Garante: Bologna University Hospital rightly refused erasure of recruitment ranking data

SEE ALSO Newsletter of September 11, 2026 [Web Doc. No. 10287084] Decision of July 23, 2026 Register of Decisions No. 550 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having reviewed the documentation on file; Having considered the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Pasquale Stanzione; PREAMBLE

Introduction. A complaint was filed pursuant to Article 77 of the Regulation—following the approval by the Emilia-Romagna Regional Employment Agency (hereinafter “Regional Agency”) of a ranking list as part of a procedure initiated pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of a technical receptionist at the IRCCS University Hospital of Bologna, Sant’Orsola Polyclinic—the complainant represented that she had requested the “erasure of [her] data [contained in the aforementioned ranking list] as well as de-indexing from search engines. […since] when typing [her] first and last name into Google, the ranking in question appears along with its position. […] The Agency refused to delete the data from that procedure, […citing] alleged transparency requirements imposed by law.” Based on the information provided by the complainant and following the Office’s investigation, it was confirmed that the decision titled “REGION OF EMILIA-ROMAGNA Administrative Acts EMPLOYMENT AGENCY Act of the Director DECISION No. XX of XX BOLOGNA,” containing the names of those enrolled in the aforementioned procedure, had been published online.

The Preliminary Investigation. As part of the preliminary investigation, the Regional Agency, in a note dated XX, stated, in particular, that: - “By Decision No. XX of XX, the Regional Employment Agency approved the ‘Public Notice of the Initiation of a Selection Process in the Public Administration pursuant to Art. 16 of Law No. 56/1987 at the University Hospital of Bologna – IRCCS - Sant’Orsola Polyclinic, for 10 positions as technical reception staff, Category B, permanent—full-time”; - “This was followed by Resolution No. XX of XX concerning the “Approval of the ranking list for the recruitment process in the public administration pursuant to Art. 16 of Law No. 56/87 for permanent, full-time positions, at the University Hospital of Bologna/IRCCS-Sant’Orsola Polyclinic for 10 positions as technical reception staff (Category B)”; - “In a communication dated XX, the data subject submitted a request, pursuant to Article 17(1) of the GDPR, for the erasure of the personal data included in the aforementioned ranking list. In its response, Ref. No. XX dated XX, the Agency provided, within the prescribed procedural timeframes, a duly substantiated reply explaining that the publication of the ranking list was justified by the broader regulatory framework”; - “The administrative proceeding was initiated pursuant to Art. 16 of Law No. 56/1987 entitled ‘Provisions on the Organization of the Labor Market’ which requires public administrations to carry out “the hiring of workers to be classified in pay grades for which no educational qualification higher than compulsory schooling is required, based on selections made from among those registered on the employment placement lists and mobility lists (…) who are called for selection in numerical order according to the rankings derived from the lists of the territorially competent districts”; - “In accordance with Decree No. 4 of the Ministry of Labor and Social Policies dated January 11, 2018, entitled ‘Three-Year Guidelines for Action on Active Labor Market Policies’ and, in particular, the related Annex B, which includes the preparation of rankings for referral to the selection process within the public administration among the essential levels of service in the field of active labor market policies”; - “in compliance with Article 35, paragraph 1, letter b of Legislative Decree No. 165/2001, which explicitly distinguishes this type of procedure—‘referral of registered candidates’—from the more well-known and widespread ‘selection procedures’ referred to in letter a) of the same article”; - “In the absence of a specific timeframe set by law, by analogy with the provisions of Art. 8, paragraph 3, of Legislative Decree No. 33 of 2013—including with regard to the publications referred to in Art. 19 of the same Decree— The Agency has established a 5-year publication period for the rankings of candidates admitted to the selection process pursuant to Article 16 of Law No. 56/1987. Although this type of ranking possesses the distinctive characteristics described above, the requirements of transparency, namely ensuring full and unconditional access to data and documents held by public administrations, in order to protect citizens’ rights and promote their active participation in administrative activities, are consistent with the provisions of Legislative Decree No. 33/2013.” By a letter dated the XX, the Authority, based on the information gathered, the verifications conducted, and the facts that emerged following the preliminary investigation, notified the Regional Agency, pursuant to Article 166, paragraph 5, of the Code, the initiation of proceedings to adopt the measures referred to in Article 58, para 2, of the Regulation, for having published on its institutional website—and indexed on major search engines— Decision No. XX of XX, containing the names of those recognized as eligible to participate in the selection process pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of a technical receptionist at the-University Hospital of Bologna IRCCS, Sant’Orsola Polyclinic, in violation of Articles 5, 6, and 9 of the Regulations, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code. In the same notice, the aforementioned head was invited to submit written defenses or documents to the Authority or to request a hearing (Art. 