuration of the software used for publication on the municipal bulletin board. Subsequently, on XX, the […Municipality] conducted a DPIA on the software used to manage the municipal bulletin board and received a positive opinion from the DPO on the same date. The risk assessment revealed that, since the staff responsible for publication had been adequately trained on issues related to data protection, human error can be considered UNLIKELY, as is the use of the publication software by individuals outside this Municipality” (see note dated XX).

With regard to the Municipality’s conduct, the Office, based on the evidence gathered and the facts that emerged following the preliminary investigation, notified the Municipality—via a note dated XX (Ref. No. XX) pursuant to Article 166, paragraph 5, of the Code— the initiation of proceedings for the adoption of the measures referred to in Article 58, para 2, of the Regulation for having acted: - in violation of the principles of lawfulness, fairness, and transparency; data minimisation; and integrity and confidentiality, as well as the principle of accountability set forth in Article 5, para 1, subparagraphs (a), (c), and (f) of the Regulation; - in violation of Articles 5(2) and 24 of the Regulation; - in violation of the principles of privacy by design and by default referred to in Article 25 of the Regulation; - in violation of the security obligations set forth in Article 32 of the Regulation; - in violation of Articles 12(1) and 34 of the Regulation.

By the aforementioned order, the Municipality was requested to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Art. 18, paragraph 1, of Law No. 689 of November 24, 1981). By letter dated XX (Ref. No. XX), to which reference is made in its entirety, the Municipality submitted a brief setting forth its defense arguments, which were then substantially reiterated during the hearing held on XX (see minutes, Ref. No. XX, of the same date), and concluded with a letter dated XX (Ref. No. XX), in which the Municipality stated, in particular, that: - “The violation concerned the publication, limited to the period from XX to XX, of general data regarding the data subjects (identification and cadastral information)”;the erroneous publication did not result in significant harm or high risks to the data subject rights and freedoms, taking into account the following mitigating circumstances: a) personal data can be obtained by anyone who requests it from the municipality’s registry office, in accordance with the provisions of Presidential Decree 233/1989, while cadastral information […] is available via an online service on the dedicated portal set up by the Revenue Agency, which allows anyone to access the database. b) given the considerable amount of data published, there were only 57 views (of which 13 were by employees of the entity—who, as such, are required to comply with confidentiality obligations—and 44 by external parties); c) the duration of the violation was essentially brief (11 calendar days); d) only one data subject filed a complaint pursuant to Art. 77 of the GDPR” (see note XX); - “The breach resulted from a mere clerical error by […the individual who carried out the publication], who […] found himself having to personally publish the document on the Municipal Notice Board and, due to a technical IT issue (of which he was unaware), unwittingly and through an automated process of which he was unaware, submitted the attachments to the main document (Resolution No. XX of XX) for publication […] without realizing that the IT system, by default and without further manual intervention by the operator, publishes the documents attached to the main document”; - “The error was committed due to the simultaneous publication of another document, carried out in accordance with the obligations arising from Law No. 69/2009 and Legislative Decree No. 33/2013, and, therefore, the employee was fully convinced of the fairness of their actions […] It also seems appropriate to note not only the accidental nature of the violation but also its isolated nature, as there have been no previous violations of the GDPR committed by the Entity” (see Note XX); - “The Authority immediately took action with the software company that manages the municipal IT service to have specific alerts introduced for the operator responsible for publishing on the online Municipal Notice Board, so that every document to be published can be ‘knowingly flagged,’ by checking the relevant box […and] in order to prevent a recurrence of incidents similar to the one that occurred, it introduced a procedural change that allows for the deliberate selection of the publication option.

In particular, it has deactivated the setting that triggered the automatic publication of attachments in Application XX, thereby allowing the manual selection of whether or not to publish a document” (see note dated XX); - “It is also noted that a request was made to the supplier—[…] via an open ticket on XX […] to modify the logic of the “XX” platform used for the online publication of resolutions and other documents, with the supplier itself releasing a new procedure into production starting in the month of XX, which currently requires active intervention by the operator to upload attachments. Information regarding the aforementioned procedure was also provided to municipal employees in order to promote informed action by individual operators at the time of uploading. The Municipality has therefore adopted additional measures to prevent the recurrence of violations similar to the one that occurred.

In this regard, it should be noted that, with the exception of the Violation, even under the platform’s previous operating procedures, there were never any instances—nor were any detected—of attachments being published with documents subject to mandatory disclosure that contained personal data (see the XX hearing transcript); - “With regard to the Violation in question, […] among the various measures adopted, a press release was issued on the Municipality’s previous institutional website and subsequently republished in two selected local newspapers (“RietiLife” and “Format Rieti”)”” (see minutes of the hearing of XX). 3. Outcome of the Preliminary Investigation 3.1. Legislation on Data Protection. Based on the findings of the Authority’s preliminary investigation, it should be noted that the processing of personal data must comply with applicable personal data protection laws and, in particular, with the provisions of the Regulation and the Code.

First, it should be noted that “personal data” means “any information relating to an identified or identifiable natural person (‘data subject’)”. Furthermore, “a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person” (Art. 4, para. 1, no. 1, of the Regulation). With regard to the principles governing data protection, Article 5, para 1, subparagraphs (a) and (c), of the Regulation stipulates that personal data must be processed lawfully, fairly, and transparently in relation to the data subject, and must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (the principles of “lawfulness, fairness, and transparency” and “data minimization”).

In accordance with the aforementioned principle of transparency, Article 12, para 1, of the Regulation provides, in particular, that the controller shall take appropriate measures to provide the data subject with the information referred to in Article 34 in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, particularly in the case of information specifically intended for children. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. Furthermore, pursuant to Art. 5, para. 1, subparagraph (f), of the Regulation, personal data must be processed “in a manner that ensures appropriate security” […], including protection, through appropriate technical and organizational measures, against unauthorized or unlawful processing and against accidental loss, destruction, or damage” (principle of integrity and confidentiality).

In this regard, Article 32 of the Regulation provides, in particular, that: the controller, “taking into account the state of the art and the costs of implementation, as well as the nature, scope, context, and processing purposes, and the risk of varying likelihood and severity to the rights and freedoms of natural persons, [shall] implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, among others, where appropriate: […] b) the ability to ensure, on an ongoing basis, the confidentiality, integrity, availability, and resilience of processing systems and services; […] d) a procedure for regularly testing, verifying, and evaluating the effectiveness of the technical and organizational measures to ensure the security of the processing” (para. 1); “When assessing the appropriate level of security, special consideration shall be given to the risks posed by the processing, arising in particular from the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data that are transmitted, stored, or otherwise processed” (para 2).

In addition, Article 25 of the Regulation requires the controller to: “taking into account the state of the art and the costs of implementation, as well as the nature, scope, context, and processing purposes, and the risks of varying likelihood and severity to the rights and freedoms of natural persons posed by the processing, both at the time of determining the means of processing and at thetime of processing itself [to implement] appropriate technical and organizational measures, such as pseudonymisation, designed to effectively implement data protection principles, such as data minimisation, and to incorporate into the processing the necessary safeguards to meet the requirements of this Regulation and protect the rights of data subjects” (principle of privacy by design, para. 1); to implement “appropriate technical and organizational measures to ensure that, by default, only the personal data necessary for each specific processing purpose are processed.

This obligation applies to the amount of personal data collected, the scope of the processing, the storage period, and accessibility. In particular, these measures ensure that, by default, personal data are not made accessible to an indefinite number of natural persons without the intervention of the natural person” (principle of privacy by default, para. 2). Finally, pursuant to Article 5, para 2 of the Regulation, it should be noted that the controller is responsible for compliance with the principles regarding data protection and must be able to demonstrate such compliance (“accountability”) and that, pursuant to Article 24, para 1, of the Regulation, the controller—taking into account the nature, scope, context, and processing purposes, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons — shall implement appropriate technical and organizational measures to ensure, and be able to demonstrate, that the processing is carried out in accordance with the Regulation. 3.2.

Violation of the principles of lawfulness of processing, data minimisation, and the integrity and confidentiality of personal data, as well as data protection by design and by default. Following the preliminary investigation, it emerged, in summary, that on XX, the following was published on the Municipality’s official website—both in the Municipal Notice Board and in the “Transparent Administration” Section — Resolution No. XX of XX concerning “XX,” including the relevant attachments, such as the service contract with the company XX, along with additional documentation, including, in particular, the list of XX personnel assigned to the urban sanitation service, as well as the list of TARI accounts. This publication resulted in the disclosure of data and information regarding the taxpayers associated with the TARI accounts—registered in the names of both individuals and legal entities—including, in particular, tax identification number, first and last name, residential address, TARI account code and category, cadastral data, address, and area of the properties subject to taxation, as well as personal data (first and last name) pertaining to certain employees of company XX (hereinafter, the “Violation”).