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). In a letter dated XX, the Regional Agency—which did not request a hearing—submitted a defense brief, stating, in particular, that: - by Decision No. XX of XX “this Agency, through the Bologna Employment Center, approved the final ranking list for the selection process pursuant to Art. 16 of Law No. 56 of 1987 for permanent hires at the Sant’Orsola Polyclinic in Bologna”; - “In this type of procedure, the Agency does not conduct any assessment regarding the employee’s suitability to perform the duties specified in the job posting; this task, in fact, falls to the final hiring entity responsible for making the hires. On the other hand, it is clear that the Agency conducts a comparative assessment of the candidates’ qualifications—not based on professional competencies but on conditions self-certified by the various participants, who are effectively competitors, as in a selection process based solely on qualifications”; - “In order to clarify the issue, it is necessary to briefly outline the system set forth in Art. 16 of Law 56/1987, which establishes a special legal framework for hiring by public entities.AA. for personnel to be assigned to positions for which the sole requirement is completion of compulsory education”; - “For this particular type of hiring, two public administrations are involved: the locally competent employment center and the entity making the hire; they carry out their respective roles through two distinct administrative procedures, initiated and concluded independently”; - “The entity intending to hire submits its request for personnel to the Employment Center [CPI], which is responsible for compiling a list of candidates for the requesting entity so that the latter may then assess their suitability for the required position, and only thereafter may the entity formally hire them into its ranks”; - Following the requesting entity’s application, the competent CPI, after verifying the fairness and completeness of the application, approves a specific public notice, the contents of which mirror those typically found in a public competitive examination announcement. The process then continues with the collection of applications and the completion of further preliminary investigations, such as verifying the eligibility of citizens’ applications and their compliance with the self-declared participation requirements pursuant to Presidential Decree. 445/2000. Finally, the process concludes with the creation of a ranking list based solely on qualifications, drawn up by applying the scores specified in the call for applications based on predetermined evaluation criteria, while also applying mechanisms typical of public competitive examinations, such as preferential qualifications”; - “For this initial procedure, the Agency compiles a ranking list that has the characteristics of a provisional ranking list, as it is subject to review through the administrative self-protection mechanism, upon request by a party, within the first few days following publication, solely for the purpose of correcting an error in the transcription of the score. This period allows the administration to take action should there be any disputes regarding the scores assigned or the exclusion of participants. Once the review is complete, the final ranking list is approved, published, and forwarded to the entity responsible for the distinct and separate hiring process, as provided for in Articles 25 and 26 of Presidential Decree 487/1994”; - Once the final ranking list is finalized, the hiring entity verifies the eligibility for the position as self-certified by the individual on the list, and must strictly adhere, as the order of call for the interview, the order established in the ranking list drawn up by the CPI—in this case, without a comparative evaluation and without creating any additional ranking lists of its own (pursuant to Article 27, paragraph 3, of Presidential Decree 487/1994)”; - “Therefore, considering the procedure described in the preceding paragraphs to be a genuine competitive and comparative selection process, the ARL deemed it necessary to align its conduct with the principles set forth in paragraph 3 of Art. 35 of Legislative Decree 165/2001, including the principle of transparency, and, consequently, to comply with the disclosure requirements set forth in Art. 19(1) of Legislative Decree 33/2013 regarding the final rankings”; - “With regard to the objection concerning the Labor Agency’s failure to cite any specific legal provision requiring online publication, it should be noted that, pursuant to Art. 26 of Presidential Decree 487/94—cited in a footnote by the GPDP itself—which provides in paragraph 7 that ‘the ranking list shall be made public in the same manner as provided for the job posting,’ since the call for applications was published online and applications had to be submitted exclusively via an online application system, with identification via SPID, it was deemed that the final ranking list should also be published in accordance with Art. 19 of Legislative Decree 33/2013.”

Outcome of the Preliminary Investigation. Applicable Legislation. Data protection regulations provide that public entities, even when conducting competitive, selection, or other evaluative procedures leading up to the establishment of an employment relationship, may process the personal data of data subjects (Art. 4(1) of the Regulation) if the processing is necessary “to comply with a legal obligation to which the controller is subject” (such as specific obligations under national law “for recruitment purposes,” Articles 6(1)(c), 9(2)(b), and 9(4); 88 of the Regulation) or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Articles 6(1)(c) and (e) of the Regulation and Article 2-ter of the Code). Such processing must, however, be based on Union or Member State law, which must pursue a public interest objective and be proportionate to the pursuit of that objective. The processing purpose must be necessary for the performance of a task carried out in the public interest or related to the exercise of official authority vested in the controller (see Article 6(3) of the Regulation and Article 2-ter of the Code). With regard to special categories of personal data, including data concerning health (for which there is a general prohibition on processing, except in the cases specified in Art. 9(2) of the Regulation, and, in any event, a regime providing greater safeguards than for other types of data (see, Article 9(4) as well as Article 2-septies, paragraph 8 of the Code), processing is permitted where it is “necessary for reasons of substantial public interest on the basis of Union or Member State law, which must be proportionate to the purpose of processing, respect the essence of the right to data protection, and provide for appropriate and specific measures to safeguard the data subject rights and interests” (Article 9, para 2, subparagraph (g), of the Regulation). The controller is required to comply with data protection principles, including those of “lawfulness, fairness, and transparency” as well as “data minimisation,” according to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject” and must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Article 5, paragraph 1, subparagraphs (a) and (c) of the Regulation).

The online disclosure of personal data. As evidenced by the documents and statements provided by the controller during the preliminary investigation, as well as by the findings based on the evidence gathered, it appears that the Regional Agency published, on its official website—which is indexed by major search engines—Decision No. XX of XX containing the names (approximately 700 individuals) of those who were granted the right to participate in the selection process pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of technical reception staff at theUniversity Hospital of Bologna IRCCS, Sant’Orsola Polyclinic. With regard to the legal basis that would have justified the online dissemination of the aforementioned data, the Regional Agency has not provided evidence of any specific legal provision requiring the online publication, on its institutional website—and the resulting indexing on the most common search engines—of the names of participants in a recruitment process for personnel registered with employment centers, pursuant to Art. 16 of Law No. 56 of 1987. With specific reference, in fact, to Art. 35 of Legislative Decree No. 165 of 2001, cited by the Regional Agency, it should be noted that this provision makes a specific distinction between the type of hiring “through placement of those registered on employment lists” (Art 35, paragraph 1, subparagraph b) and hiring “through selection procedures” (Article 35, paragraph 1, letter a), and only in the latter case is there an explicit reference to paragraph 3 of the same article, which lists the principles to which recruitment procedures in public administrations must conform, while the other form of recruitment is not covered because it is instead subject to different and more specific regulations. Presidential Decree No. 487 of 1994 also includes a section specifically dedicated to this particular form of hiring (see Chapter III: Hiring through District Employment Offices pursuant to Article 16 of Law No. 56 of February 28, 1987), which sets forth rules distinct from those governing hiring through selection procedures in the general sense. In fact, in numerous cases handled by the Data Protection Authority concerning the disclosure of personal data in the context of selection procedures, reference is made to the regulatory provisions