In this regard, it should be noted that, although the Municipality represented, in particular, that the Violation resulted from “a mere clerical error […] committed due to the simultaneous publication of another document,” that “on XX, the employee […] responsible for publishing the document in question was absent,” and that the “Manager […] found himself having to personally publish the document on the Municipal Notice Board, and, due to a technical IT issue (of which he was unaware), unwittingly and through an automatic process unknown to him, submitted the attachments to the main document for publication,” the software used at the time of the events was found to be configured “by default to publish attachments” (see Attachment XX “Report XX” attached to the note dated XX). This setting was caused by the absence of measures designed to limit publication to only those acts and documents required by law, as the “Publish” field was selected by default, with the result that removing the corresponding checkmark was, in fact, left to the active intervention of the designated operator (see Annex 4 cited above).

In this regard, although the Municipality has represented that it has been working with the provider that manages the “XX” platform to modify the aforementioned functionality since XX—following the violation that occurred—it should be noted that, based on the documentation produced during the preliminary investigation, it is evident only that the aforementioned request had been acknowledged by the provider itself; however, the case file lacks any record of follow-up actions or communications between the Municipality and the provider aimed at urging the actual modification of the functionality. It should also be noted that, based on the evidence provided, the ticket initially opened by the Municipality appears to have been of a purely preliminary nature, as its subject line read “Ticket #XX – Publication of attachments to documents – suggestion to change default settings” (see “Presa_in_carico_del_ticket” attached to the note dated XX).

This conclusion is further confirmed by the fact that, in the subsequent exchange of correspondence between the Municipality and the same supplier, reference was made to a subsequent ticket with the subject line “Re: Ticket #XX – GPDP – Report regarding the dissemination of personal data. Request for a report,” in which the Supplier, on XX, provided further explanations regarding the fact that “the software is configured by default to publish attachments. Therefore, if a document is not to be published, the operator must remove the “Publish” flag [...] (see Attachment 4 “Report XX,” cited above). That said, it should be noted that the aforementioned default setting conflicts, first and foremost, with the cited principle of integrity and confidentiality of the personal data of data subjects, as well as with the principles of privacy by design and by default referred to in Art. 25 of the Regulation, given that the default uploading of records and documents, as well as their attachments—even those consisting of large files, as in the present case—entails greater exposure to risks for the personal rights and freedoms of the data subjects, where, as in the present case, the individual user does not deselect the option regarding default publication.

It is therefore evident that a software configuration that does not allow for the selection of records and documents to be published (opt-in), but only to exclude their publication, if necessary (opt-out), entails a considerable increase in the risk of loss of data confidentiality, especially in the event of human error or system bugs. This default setting is also contrary to the principles of lawfulness and data minimization set forth in Art. 5(1)(a) and (c) of the Regulation, particularly in light of the legislation—expressly cited by the Municipality—which generally provides for the publication of acts, information, and documents for the purpose of legal publicity (see, in particular, Law No. 69/2009, but see also Legislative Decree No. 267/2000) or for the purpose of administrative transparency (Art. 14 of Legislative Decree No. 33/2013). In this regard, in fact, before publishing any personal data relating to data subjects online, the controller is, in any case, required to verify which data and information to publish, while ensuring full compliance with data protection regulations, with specific reference to the relevance and proportionality of the data disclosed.

Over time, the Data Protection Authority has provided specific guidance to public administrations regarding the precautions to be taken when publishing personal data on the Internet for the purposes of transparency and publicizing administrative actions; in particular, in 2014, with the “Guidelines on the processing of personal data, including data contained in administrative records and documents, carried out for the purposes of publicity and transparency on the web by public entities and other obligated bodies” (Provision No. 243 of May 15, 2014, Web Doc. No. 3134436, Parts I and II, specifically para. 3.a). In this context, even while the previous regulatory framework was still in effect, a series of principles were identified whose relevance can still be considered valid today, and it was clarified (and also confirmed in numerous subsequent decisions) that the existence of a disclosure regime cannot result in any automatic online dissemination of personal data nor constitute an exception to the principles governing the data protection process, as confirmed by the personal data protection framework contained in the Regulation, in light of which the controller is required to “implement appropriate technical and organizational measures to ensure that, by default, only the personal data necessary for each specific processing purpose are processed” and must be “able to demonstrate” —in accordance with the principle of “accountability”—that it has done so pursuant to Articles 5(2), 24, and 25(2) of the Regulation.

On such occasions, the Data Protection Authority has reiterated that all the limits set forth by the principles governing data protection also apply to the publication of acts or resolutions on the online municipal bulletin board, with particular regard first and foremost to the prior verification of the existence of suitable grounds for the lawfulness of the online dissemination of the personal data contained therein —as the data controller must first verify the existence of a specific legal provision authorizing such disclosure as a suitable legal basis—and to the minimization of such data (see, among many others, most recently, Decision No. 423 of July 17, 2025, Web Doc. No. 10181686, and the precedents cited therein). As for the Municipality’s reference to the transparency obligations set forth in Legislative Decree No. 33 of March 14, 2013, it should be noted that even in such cases, publication in the Section “Transparent Administration” must be carried out in accordance with the procedures and in the format expressly provided for by the aforementioned regulatory framework and by the guidelines issued over time by the National Anti-Corruption Authority, since only the specific information enumerated by that regulatory framework is subject to publication, and not, on the other hand, the full text of administrative documents (see FAQs on transparency regarding the application of Legislative Decree No. 33/2013, available on the ANAC website | Home page - www.anticorruzione.it at https://www.anticorruzione.it/chiedilo-ad-anac/-/categories/119067).

It should be noted that, even with regard to any publication in the “Transparent Administration” section of the institutional website, the data controller must always verify—based on a responsible and careful assessment—which data and information to publish in accordance with the sector-specific regulations governing the methods, timing, and forms of disclosure (see, most recently, Provision No. 423 of July 17, 2025, cited above). It is further noted that the observation made by the Municipality during the preliminary investigation regarding the fact that, with respect to the violation in question, “the published data concerning real estate owned by natural and/or legal persons is easily accessible to anyone with an account on the Revenue Agency’s SISTER platform, which is intended in particular for both independent professionals (engineers, accountants, etc.) and public entities.” In this regard, it must be emphasized that the breach resulted, for a considerable number of data subjects, in the disclosure of a massive amount of personal data, making it freely and immediately accessible to anyone.

This situation differs substantially—in terms of scope and accessibility—from a scenario in which similar information might be obtained through selective queries of separate information systems, which require specific search operations, do not allow for immediate access, and pertain, on a case-by-case basis, to individual data subjects who have been previously identified. In light of the reasons set forth above, it is therefore established that the measures adopted by the Municipality, at least until the month of XX, regarding the procedures for uploading its documents to the institutional website, were not adequate to ensure—from the design stage and by default— neither compliance with the principles of lawfulness of processing and data minimisation, nor a level of security appropriate to the risk, as they were unable to permanently ensure the confidentiality of the personal data processed and thus resulted in the Municipality’s violation of Articles 5(1)(a), (c) and (f), 25, and 32 of the Regulation. 3.3.

Failure to adopt adequate measures to promptly detect and manage the Data Breach. In addition to the observations made in paragraph 3.2. above, during the investigation—and based in part on the assessment criteria provided by the Municipality—it became apparent that the additional measures adopted to detect the Data Breach were inadequate. Pursuant to the aforementioned Art 25 of the Regulation, the controller is in fact required to implement the data protection principles (Article 5 of the Regulation) by adopting appropriate technical and organizational measures and incorporating into the processing the necessary safeguards to meet the requirements of the Regulation and protect the rights and freedoms of data subjects. In particular, in order to ensure compliance with the principles of integrity and confidentiality (Article 5(1)(f) of the Regulation), the controller must constantly assess whether, at any stage of processing, it is using appropriate means and suitable measures to address any vulnerabilities.

Furthermore, the controller must conduct periodic reviews of the security measures put in place to safeguard and protect personal data (see Recital 78 of the Regulation and “Guidelines 4/2019 on Article 25: Data Protection by Design and by Default,” adopted on XX by the European Data Protection Board, specifically points 84 and 85). In this regard, the “Guidelines on the Notification of Personal Data Breaches pursuant to Regulation (EU) 2016/679” issued by the Article 29 Working Party on October 3, 2017, as last amended and adopted on February 6, 2018, and endorsed by the European Data Protection Board on May 25, 2018, further clarify that “the ability to detect, address, and report a breach in a timely manner must be considered an essential aspect” of the technical and organizational measures that the controller and processor must implement, pursuant to Article 32 of the Regulation, to ensure an adequate level of personal data security.

With regard to the case at hand, the Municipality should therefore have conducted continuously verify the adequacy of the technical and organizational measures relating to the personal data processing operations it had implemented, in order to prevent (or promptly detect) errors or anomalies in the data uploaded to the various Sections of the institutional website, by implementing appropriate measures to ensure a level of security commensurate with the risk. However, this did not occur in this specific case, given that the erroneous publication of the Resolution and its attachments was detected only later—on the XX—when the operator “responsible for publishing the document […had] resumed work, […] checked the publications made and noticed the violation […thereby] reporting the matter […] and removing the publication.” The specific functions used and the technical measures adopted by the Municipality were therefore not sufficient to prevent and promptly detect the Breach and, consequently, must be considered non-compliant with the provisions of Articles 5(1)(f), 25, and 32 of the Regulation.