regarding forms of recruitment in the Public Administration “through selection procedures” as defined in Article 35(1)(a) and therefore not applicable to this form of hiring through placement by individuals registered on employment placement lists (see Decision No. 235 of April 11, 2024, web doc. 10019523; Provision No. 116 of February 26, 2026, Web Doc. 10235715). In this regard, therefore, it should be noted that Art. 19 of Legislative Decree No. 33 of March 14, 2013, in requiring the publication of only “final rankings,” refers exclusively to competitive selection procedures arising from “recruitment announcements” and not to those carried out “through the placement of registered individuals on employment lists.” Consequently, the reference to Article 8, paragraph 3, of Legislative Decree No. 33 of 2013, which the Regional Agency cited in order to identify “a dissemination period” that would allow for the publication of the aforementioned rankings for five years, is irrelevant, given that the specific form of hiring provided for in Art. 16 of the aforementioned Law No. 56 of 1987—for the reasons set forth above—cannot be equated with “a public competitive examination” such as the competitive procedures to which Art. 19 of the aforementioned decree applies. Having thus clarified that Legislative Decree No. 33 of 2013 contains no provision requiring the online publication of the aforementioned lists—with particular reference, specifically, the forms of publicity and transparency regarding the names of participants in this particular form of hiring, it should be noted that although Article 26, paragraph 7, of Presidential Decree No. 487 of 1994 provides that such “rankings” be “made public” in order to ensure protection for the data subject concerned should they deem it necessary to file an objection regarding their position on the ranking list, this does not mean that each person’s personal data must be accessible to anyone. Similarly, Article 25, paragraph 2, which requires that the single ranking list be made public “by posting it on the bulletin boards of the relevant offices and Sections,” does not permit such information to be made public online or indexed by common search engines. In particular, with regard to obligations to publish data, information, and documents of the public administration online—as provided for by specific sector-specific provisions other than those concerning transparency—such as, among other things, those aimed at ensuring that administrative acts or measures are made known to data subjects—it should be noted that “where the online publication of data, information, and documents involves the processing of personal data, the requirements of publicity and transparency must be appropriately balanced against the fundamental rights and freedoms, as well as the dignity of the data subject, with particular reference to confidentiality, personal identity, and the right to data protection” (see “Guidelines on the processing of personal data, including data contained in administrative acts and documents, carried out for the purposes of publicity and transparency on the web by public entities and other obligated bodies,” Provision No. 243 of May 15, 2014, web doc. No. 3134436). The Regional Agency could have complied with the requirements of the law by anonymizing the personal data in such a way that only the data subject could determine their position on the ranking list. This measure is considered essential when personal data is disseminated online, resulting in its indexing by common search engines, as in the present case, given that, as the Data Protection Authority has traditionally pointed out on numerous occasions, the publication of personal data online, unlike traditional forms of advertising, constitutes a particularly invasive form of data dissemination because it allows anyone, through common search engines external to the websites, to indiscriminately and in real time locate a substantial amount of personal information made available on the web—information that is not always up-to-date and varies in nature. Once published, in fact, the data risks remaining online indefinitely and can be used—including by cross-referencing it with other information available on the web—by anyone. When using this dissemination tool, it is therefore necessary to establish appropriate mechanisms for selecting the information that might otherwise be aggregated on a massive scale through a common search engine external to the websites and susceptible to further use. Even if, therefore, the