It should also be noted that, with regard to the adoption of the technical and organizational security measures necessary to ensure the compliance of the personal data processing activities carried out, although the Regulation also imposes specific obligations in this regard on the processor (Art. 32), it remains the case that the data controller is the entity bearing “overall accountability” for the processing of personal data carried out (see Art. 5(2) [so-called “accountability”] and Art. 24 of the Regulation), even when such processing is carried out by other entities “on its behalf” (Recital 81, Articles 4(8) and 28 of the Regulation). In light of the foregoing considerations, it is therefore established that the Municipality acted in violation of Articles 5(1)(f) and (2), 24, 25, and 32 of the Regulation, including with regard to the detection and handling of the data breach that occurred. 3.4.

Inadequate risk assessment and notification of the data breach to the data subjects. With regard to the data breach that occurred, the Municipality, believing that the breach was not likely to pose a high risk to the rights and freedoms of natural persons, initially failed to inform the data subjects, considering the severity of the potential impact on them to be negligible (see Sec XX, Point XX, of the notification dated XX). Subsequently, during the preliminary investigation, it stated that “despite the high number of data subjects affected by the data breach, since the publication of the personal data did not fall within the categories referred to in Articles 9 and 10 of the Regulation, it was initially decided not to notify the data subjects as required by Art. 34 of the Regulation, deferring the decision to any ruling by the Data Protection Authority on the matter (Art. 34 para. 4 of the Regulation),” and further specifying that “on XX, in response to the news article published in the online newspaper RietiLife […] the Municipality issued a Press Release detailing the incident and the actions taken, both to the councilwoman and to the data subjects involved in the data breach (in compliance with Art. 34(1) of the Regulation), via the same online news outlet and the institutional website […].”

In this regard, it must be emphasized, first and foremost, that Article 34(1) of the Regulation stipulates that “where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the breach to the data subject without undue delay.” Indeed, it is the responsibility of the controller, through proactive and informed actions, to carry out the aforementioned risk assessment, in accordance not only with the provisions of the aforementioned Article 34 of the Regulation but also, more generally, with the principle of “accountability” referred to in Articles 5(2) and 24 of the Regulation. This assessment—which is distinct from the data protection impact assessment provided for in Art. 35 of the Regulation, to be conducted before processing begins—must be carried out by the controller, taking into account all the circumstances of the specific case in order to correctly identify a specific level of risk severity, and must therefore not be limited to considering solely whether a personal data breach affects data falling within the categories referred to in Articles 9 and 10 of the Regulation.

In the present case, the Municipality should, in fact, have considered—for the purpose of properly assessing the severity of the risk arising from the breach and its consequences on the data subject rights and freedoms—additional relevant factors such as: with regard to TARI users, the number of data subjects involved and the types of data affected (in particular, the data subjects’ identifying information and residential addresses), as well as the fact that such data were capable of revealing highly personal information—such as, for example, the data subject’s standard of living as inferred from the type of residence (upscale, public housing, low-income), since this circumstance can be inferred from the TARI user category assigned to each taxpayer—and capable of entailing a high level of risk to the rights and freedoms of the individuals involved (e.g., increased exposure to theft, discrimination, etc.).

Second, with regard to notification to data subjects, it should be noted that the aforementioned Article 34 of the Regulation provides that such notification “shall describe in clear and plain language the nature of the personal data breach and shall contain at least the information and measures referred to in Article 33, paragraph 3, subparagraphs (b), (c), and (d)” (para 2). Regarding the methods for notifying data subjects of the breach, Art 34(3) of the Regulation provides specific exemptions from direct notification to data subjects where such notification “would entail a disproportionate effort”; nevertheless, even under such circumstances, the obligation to inform data subjects—albeit not directly—regarding the high-risk nature of the breach remains. In this regard, it should be noted that “Guidelines 9/2022 on the notification of personal data breaches under the GDPR,” adopted by the European Data Protection Board on XX, state that “in principle, the breach should be communicated directly to the data subjects involved, unless this would require a disproportionate effort.

In such a case, a public announcement or a similar measure that allows the data subjects to be informed with equivalent effectiveness shall be made (article 34(3)(c)).” In the case at hand, it should be noted that the notification made by the Municipality through the publication of a Press Release on XX on its official website—subsequently republished, as stated by the Municipality, “through two selected local newspapers (‘RietiLife’ and ‘Format Rieti’”)” —does not constitute a suitable means of fulfilling the obligations set forth in Art. 34 of the Regulation. In fact, the press release itself expressly stated that “We promptly took the steps required by law, activating the protocol and thereby also notifying the Privacy Commissioner, in which we indicated our willingness to inform the public of the incident when the Privacy Commissioner […] indicated [to the Municipality] that it was necessary,” thereby implying that the assessments falling within the Municipality’s purview—aimed at determining whether to notify the data subjects, which had, moreover, been improperly delegated to the Authority—were still ongoing.

The inadequacy of the aforementioned statement is further evident from the fact that it provided no details on the types of personal data involved in the breach, nor did it identify the categories of data subjects affected; it merely contained incorrect information (namely: “the published document contained […] data on legal entities, which do not fall within the scope of privacy regulations”), without, moreover, disclosing what was acknowledged in the note dated XX regarding the possibility that, in the case of sole enterprises, one or more natural persons may be identified from the business name. On this point, it should be noted that specifying the types of personal data subject to the data breach—as well as the additional information referred to in Art. 33, para. 3, subparagraph b), (c) and (d) of the Regulation—is necessary in order to fully inform data subjects about the actual nature of the data breach that occurred and to make them aware of its possible consequences.

This information is also essential for effectively identifying the most appropriate forms of protection, in accordance with the principle of transparency and the obligations associated with it, in compliance with the provisions of Articles 5(1)(a), para 1, letter a), 12(1), and 34 of the Regulation, especially in Recital 3, where it is stated that, in the present case, the measures adopted by the Municipality following the breach (specifically, the removal of the Decision and its annexes from the institutional website on XX, that is, ten days after publication) were not sufficient to entirely prevent the occurrence of a high risk to the data subject rights and freedoms. Indeed, during the period in which the personal data were erroneously published, it was found that “The total number of downloads of the decision and/or the attachments was 31 […all] by external parties […while the number] of views of the decision and/or its attachments was 57 (fifty-seven), of which 13 (thirteen) were by […municipal] employees and 44 […] by external parties.”

In addition, it should be noted that the aforementioned notice was not readily accessible to the data subjects. In this regard, it should be noted that the “Guidelines 9/2022 on the notification of data breaches under the General Data Protection Regulation (GDPR),” adopted by the European Data Protection Board on March 28, 2023, while recommending the use of multiple communication channels, also clarify that the primary objective of the notification referred to in Article 34 of the Regulation is to help data subjects understand the nature of the breach. This objective certainly cannot be considered achieved if, as in the case at hand, the notification requires data subjects to conduct a specific search. This is because the press release published on the Municipality’s previous institutional website (homepage URL: https://..., press release URL: https://...), in addition to having a misleading title—“Response […to a council member]: No Delay or Reluctance, but Strict Enforcement of the Rules,” which is not immediately attributable to the breach that occurred, was available only in the Press Release section of the aforementioned website.

For the reasons set forth above, it has been established that the Municipality failed to provide the data subjects involved with adequate notice regarding the data breach that occurred, as well as to conduct an adequate risk assessment in relation to it, in violation of Articles 5, para 1, subparagraph a), para 2, 12(1), 24, and 34 of the Regulation. 4. Conclusions In light of the assessments referred to above, it is noted that the statements made by the Municipality during the preliminary investigation—for the veracity of which it may be held accountable pursuant to Art. 168 of the Code—although worthy of consideration, do not suffice to rebut the findings notified by the Office in the notice initiating the proceedings and are insufficient to warrant the dismissal of these proceedings pursuant to Art. 14, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, as none of the cases provided for in Art. 11, as referenced therein, apply.

The Office’s preliminary assessments are therefore confirmed, and the processing of personal data by the Municipality is found to be unlawful, as it processed personal data in violation of Articles 5, paragraph 1, subparagraphs (a), (c) and (f), and Articles 2, 12(para 1), 24, 25, 32, and 34 of the Regulation. The violation of the aforementioned provisions renders applicable the administrative sanctions provided for in Article 83, paragraphs 4 and 5, of the Regulation, pursuant to Articles 58, para 2, subparagraph (i), and 83, para 3, of the same Regulation, as also referred to in Article 166, para 2, of the Code. However, given that the effects of the conduct have ceased, the conditions for adopting further corrective measures under Article 58, para 2, of the Regulation do not apply. 5. Adoption of the injunction order for the imposition of the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code) The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction, by which it also orders the application of the ancillary administrative sanction of its publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019).

Given that the Municipality’s violation of the aforementioned provisions occurred as a result of conduct that can be considered a single act (the same processing operation or interconnected processing operations, insofar as they relate to the same violation), Art 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, the most serious violations, relating to Articles 5 and 12 of the Regulation, are subject to the penalty provided for in Article 83, para 5, of the Regulation—as also referred to in Art 166, paragraph 2, of the Code—the total amount of the fine shall be set at up to 20,000,000 euros (twenty million/00). The amount of the aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Art. 83, para. 2, of the Regulation.

With specific regard to the nature and severity of the violation (Article 83, para 2, subparagraph a) of the Regulation), it must be considered that the data breach that occurred affected, particularly with regard to TARI users, a large number of data subjects (over 31,000) and involved not only identifying information and residential addresses but also highly personal information—such as, for example, the data subject’s standard of living as inferred from the type of residence (luxury, public housing, low-income housing), based on the TARI user category assigned to each taxpayer—which, taken together, are likely to pose a high level of risk to the rights and freedoms of the individuals involved (e.g., increased exposure to theft, discrimination, etc.). In any case, with regard to the duration of the breach that occurred, it must be considered that it lasted for a limited period of time, during the summer (late August and early September).

Furthermore, the following must be taken into account: - the negligent nature of the breach (Article 83(2)(b) of the Regulation); - that the processing operations in question do not relate to special categories of data (Article 83(2)(g)). In light of these circumstances, it is considered that, in this case, the severity of the violation committed by the controller can be deemed moderate (see European Data Protection Board, “Guidelines 04/2022 on the calculation of administrative fines under the GDPR” of May 23, 2023, paragraph 60). That said, it is considered that, for the purposes of determining the amount of the fine, the following circumstances should be taken into account in the controller’s favor: the fact that the controller is a small municipality, that there are no prior relevant violations committed by the controller, and the instance of cooperation demonstrated by the controller with thesupervisory authority in order to remedy the violation and mitigate its possible negative effects, having, in particular, adopted “as of the month of XX, a new procedure that currently requires active action on the part of the operator when uploading attachments […and] provided information to municipal employees as well, in order to promote informed action by individual operators at the time of uploading” (Art. 83, para. 2, subpars.

(e) and (f), of the Regulation). In light of the aforementioned factors, evaluated as a whole, it is determined that the amount of the monetary penalty shall be 6,000.00 (six thousand/00) euros for the violation of Articles 5, paragraph 1, subparagraphs (a), (c) and (f), and 2, 12, para 1, 24, 25, 32, and 34 of the Regulation, as an administrative fine deemed, pursuant to Art 83, para 1, of the Regulation, to be effective, proportionate, and dissuasive. In this context, it is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the fact that the Violation involved personal data pertaining to a large number of data subjects and, taken as a whole, is likely to entail a high level of risk to the rights and freedoms of the individuals concerned.

Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by the Municipality of Rieti was unlawful under the terms set forth in the reasoning, for violation of Articles 5(1)(a), (c) and (f), and Articles 2, 12(para 1), 24, 25, 32, and 34 of the Regulation; ORDERS pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the Municipality of Rieti, with its registered office at Piazza Vittorio Emanuele II No. 1, 02100, Rieti, Tax ID No. 00100700574, to pay the sum of 6,000.00 (six thousand/00) euros as an administrative fine for the violations set forth in the grounds of this decision. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed fine; ORDERS the Municipality of Rieti: - to pay the sum of 6,000.00 euros (six thousand/00) in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, in accordance with the procedures set forth in the attachment, within thirty days of service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981; ORDERS pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this decision on the Data Protection Authority’s website; pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the entry of this decision in the Authority’s internal register, as provided for in Article 57, para 1, subparagraph (u), of the Regulation.

Pursuant to Article 78 of the Regulation, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, under penalty of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 14, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montouri [Web Doc. No. 10286417] Decision of July 14, 2026 Register of Decisions No. 523 of July 14, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc.

No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having regard to the documentation on file; Having regard to the observations made by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Ginevra Cerrina Feroni; PREAMBLE 1. Introduction In a complaint submitted to the Authority pursuant to Art. 144 of the Code on XX, the dissemination of personal data on the institutional website of the Municipality of Rieti (hereinafter, the “Municipality”) was specifically alleged, including the personal data of TARI taxpayers. The aforementioned report specifically cited a news article stating that “The administration […] exposed the personal data of over 31,000 citizens, putting them at risk of identity theft and fraud. […on XX] a file of over 2,000 pages was in fact published, in which the personal data of Rieti citizens and enterprises were left fully exposed: first name, last name, tax ID numbers and addresses, as well as property records, addresses, user categories, and the square meters of the properties they own and on which they pay the TARI” […the] mayor, […] did not deem it necessary to immediately inform citizens of this serious breach. […] the administration […] removed the document and the related resolution, as if nothing had happened” (see URL https://...).

In response to the aforementioned article, the Municipality, as verified by the Office on XX, issued a statement declaring that it “acted as promptly as possible,” and asserting that “there was no concealment regarding the matter, but rather the procedures outlined in protocols for similar cases were scrupulously followed. The error was detected by municipal staff, and the Administration immediately took the required action, namely, the removal of the document. It should also be noted that the published document contained personal data—which was neither sensitive nor of a judicial nature—as well as data pertaining to legal entities, which do not fall within the scope of privacy regulations. We promptly took the steps required by law, activating the protocol and consequently also filing a report with the Privacy Authority, in which we expressed our willingness to inform the public of the incident should the Authority itself […] indicate [to the Municipality] that it was necessary. […] There was, therefore, no reluctance or delay, but merely the application of the provisions of the law” (see press release dated XX, URL https://...). 2.

The Preliminary Investigation 2.1. The Data Breach That Occurred Regarding the data breach that occurred, the Municipality, in a note filed under ref. no. XX on XX, notified the Authority, pursuant to Article 33 of the Regulation, specifically that: - “On XX, Resolution No. XX of XX was erroneously published on the Municipal Notice Board along with its attachments, which were, in any case, merely part of the case file and were not intended for publication (including Service Contract XX) […] the aforementioned Service Contract XX includes, among its attachments, the list of the Company’s employees (first and last names of 50 individuals), the Business Plan, and the TARI registry (approximately 31,000 accounts, including both individuals and legal entities, with details such as tax ID number, first and last names, residence, cadastral data, and addresses of properties subject to taxation, as well as the taxable area).

Upon verifying the erroneous publication of the aforementioned document and its annexes on XX, the publication was immediately removed from both the Municipal Notice Board and the “Transparent Administration” section (Section F, Point 7); - The systems involved in the breach are the “Software for managing the Municipal Notice Board and the ‘Transparent Administration’ Section provided by the company XX […]” (Section F, Point 8); - The technical and organizational measures in place at the time of the breach consist of “Awareness-raising and training for staff involved in data processing and related control activities” (Sec. F, Point 9); - The data affected by the breach included personal identification data (first name, last name, gender, date of birth, place of birth, tax identification number), as well as data related to registration in the municipality’s TARI registry (i.e., property records and addresses of taxable properties, taxable area) of approximately 31,050 data subjects, including Users, contractors, subscribers, and current or potential customers (Sec. F, points 10, 11, and 12); specifically, the data subjects involved are “employees of XX” and “natural or legal persons required to be registered in the TARI registry” (Sec F, point 14); - The data were disclosed beyond the scope of the privacy notice or the applicable regulations and can be linked, without unreasonable effort, to other information relating to the data subjects (Sec. G, point 1.1); - the breach resulted in unauthorized third parties gaining access to the data (Sec. G, point 2), and the severity of the potential impact on the data subjects was assessed by the Municipality as negligible (Sec. G, point 3).

In the aforementioned notification, it was also stated that on XX, the data was “removed from both the Municipal Bulletin and the ‘Transparent Administration’ Section,” and that among the technical and organizational measures adopted (or to be adopted) to prevent similar future breaches, there is the “Amendment of the controller’s policies regarding data protection, including the assignment of accountability, awareness-raising, and training of staff involved in processing and related oversight activities” (Section H, points 1 and 2). In the same breach notification, the Municipality stated that the notification to data subjects required by Article 34 of the Regulation was not provided because “the breach is unlikely to pose a high risk to the rights and freedoms of natural persons,” since “The published lists do not contain personal data as referred to in articles 9 and 10 of EU Regulation 2016/679” (Section I, point 1, and Section L, point 1). 2.2.