relevant regulatory framework—which is sometimes quite outdated, as in the present case—expressly provides for specific and limited forms of dissemination, such forms of publication do not, in and of themselves, authorize the posting of the data subjects’ personal data on the entity’s institutional website. Instead, the controller must ensure differentiated levels of publicity and transparency so as to tailor the accessibility of the information according to the specific underlying interest, thereby avoiding disproportionate interference in the private lives of the data subjects (Articles 7 and 8 of the Charter of Nice; see also Recital 156 of the Regulation and “Guidelines on the Processing of Personal Data of Employees for the Purpose of Managing Employment Relationships in the Public Sector,” Provision No. 161 of June 14, 2007, Web Doc. No. 1417809). Furthermore, with particular regard to the information contained in the aforementioned lists, it should be noted that Art. 24 of Presidential Decree No. 487 of 1994 stipulates that employment centers shall compile “ranking lists […] based on the elements set forth in the table attached to this decree,” which also refers to information of a special nature, such as the “degree of disability” (see the annex to Presidential Decree No. 487 of 1994, “CRITERIA FOR THE COMPILATION OF RANKING LISTS”). In this regard, although it is not possible to determine, based on the published list, the reason for each data subject’s participation in the aforementioned procedure—that is, whether it is due to a disability or an unfavorable financial or income situation— the mere participation in this procedure may imply that the data subjects have a disability. This information—not all of which falls under special categories of data but relates to the specific personal circumstances of participants in the aforementioned procedure—must undoubtedly be processed by the administration; however, in light of the relevant regulatory framework, the conditions for its disclosure through online publication are not met. In fact, with regard to selection processes involving special categories of workers (e.g., “automatic placements for public administration employees under Law 68/99”), the Regional Agency has stated that such rankings “deserve a higher level of protection in terms of disclosure, as these rankings are fully anonymized by the Employment Agency”; this principle, by analogy, must be applied to all information of a special nature that could be disclosed online, as in the present case. In this specific regard, it should be noted that in order to identify any information that might reveal the health status of the data subjects concerned—the disclosure of which is expressly prohibited (Art. 2-septies, paragraph 8)—it is always necessary to conduct a specific assessment. In particular, the Data Protection Authority has stated, regarding this specific form of selection, that “it is not, for example, permitted to disclose the names of those eligible for mandatory job placement contained in lists and rankings,” given that it is not possible to invoke generic requirements of publicity related to the transparency of procedures concerning the organization of personnel and offices (see para 6 of the Guidelines of June 14, 2007, No. 161, cited above). In any case, the processing in question—even when it does not directly refer to data concerning health of the data subjects—could, since it nonetheless consists of the disclosure of personal data revealing sensitive economic or social aspects, have prejudicial effects on them, compromising their dignity. While taking into account the wording of the regulatory text, which dates back some time, and the absence of specific operational guidelines, circumstances that may have led to an erroneous interpretation by the Regional Agency regarding the publication of the aforementioned names, it must be concluded that the processing carried out constituted an unlawful disclosure of personal data, as it was conducted without an adequate legal basis. In light of the foregoing considerations, the online publication on the Regional Agency’s institutional website and the subsequent indexing by search engines of Decision No. XX of XX—containing the “unmasked” names of those registered on the employment lists (approximately 700)—was carried out without anappropriate legal basis and in a manner inconsistent with the principles of “lawfulness, fairness, and transparency,” as well as “data minimisation,” in violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code.