Responses to Requests for Information In letters dated XX and XX (ref. nos. XX and XX, respectively), the Municipality responded to the requests for information made by this Authority pursuant to Article 157 of the Code (see notes ref. nos. XX of XX and XX of X), providing clarifications regarding the following issues: a. Regarding how the Municipality became aware of the breach that occurred on XX, as well as the extent of the disclosure of personal data contained in Decision No. XX of XX and its annexes (hereinafter, the “Decision”), the Municipality stated, in particular, that: - “On XX, the employee […] responsible for publishing the document in question was absent […]. On XX, […] the employee reviewed the published documents and noticed the breach. On the same day, he reported the matter […] and removed the publication. On the morning of XX, he notified the DPO of the incident for an assessment of the breach […]” (see note dated XX); - “[…] the publication of the document in question was a mere clerical error that led to the violation and was committed due to the simultaneous publication of another document” (see note dated XX); - “The total number of downloads of the decision and/or the attachments was 31 (thirty-one), all of which were made by external parties.

The total number of views of the decision and/or the attachments was 57 (fifty-seven), of which 13 (thirteen) were by employees of this municipality and 44 (forty-four) were by external parties” (see Note XX); b. With regard to the legal basis and the processing purpose carried out through the publication of the Decision in the Municipal Gazette and in the “Transparent Administration” Section of its institutional website, the Municipality stated that “The legal basis for the processing is found in Article 6(1)(c) of the Regulation for the purposes of the legal obligations incumbent upon the Controller as imposed by Law No. 69 of June 18, 2009, No. 69 for the Municipal Notice Board and by Legislative Decree No. 33 of March 14, 2013, for the ‘Transparent Administration’ Section of the institutional website” (see note XX); c. With regard, however, to the legal basis and processing purpose carried out by the Municipality in relation to the personal data of the employees of XX (hereinafter “XX”), including in connection with the publication of the Resolution “XX […] is a company with the Municipality as its sole shareholder […] operating in the following public utility sectors […including] Waste management, Public sanitation, […] Based on the Economic and Financial Plan for the year XX (also referred to in Resolution No. XX of XX), please refer to the contract between the Municipality of Rieti and its subsidiary […] included among the annexes to Resolution No. XX of XX […].

As part of the routine exchange of information between the Administration and its subsidiary, notice was given regarding the violation in question, requesting proper documentation regarding any reports or complaints. As of today, nothing has been communicated in this regard” (see note dated XX); d. With regard to the categories of legal entities involved in the violation in question, the City has clarified that: - “The legal entities involved are enterprises, professional partnerships, and partnerships or corporations, including consortia and cooperatives, […] Among these, sole enterprises and partnerships may, in their names, identify one or more natural persons, as reflected in the official database of the Chambers of Commerce, which is available upon request” (see note dated XX); - “[…] the number of data subjects indicated in the data breach notification […] ref. no. XX of XX also includes legal entities (e.g., sole enterprises, etc.), from whose business names one or more natural persons can be identified”; furthermore, “the published data concerning real estate owned by natural and/or legal persons is easily accessible to anyone with an account on the Revenue Agency’s SISTER platform, which is intended in particular for both independent professionals (engineers, accountants, etc.) and public entities” (see note XX); e. With regard to the other parties involved in the processing of the personal data subject to a data breach and the role they play in relation to data protection regulations, the Municipality has stated that “Company XX is the economic operator entrusted with managing the Municipal Register and the ‘Transparent Administration’ Section of the institutional website, designated as the processor (Art. 28 of the Regulation) […]” (see note XX); f. With regard, however, to the specific technical measures, as well as the organizational measures (in addition to those already indicated in the notification pursuant to Article 33 of the Regulation) in place at the time of the breach, the Municipality stated that: - “The persons entrusted with processing during the period from XX to XX were informed and trained—including through operational instructions—on the obligations regarding data protection imposed by the Regulation, the Code, and the relevant provisions of the Data Protection Authority, as amended in conjunction with the provisions on transparency in administrative acts and anti-corruption […]” (see note dated XX);Following the data breach […] the instructions contained in the document […] dated XX […] were deemed current and applicable, and the “XX” edition, revision XX, dated XX […] was prepared and distributed to managers” (see note dated XX); - “During the period between XX and XX, employees involved in data processing and related control activities (Art. 29 of the Regulation) […]” were trained and made aware of their responsibilities, including those from the Office responsible for publishing the Decision (see note XX); - Regarding the operational logic of the software for managing the Municipal Bulletin provided by the company XX (hereinafter, the “Supplier”) in relation to the document publication process: “The software is configured by default to publish attachments.

Therefore, if a document is not to be published, the operator must remove the “Publish” flag. In this way, the attachment will not be visible either on the public notice board or in the online services” (see Annex XX “Report XX” attached to Note XX); g. Finally, regarding the risk assessment conducted by the Municipality concerning the severity of the breach that occurred and the reasons why it decided not to notify the data subjects pursuant to Art 34 of the Regulation, as well as any additional risk mitigation measures adopted, the Municipality stated that: - “On XX, the data breach was analyzed […] and on the same date, a formal report was filed with the Data Protection Authority. The report indicated that, despite the high number of data subjects affected by the data breach, since the published personal data did not fall within the categories referred to in Articles 9 and 10 of the Regulation, it was decided, initially, not to notify the data subjects as required by Article 34 of the Regulation, deferring the decision to any instructions the Data Protection Authority might issue on the matter (Article 34(4) of the Regulation).

Nevertheless, on XX, in response to the news article published in the online newspaper RietiLife […] the Municipality issued a Press Release reporting the incident and the actions taken, both to the councilwoman and to the data subjects involved in the data breach (in compliance with Article 34(1) of the Regulation), via the same online news outlet and the institutional website […]” (see note dated XX); - “Following the data breach and the initiation of the investigation […] further clarification was sought regarding the configuration of the software used for publication on the municipal bulletin board. Subsequently, on XX, the […Municipality] conducted a DPIA on the software used to manage the municipal bulletin board and received a favorable opinion from the DPO on the same date. The risk assessment revealed that, since the staff responsible for publication had been appropriately trained on issues related to personal data protection, human error can be considered UNLIKELY, as is the use of the publication software by individuals outside this Municipality” (see note dated XX).

With regard to the Municipality’s conduct, the Office, based on the evidence gathered and the facts that emerged following the preliminary investigation, notified the Municipality, by note dated XX (ref. no. XX) pursuant to Article 166, paragraph 5, of the Code, the initiation of proceedings for the adoption of the measures referred to in Article 58, para 2, of the Regulation for having acted: - in violation of the principles of lawfulness, fairness, and transparency; data minimisation; and integrity and confidentiality, as well as the principle of accountability referred to in Art 5, para 1, subparagraphs (a), (c), and (f) of the Regulation; - in violation of Articles 5(2) and 24 of the Regulation; - in violation of the principles of privacy by design and by default referred to in Art 25 of the Regulation; - in violation of the security obligations set forth in Article 32 of the Regulation; - in violation of Articles 12(1) and 34 of the Regulation.

By the aforementioned order, the Municipality was invited to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). By letter dated XX (Ref. No. XX), to which full reference is made, the Municipality submitted a brief setting forth its defense arguments, which were subsequently reaffirmed in substance during the hearing held on XX (see minutes, Ref. No. XX, of the same date), and concluded with a letter dated XX (Ref. No. XX), in which the Municipality stated, in particular, that: - “The violation concerned the publication, limited to the period from XX to XX, of general data pertaining to the data subjects (identification and cadastral data)”;the erroneous publication did not result in significant harm or high risks to the data subject rights and freedoms, taking into account the following mitigating circumstances: a) personal data can be obtained by anyone who requests it from the Municipality’s registry office, in accordance with the provisions of Presidential Decree 233/1989, while cadastral information […] is available through an online service on the dedicated portal set up by the Revenue Agency, which allows anyone to access the database. b) despite the considerable amount of data published, there were only 57 views (13 of which were by employees of the entity—who, as such, are bound by confidentiality obligations—and 44 by external parties); c) the duration of the breach was essentially brief (11 calendar days); d) only one data subject filed a complaint pursuant to Article 77 of the GDPR” (see note XX); - “The breach resulted from a mere clerical error by […the individual who published the document], who […] found themselves having to personally publish the document on the Municipal Notice Board and, due to a technical IT issue (of which they were unaware), unknowingly and through an automated process unknown to them, submitted the attachments to the main document for publication (Resolution No. XX of XX) […] failing to realize that the computer system, by default and without any further manual action by the operator, publishes the documents attached to the main document”; - “the error was committed due to the simultaneous publication of another document, carried out in accordance with the obligations arising from Law No. 69/2009 and Legislative Decree No. 33/2013, and, therefore, the agent was fully convinced of the fairness of his actions […] It also seems appropriate to note not only the accidental nature of the violation but also its isolated nature, as there have been no previous violations of the GDPR committed by the Entity” (see note XX); - “The Entity immediately took action with the software company that manages the municipal IT service to have specific alerts implemented for the operator responsible for publishing on the online municipal bulletin board, so that every document to be published can be ‘knowingly flagged’ by checking the relevant box […and] in order to prevent a recurrence of incidents similar to the one that occurred, it has implemented a procedural change that allows the publication option to be selected with full awareness.

In particular, it has deactivated the setting that triggered the automatic publication of attachments in Application XX, thereby allowing the manual selection of whether or not to publish a document” (see note dated XX); - “It is also noted that a request was made to the supplier—[…] via an open ticket on XX […] to modify the logic of the “XX” platform used for the online publication of resolutions and other documents, with the supplier itself releasing a new procedure into production starting in the month of XX, which currently requires active intervention by the operator to upload attachments. Information regarding the aforementioned procedure was also provided to municipal employees in order to promote informed action by individual operators at the time of uploading. The Municipality has, therefore, adopted additional measures to prevent the recurrence of violations similar to the one that occurred.

In this regard, it is noted that, with the exception of the Violation, even under the platform XX’s previous operating procedures, there were never any instances—nor were any detected—of attachments containing personal data being published alongside documents subject to mandatory publication (see the XX hearing transcript); - “With regard to the Violation in question, […] among the various measures adopted, a press release was issued on the Municipality’s previous institutional website and subsequently republished in two selected local newspapers (“RietiLife” and “Format Rieti”)”” (see minutes of the hearing of XX). 3. Outcome of the Preliminary Investigation 3.1. Legislation on Data Protection. Based on the findings of the Authority’s preliminary investigation, it should be noted that the processing of personal data must comply with applicable personal data protection laws and, in particular, with the provisions of the Regulation and the Code.

First, it should be noted that “personal data” means “any information relating to an identified or identifiable natural person (‘data subject’).” Furthermore, “a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person” (Art. 4, para. 1, no. 1, of the Regulation). With regard to the principles governing data protection, Article 5, para 1, subparagraphs (a) and (c), of the Regulation stipulates that personal data must be processed lawfully, fairly, and transparently in relation to the data subject, and must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed (the principles of “lawfulness, fairness, and transparency” and “data minimization”).

In accordance with the aforementioned principle of transparency, Article 12, para 1, of the Regulation provides, in particular, that the controller shall take appropriate measures to provide the data subject with the information referred to in Article 34 in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, particularly in the case of information specifically intended for children. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. Furthermore, pursuant to Art. 5, para. 1, subparagraph (f) of the Regulation, personal data must be processed “in a manner that ensures appropriate security” […], including protection, through appropriate technical and organizational measures, against unauthorized or unlawful processing and against accidental loss, destruction, or damage” (principle of integrity and confidentiality).

In this regard, Article 32 of the Regulation provides, in particular, that: the controller, “taking into account the state of the art and the cost of implementation, as well as the nature, scope, context, and processing purposes, and the risk of varying likelihood and severity to the rights and freedoms of natural persons, [shall] implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, among others, where applicable: […] b) the ability to ensure, on an ongoing basis, the confidentiality, integrity, availability, and resilience of processing systems and services; […] d) a procedure for regularly testing, verifying, and evaluating the effectiveness of the technical and organizational measures to ensure the security of the processing” (para. 1); “When assessing the appropriate level of security, special consideration shall be given to the risks posed by the processing, arising in particular from the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed” (para 2).

In addition, Article 25 of the Regulation requires the controller to: “taking into account the state of the art and the costs of implementation, as well as the nature, scope, context, and processing purposes, and the risks of varying likelihood and severity to the rights and freedoms of natural persons posed by the processing, both at the time of determining the means of processing and at thetime of processing itself [to implement] appropriate technical and organizational measures, such as pseudonymisation, designed to effectively implement data protection principles, such as data minimisation, and to incorporate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects” (principle of privacy by design, para. 1); to implement “appropriate technical and organizational measures to ensure that, by default, only personal data necessary for each specific processing purpose are processed.

This obligation applies to the amount of personal data collected, the scope of the processing, the storage period, and accessibility. In particular, these measures ensure that, by default, personal data are not made accessible to an indefinite number of natural persons without the intervention of the natural person” (principle of privacy by default, para. 2). Finally, pursuant to Article 5, para 2 of the Regulation, it should be noted that the controller is responsible for compliance with the principles governing data protection and must be able to demonstrate such compliance (“accountability”) and that, pursuant to Article 24, para 1, of the Regulation, the controller—taking into account the nature, scope, context, and processing purposes, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons — implements appropriate technical and organizational measures to ensure, and be able to demonstrate, that processing is carried out in accordance with the Regulation. 3.2.

Violation of the principles of lawfulness of processing, data minimisation, and the integrity and confidentiality of personal data, as well as data protection by design and by default. Following the preliminary investigation, it emerged, in summary, that on XX, the following was published on the Municipality’s official website—both in the Municipal Notice Board and in the “Transparent Administration” Section: — Resolution No. XX of XX concerning “XX,” including the relevant attachments, such as the service contract with the company XX, along with additional documentation, including, in particular, the list of XX personnel assigned to the urban sanitation service, as well as the list of TARI accounts. This publication resulted in the disclosure of data and information regarding taxpayers associated with the TARI accounts—registered in the names of both individuals and legal entities—including, in particular, tax identification number, first and last name, residential address, TARI account code and category, cadastral data, address and area of the properties subject to taxation, as well as personal data (first and last name) pertaining to certain employees of company XX (hereinafter, the “Violation”).

In this regard, it should be noted that, although the Municipality represented, in particular, that the Violation resulted from “a mere clerical error […] committed due to the simultaneous publication of another document,” that “on XX, the employee […] responsible for publishing the document in question was absent,” and that the “Manager […] found himself having to personally publish the document on the Municipal Notice Board, and, due to a technical IT issue (of which he was unaware), unwittingly and through an automated process of which he was unaware, submitted the attachments to the main document for publication,” the software used at the time of the events was found to be configured “by default to publish attachments” (see Attachment XX “Report XX” attached to the note dated XX). This setting was caused by the absence of measures designed to limit publication to only those acts and documents required by law, as the “Publish” field was selected by default, with the result that removing the corresponding checkmark was effectively left to the active intervention of the designated operator (see Annex 4 cited above).

In this regard, although the Municipality has represented that it took action with the provider managing the “XX” platform to modify the aforementioned functionality as early as XX—following the violation that occurred—it should be noted that, based on the documentation produced during the preliminary investigation, it is evident only that the aforementioned request had been acknowledged by the provider itself; however, the case file contains no record of any follow-up or communications between the Municipality and the provider aimed at urging the actual modification of the feature. It should also be noted that, based on the evidence provided, the ticket initially opened by the Municipality appeared to be of a purely preliminary nature, as its subject line read “Ticket #XX – Publication of attachments to documents – suggestion to change default settings” (see “Presa_in_carico_del_ticket” attached to the note dated XX).

This conclusion is also confirmed by the fact that, in the subsequent exchange of correspondence between the Municipality and the same supplier, reference was made to a later ticket, titled “Re: Ticket #XX – GPDP – Report regarding the disclosure of personal data. Request for a report,” in which the Supplier, on XX, had provided further explanations regarding the fact that “the software is configured by default to publish attachments. Therefore, if a document is not to be published, the operator must remove the “Publish” flag [...] (see Attachment 4 “Report XX,” cited above). That said, it should be noted that the aforementioned default setting conflicts, first and foremost, with the aforementioned principle of integrity and confidentiality of the personal data of data subjects, as well as with the principles of privacy by design and by default referred to in Art. 25 of the Regulation, given that the default uploading of records and documents, as well as their attachments—including large files, as in the present case—entails greater exposure to risks for the personal rights and freedoms of data subjects, where, as in the present case, the individual user does not deselect the option for default publication.

It is therefore clear that a software setting that does not allow users to select which records and documents to publish (opt-in), but only to exclude their publication, if necessary (opt-out), entails a considerable increase in the risk of loss of data confidentiality, especially in the event of human error or system bugs. This default setting is also contrary to the principles of lawfulness and data minimization set forth in Art. 5(1)(a) and (c) of the Regulation, particularly in light of the legislation—expressly cited by the Municipality—which generally provides for the publication of acts, information, and documents for the purpose of legal publicity (see, in particular, Law No. 69/2009, but see also Legislative Decree No. 267/2000) or for the purpose of administrative transparency (Art. 14 of Legislative Decree No. 33/2013). In this regard, in fact, before disseminating any personal data relating to data subjects online, the controller is, in any case, required to verify which data and information to publish, while ensuring full compliance with data protection regulations, with specific reference to the relevance and proportionality of the data disclosed.

Over time, the Data Protection Authority has provided specific guidance to public administrations regarding the precautions to be taken when publishing personal data on the Internet for the purposes of transparency and public disclosure of administrative actions; in particular, in 2014, with the “Guidelines on the Processing of Personal Data, Including Data Contained in Administrative Records and Documents, Carried Out for the Purposes of Publicity and Transparency on the Web by Public Entities and Other Obligated Bodies” (Provision No. 243 of May 15, 2014, Web Doc. No. 3134436, Parts I and II, specifically para. 3.a). In this context, even under the previous regulatory framework, a series of principles were identified whose relevance can still be considered valid today, and it was clarified (and also confirmed in numerous subsequent decisions) that the existence of a disclosure regime cannot entail any automatic dissemination of personal data online nor a derogation from the principles governing the data protection, as confirmed by the data protection system contained in the Regulation, in light of which the controller is required to “implement appropriate technical and organizational measures to ensure that, by default, only the personal data necessary for each specific processing purpose are processed” and must be “able to demonstrate” —in accordance with the principle of “accountability”—that they have done so pursuant to Articles 5(2), 24, and 25(2) of the Regulation.

On such occasions, the Data Protection Authority has reiterated that all the limitations set forth by the principles governing data protection also apply to the publication of acts or resolutions on the online municipal bulletin board, with particular regard first to the prior verification of the existence of suitable grounds for the lawfulness of the online dissemination of the personal data contained therein —as the data controller must first verify the existence of a specific legal provision authorizing such disclosure as a suitable legal basis—and to the minimization of such data (see, among many others, most recently, Decision No. 423 of July 17, 2025, Web Doc. No. 10181686, and the precedents cited therein). As for the Municipality’s reference to the transparency obligations set forth in Legislative Decree No. 33 of March 14, 2013, it should be noted that even in such cases, publication in the Section “Transparent Administration” must be carried out in accordance with the procedures and in the format expressly provided for by the aforementioned regulatory framework and by the guidelines issued over time by the National Anti-Corruption Authority, as only the specific information enumerated by that regulatory framework is subject to publication, and not, however, the full texts of administrative documents (see FAQs on transparency regarding the application of Legislative Decree No. 33/2013, available on the ANAC website | Home page - www.anticorruzione.it at https://www.anticorruzione.it/chiedilo-ad-anac/-/categories/119067).

It should be noted that, even with regard to any publication in the “Transparent Administration” section of the institutional website, the data controller must always verify—based on a responsible and careful assessment—which data and information to publish in accordance with the sector-specific regulations governing the methods, timing, and forms of disclosure (see, most recently, Provision No. 423 of July 17, 2025, cited above). It is further noted that the observations made by the Municipality during the preliminary investigation regarding the fact that, with respect to the violation in question, “the published data concerning real estate owned by natural and/or legal persons are easily accessible to anyone with an account on the Revenue Agency’s SISTER platform, which is intended in particular for both independent professionals (engineers, accountants, etc.) and public entities.” In this regard, it must be emphasized that the breach resulted, for a considerable number of data subjects, in the disclosure of a vast amount of personal data, making it freely and immediately accessible to anyone.

This situation differs substantially—in terms of scope and accessibility—from a scenario in which similar information might be obtained through selective queries of separate information systems, which require specific search operations, do not allow for immediate access, and pertain, on a case-by-case basis, to individual data subjects who have been previously identified. In light of the reasons set forth above, it is therefore established that the measures adopted by the Municipality, at least up until the month of XX, regarding the procedures for uploading its documents to the institutional website, were not adequate to ensure—from the design stage and by default— neither compliance with the principles of lawfulness of processing and data minimisation, nor a level of security appropriate to the risk, as they were unable to ensure, on a permanent basis, the confidentiality of the personal data processed and thus resulted in the Municipality’s violation of Articles 5(1)(a), (c) and (f), 25, and 32 of the Regulation. 3.3.

Failure to adopt adequate measures to promptly detect and manage the Data Breach. In addition to the observations made in paragraph 3.2 above, during the investigation—and based in part on the assessment criteria provided by the Municipality—it became apparent that the additional measures adopted to detect the Data Breach were inadequate. Pursuant to the aforementioned Art 25 of the Regulation, the controller is in fact required to implement the data protection principles (Article 5 of the Regulation) by adopting appropriate technical and organizational measures and incorporating into the processing the necessary safeguards to meet the requirements of the Regulation and protect the rights and freedoms of data subjects. In particular, in order to ensure compliance with the principles of integrity and confidentiality (Article 5(1)(f) of the Regulation), the controller must constantly assess whether, at any stage of the processing, it is using appropriate means and suitable measures to address any vulnerabilities.

Furthermore, the controller must conduct periodic reviews of the security measures put in place to safeguard and protect personal data (see Recital 78 of the Regulation and “Guidelines 4/2019 on Article 25: Data Protection by Design and by Default,” adopted on XX by the European Data Protection Board, specifically points 84 and 85). In this regard, the “Guidelines on the Notification of Personal Data Breaches pursuant to Regulation (EU) 2016/679” of the Article 29 Working Party dated October 3, 2017, as last amended and adopted on February 6, 2018, and endorsed by the European Data Protection Board on May 25, 2018, further clarify that “the ability to promptly detect, address, and report a data breach must be considered an essential aspect” of the technical and organizational measures that the controller and processor must implement, pursuant to Article 32 of the Regulation, to ensure an adequate level of security for personal data.

With regard to the case at hand, the Municipality should therefore have conducted continuously verify the adequacy of the technical and organizational measures related to the personal data processing operations it had implemented, in order to prevent (or promptly detect) errors or anomalies in the data uploaded to the various Sections of the institutional website, by implementing appropriate measures to ensure a level of security commensurate with the risk. However, this did not occur in this specific case, given that the erroneous publication of the Resolution and its attachments was detected only later—on the XX—when the operator “responsible for publishing the document […had] resumed service, […] checked the publications made and realized the violation […thereupon] reported the matter […] and removed the publication.” The specific functionalities used and the technical measures adopted by the Municipality were therefore not sufficient to prevent and promptly detect the Breach and, consequently, must be considered non-compliant with the provisions of Articles 5(1)(f), 25, and 32 of the Regulation.

It should also be noted that, with regard to the adoption of the technical and organizational security measures necessary to ensure the compliance of the personal data processing operations carried out, although the Regulation also imposes specific obligations in this regard on the processor (Art. 32), it remains the case that the data controller is the entity bearing “overall accountability” for the processing of personal data carried out (see Art. 5(2) (so-called “accountability”) and Art. 24 of the Regulation), even when such processing is carried out by other entities “on its behalf” (Recital 81, Articles 4(8) and 28 of the Regulation). In light of the foregoing considerations, it is therefore established that the Municipality acted in violation of Articles 5(1)(f) and (2), 24, 25, and 32 of the Regulation, including with respect to the detection and handling of the data breach that occurred. 3.4.

Inadequate risk assessment and notification of the data breach to the data subjects. With regard to the data breach that occurred, the Municipality, believing that the breach was not likely to pose a high risk to the rights and freedoms of natural persons, initially failed to inform the data subjects, considering the severity of the potential impact on them to be negligible (see Sec. XX, Point XX, of the notification dated XX). Subsequently, during the preliminary investigation, it stated that “despite the high number of data subjects affected by the data breach, since the publication of the personal data in question did not fall within the categories referred to in Articles 9 and 10 of the Regulation, it was initially decided not to notify the data subjects as required by Art. 34 of the Regulation, deferring the decision to any instructions from the Data Protection Authority on the matter (Art. 34(4) of the Regulation),” and further specifying that “on XX, in response to the news article published in the online newspaper RietiLife […] the Municipality issued a Press Release reporting the incident and the actions taken, both to the councilwoman and to the data subjects involved in the data breach (in compliance with Article 34(1) of the Regulation), through the same online news outlet and the institutional website […].”

In this regard, it must be emphasized, first and foremost, that Article 34(1) of the Regulation stipulates that “where a data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the breach to the data subject without undue delay.” Indeed, it is the responsibility of the controller, through proactive and informed actions, to carry out the aforementioned risk assessment, in accordance not only with the provisions of the aforementioned Article 34 of the Regulation but also, more generally, with the principle of “accountability” referred to in Articles 5(2) and 24 of the Regulation. This assessment—which is distinct from the data protection impact assessment required by Article 35 of the Regulation, to be conducted before processing begins—must be carried out by the controller, taking into account all the circumstances of the specific case in order to correctly identify a specific level of risk severity, and must therefore not be limited to considering only whether a personal data breach affects data falling within the categories referred to in articles 9 and 10 of the Regulation.

In the present case, the Municipality should, in fact, have considered—for the purpose of properly assessing the severity of the risk arising from the breach and its consequences on the data subject rights and freedoms of the data subjects involved—additional relevant factors such as: with regard to TARI users, the number of data subjects involved and the types of data affected (in particular, the data subjects’ identifying information and residential addresses), as well as the fact that such data were capable of revealing highly personal information—such as, for example, the data subject’s standard of living as inferred from the type of residence (upscale, public housing, low-income), since this circumstance can be inferred from the TARI user category assigned to each taxpayer—and capable of entailing a high level of risk to the rights and freedoms of the individuals involved (e.g., increased exposure to theft, discrimination, etc.).

Second, with regard to notification to data subjects, it should be noted that the aforementioned Article 34 of the Regulation provides that such notification “shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in Article 33(3), subparagraphs (b), (c), and (d)” (para. 2). Regarding the methods for notifying data subjects of the breach, Article 34, paragraph 3, of the Regulation provides specific exemptions from direct notification to data subjects where such notification “would involve a disproportionate effort”; nevertheless, even under such circumstances, the obligation to inform data subjects—albeit not directly—regarding the high-risk nature of the breach remains. In this regard, it should be noted that “Guidelines 9/2022 on the notification of data breaches pursuant to the GDPR,” adopted by the European Data Protection Board on XX, state that “in principle, the breach should be communicated directly to the data subjects involved, unless this would require a disproportionate effort.

In such a case, a public announcement or a similar measure should be taken to inform the data subjects with comparable effectiveness (Article 34(3)(c))”. In the case at hand, it should be noted that the notification made by the Municipality through the publication of a Press Release on XX on its official website—subsequently republished, as stated by the Municipality, “in two selected local newspapers (‘RietiLife’ and ‘Format Rieti’”)” —does not constitute a suitable means of fulfilling the obligations set forth in Article 34 of the Regulation. In fact, the press release itself expressly stated that “We promptly took the steps required by law, activating the protocol and thereby also notifying the Privacy Commissioner, in which we indicated our willingness to inform the public of the incident when the Commissioner […] indicated [to the Municipality] that it was necessary,” thereby implying that the assessments falling within the Municipality’s purview—aimed at determining whether to notify the data subjects, which had, moreover, been improperly delegated to the Authority—were still ongoing.

The inadequacy of the aforementioned statement is further evident from the fact that it provided no details regarding the types of personal data involved in the breach, nor did it identify the categories of data subjects affected; it merely contained an incorrect statement (namely: “the published document contained […] data on legal entities, which do not fall within the scope of privacy regulations”), without disclosing, moreover, what was acknowledged in the note dated XX regarding the possibility that, in the case of sole enterprises, one or more natural persons may be identified from the business name. On this point, it should be noted that specifying the types of personal data subject to the data breach—as well as the additional information referred to in Art. 33, para. 3, subparagraph b), (c) and (d), of the Regulation—is necessary in order to fully inform the data subjects regarding the actual nature of the breach that occurred and to make them aware of its possible consequences.

This information is also essential for effectively identifying the most appropriate forms of protection, in accordance with the principle of transparency and the obligations associated with it, in compliance with the provisions of Articles 5(1)(a), para 1, letter a), 12(1), and 34 of the Regulation, especially Recital 34, which states that, in the present case, the measures adopted by the Municipality following the breach (specifically, the removal of the Decision and its annexes from the official website on XX, that is, ten days after publication) were not sufficient to entirely prevent the occurrence of a high risk to the data subject rights and freedoms. Indeed, during the period in which the personal data was erroneously published, it was found that “The total number of downloads of the decision and/or the attachments was 31 […all] by external parties […while the number] of views of the decision and/or the attachments was 57 (fifty-seven), of which 13 (thirteen) were by […municipal] employees and 44 […] by external parties.”

In addition, it should be noted that the aforementioned notice was not readily accessible to the data subjects. In this regard, it should be noted that the “Guidelines 9/2022 on the notification of data breaches pursuant to the General Data Protection Regulation (GDPR),” adopted by the European Data Protection Board on March 28, 2023, while recommending the use of multiple communication channels, also clarify that the primary objective of the notification referred to in Article 34 of the Regulation is to help data subjects understand the nature of the breach. This objective certainly cannot be considered achieved if, as in the case at hand, the notification requires data subjects to conduct a specific search. This is because the press release published on the Municipality’s previous institutional website (homepage URL: https://..., press release URL: https://...), in addition to having a misleading title—“Response […to a council member]: No Delay or Reluctance, but Strict Enforcement of the Rules,” which is not immediately attributable to the breach that occurred, was available only in the Press Release section of the aforementioned website.

For the reasons set forth above, it has been established that the Municipality failed to provide the data subjects involved with adequate notice regarding the breach that occurred and to conduct an adequate risk assessment in relation to it, in violation of Articles 5, para 1, subparagraph a), para 2, 12(1), 24, and 34 of the Regulation. 4. Conclusions In light of the assessments referred to above, it is noted that the statements made by the Municipality during the preliminary investigation—the veracity of which it may be called upon to verify pursuant to Art. 168 of the Code—while worthy of consideration, do not sufficiently address the objections notified by the Office in the notice initiating the proceedings and are insufficient to warrant the dismissal of these proceedings pursuant to Art. 14, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, as none of the cases provided for in Art. 11, as referenced therein, apply.

The Office’s preliminary assessments are therefore confirmed, and the processing of personal data by the Municipality is found to be unlawful, as it processed personal data in violation of Articles 5, paragraph 1, subparagraphs a), (c) and (f), and Articles 2, 12(para 1), 24, 25, 32, and 34 of the Regulation. The violation of the aforementioned provisions renders applicable the administrative sanctions provided for in Article 83, paragraphs 4 and 5, of the Regulation, pursuant to Articles 58, paragraph 2, subparagraph (i), and 83, paragraph 3, of the Regulation itself, as also referred to in Article 166, paragraph 2, of the Code. However, in this case, given that the conduct has ceased to have any effect, the conditions for adopting further corrective measures under Article 58, para 2, of the Regulation do not apply. 5. Adoption of the injunction order for the imposition of the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code) The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction, by which it also orders the application of the ancillary administrative penalty of publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019).

Given that the Municipality’s violation of the aforementioned provisions occurred as a result of conduct that can be considered a single act (the same processing operation or interconnected processing operations, as they pertain to the same violation), Art 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, the most serious violations, relating to Articles 5 and 12 of the Regulation, are subject to the penalty provided for in Article 83, para 5, of the Regulation—as also referred to in Art 166, paragraph 2, of the Code—the total amount of the fine shall be set at up to 20,000,000 euros (twenty million/00). The amount of the aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Art. 83, para. 2, of the Regulation.

With specific regard to the nature and severity of the violation (Article 83, para 2, subparagraph (a) of the Regulation), it must be considered that the data breach that occurred affected, particularly with regard to TARI users, a large number of data subjects (over 31,000) and involved not only identifying information and residential addresses but also highly personal information—such as, for example, the data subject’s standard of living as inferred from the type of residence (luxury, public housing, low-income housing), based on the TARI user category assigned to each taxpayer—which, taken together, could entail a high level of risk to the rights and freedoms of the individuals involved (e.g., increased vulnerability to theft, discrimination, etc.). In any case, with regard to the duration of the breach that occurred, it must be noted that it lasted for a limited period of time, during the summer (late August and early September).

Furthermore, the following must be taken into account: - the negligent nature of the breach (Article 83(2)(b) of the Regulation); - that the processing operations in question do not relate to special categories of data (Article 83(2)(g)). In light of these circumstances, it is considered that, in the present case, the severity of the violation committed by the controller can be deemed moderate (see European Data Protection Board, “Guidelines 04/2022 on the calculation of administrative fines under the GDPR” of May 23, 2023, paragraph 60). That said, it is considered that, for the purposes of quantifying the fine, the following circumstances should be taken into account in the controller’s favor: the fact that the controller is a small municipality, that there are no previous relevant violations committed by the controller, as well as the degree of cooperation demonstrated by the controller with thesupervisory authority in order to remedy the violation and mitigate its possible negative effects; in particular, the controller has adopted “as of the month of XX, a new procedure that currently requires active action on the part of the operator to upload attachments […and] provided information to municipal employees to promote informed action by individual operators at the time of uploading” (Art. 83, para. 2, subpars. e) and f), of the Regulation).

In light of the aforementioned factors, evaluated as a whole, it is determined that the amount of the monetary penalty shall be 6,000.00 (six thousand/00) euros for the violation of Articles 5, paragraph 1, subparagraphs (a), (c) and (f), and 2, 12, para 1, 24, 25, 32, and 34 of the Regulation, as an administrative fine deemed, pursuant to Article 83, para 1, of the Regulation, to be effective, proportionate, and dissuasive. In this context, it is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the fact that the Violation involved personal data relating to a large number of data subjects and, taken as a whole, is likely to entail a high level of risk to the rights and freedoms of the individuals involved.

Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 are met. NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by the Municipality of Rieti is unlawful under the terms set forth in the reasoning, for violation of Articles 5(1)(a), (c) and (f), and Articles 2, 12(para 1), 24, 25, 32, and 34 of the Regulation; ORDERS pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the Municipality of Rieti, with its registered office at Piazza Vittorio Emanuele II No. 1, 02100, Rieti, Tax ID 00100700574, to pay the sum of 6,000.00 euros (six thousand/00) as an administrative fine for the violations set forth in the grounds of this decision. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed fine; ORDERS the Municipality of Rieti: - to pay the sum of 6,000.00 euros (six thousand/00) in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, in accordance with the procedures set forth in the attachment, within thirty days of service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981; ORDERS pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this order on the Data Protection Authority’s website; pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the entry of this decision in the Authority’s internal register, as provided for in Article 57, para 1, letter u), of the Regulation.

Pursuant to Article 78 of the Regulation, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, under penalty of inadmissibility, within thirty days from the date of notification of the decision or within sixty days if the appellant resides abroad. Rome, July 14, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montouri