Conclusions. In light of the above assessments, it is noted that the statements made by the controller during the preliminary investigation—for the truthfulness of which the controller may be held accountable pursuant to Article 168 of the Code—although worthy of consideration, do not suffice to address the objections notified by the Office in the notice initiating the proceedings and are insufficient to warrant the dismissal of these proceedings pursuant to the combined provisions of Articles 11 and 14 of the Data Protection Authority’s Regulation No. 1/2019. The Office’s preliminary assessments are therefore confirmed, and the processing is found to be unlawful with regard to the disclosure of the personal data of over seven hundred data subjects, as set forth in Decision No. XX of XX, as part of the selection process conducted pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of a technical receptionist at the IRCCS University Hospital of Bologna, Sant’Orsola Polyclinic, in violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code. Given that the violation of the aforementioned provisions occurred as a result of a single course of conduct (the same processing or related processes), Article 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, the most serious violations—relating to Articles 5, 6, and 9 of the Regulation, as well as Article 2-ter and Article 2-septies, paragraph 8, of the Code—are subject to the penalty provided for in Article 83, para 5, of the Regulation—as also referred to in Art 166, paragraph 2, of the Code—the total amount of the penalty is to be set at up to 20,000,000 euros. In any case, considering that the conduct has exhausted its effects—given that the Regional Agency, as soon as it received notice of the initiation of the investigation, removed Determination No. XX of XX from its institutional website and also requested de-indexing —the conditions for adopting corrective measures, as provided for in Art 58, para 2, of the Regulation, do not apply.

Adoption of the injunction ordering the imposition of the administrative fine and ancillary sanctions (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction order, by which it also orders the application of the ancillary administrative sanction of its publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). In this regard, taking into account Article 83(3) of the Regulation, in the present case, the violation of the aforementioned provisions is subject to the imposition of the administrative fine provided for in Article 83(5) of the Regulation. The amount of the aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Article 83(2) of the Regulation. It is considered that, in the present case, the severity of this violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60), given that: - the processing in question, which took place from XX to XX, involved the publication of personal data of approximately 700 data subjects (Article 83(2)(a) of the Regulation); - the violation occurred in good faith under the mistaken belief that the Regional Agency was acting in accordance with the applicable sector-specific regulations, given that the Agency operated under the mistaken belief that it could pursue purposes of publicity and transparency regarding administrative action, especially given that the applicable sector-specific regulations are outdated and not easily interpreted in light of personal data protection laws, but without taking into account the guidance provided over time by the Data Protection Authority to all public entities on this matter (Article 83(2)(b) of the Regulation); - the publication also concerned, albeit indirectly, personal data belonging to the special categories of personal data referred to in Article 9 of the Regulation (see Article 83(2)(g) of the Regulation). That said, the following mitigating circumstances must be taken into account: - The Regional Agency has taken specific measures by removing the aforementioned personal data from its institutional website and de-indexing it on search engines, and has stated that it has implemented technical and organizational measures aimed at complying with applicable regulations and the guidelines of the Data Protection Authority (Art. 83, par. 2, letter c) of the Regulation); - the Regional Agency has offered full cooperation with the Authority (Art. 83, para. 2, letter f) of the Regulation); - there are no previous relevant violations committed by the controller of the same nature as those ascertained in relation to the facts of the complaint (see Article 83, para 2, letter e) of the Regulation). In light of the aforementioned factors, evaluated as a whole, it is determined that the amount of the administrative fine shall be set at 30,000.00 (thirty thousand/00) euros for the violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code, as an administrative fine deemed, pursuant to Article 83(1) of the Regulation, to be effective, proportionate, and dissuasive. In this context, it is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the large amount of personal data—including special categories of personal data—belonging to approximately seven hundred data subjects that were published online and indexed by search engines. Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 are met. NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by the Regional Agency, as described in the grounds, is unlawful due to a violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code; ORDERS pursuant to Article 58, para 2, subparagraph i) of the Regulation, that the Emilia Romagna Regional Employment Agency, represented by its pro tempore legal representative, with headquarters at Viale Aldo Moro, 38 - 40127 Bologna (BO), Tax ID No. 91388210378, to pay the sum of 30,000.00 euros (thirty thousand/00) as an administrative fine for the violations set forth in this order; THUS ORDERS the Regional Agency to pay the aforementioned sum of 30,000.00 euros (thirty thousand/00) in accordance with the procedures set forth in the attachment, within thirty days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying —always in accordance with the procedures set forth in the attachment—of an amount equal to half the imposed penalty within the time limit specified in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; ORDERS a) pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; b) pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this order on the Authority’s website; c) pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Articles 78 of the Regulation, 152 of the Code, and 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, subject to the condition that it be filed within thirty days from the date of notification of the decision or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori SEE ALSO Newsletter of September 11, 2026 [Web Doc. No. 10287084] Decision of July 23, 2026 Register of Decisions No. 550 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection, setting forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at the performance of the tasks and the exercise of the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having reviewed the documentation on file; Having considered the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Pasquale Stanzione; PREAMBLE 1 Introduction. A complaint was filed pursuant to Art. 77 of the Regulation—following the approval by the Emilia Romagna Regional Employment Agency (hereinafter “Regional Agency”) of a ranking list as part of a procedure initiated pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of a technical receptionist at the IRCCS University Hospital of Bologna, Sant’Orsola Polyclinic—the representative stated that she had requested the “erasure of [her] data [contained in the aforementioned ranking list] as well as de-indexing from search engines. […since] when typing [her] first and last name into Google, the ranking in question appears along with its corresponding position. […] The Agency refused to delete the data from that procedure, […citing] alleged transparency requirements imposed by law.” Based on the information provided by the complainant and following the Office’s investigation, it was ascertained that the decision titled “REGION OF EMILIA-ROMAGNA Administrative Acts EMPLOYMENT AGENCY Act of the Director DECISION No. XX of XX BOLOGNA,” containing the names of those enrolled in the aforementioned procedure, had been published online. 2 The Preliminary Investigation. As part of the preliminary investigation, the Regional Agency, in a memorandum dated XX, stated, in particular, that: - “By Decision No. XX of XX, the Regional Employment Agency approved the ‘Public Notice of the commencement of a selection process in the public administration pursuant to Art. 16 of Law No. 56/1987 at the University Hospital of Bologna - IRCCS - Sant’Orsola Polyclinic, for 10 positions of technical receptionist, Category B, permanent—full-time”; - “This was followed by Resolution No. XX of XX concerning the “Approval of the ranking list for the recruitment process in the public administration pursuant to Art. 16 of Law No. 56/87 for permanent, full-time, at the University Hospital of Bologna/IRCCS-Sant’Orsola Polyclinic for 10 positions as reception technical staff (Category B)”; - “In a communication dated XX, the data subject submitted a request, pursuant to Article 17(1) of the GDPR, for the erasure of the personal data included in the aforementioned ranking list. In its response, Ref. No. XX dated XX, the Agency, in compliance with procedural deadlines, duly responded by explaining that the publication of the ranking list was justified by the broad regulatory framework”; - “The administrative proceeding was initiated pursuant to Art. 16 of Law No. 56/1987, entitled ‘Provisions on the Organization of the Labor Market’ which requires public administrations to carry out “the hiring of workers to be classified in pay grades for which no educational qualification higher than compulsory schooling is required, based on selections made from among those registered on the employment and mobility lists (…) who are called for selection in numerical order according to the rankings derived from the lists of the territorially competent districts”; - “In accordance with Decree No. 4 of the Ministry of Labor and Social Policies dated January 11, 2018, entitled ‘Three-Year Guidelines for Action on Active Labor Market Policies’ and, in particular, the related Annex B, which includes the preparation of rankings for referral to the selection process within the public administration among the essential levels of service in the field of active labor market policies”; - “in compliance with Article 35, paragraph 1, subparagraph b of Legislative Decree No. 165/2001, which explicitly distinguishes this type of procedure—‘referral of registered candidates’—from the more well-known and widespread ‘selection procedures’ referred to in subparagraph a) of the same article”; - “In the absence of a specific timeframe defined by the law, by analogy with the provisions of Article 8, paragraph 3, of Legislative Decree No. 33 of 2013—including with regard to the publications referred to in Article 19 of the same Decree— the Agency has established a 5-year publication period for the rankings of candidates admitted to the selection process pursuant to Article 16 of Law No. 56/1987. Although this type of ranking has the distinctive characteristics described above, the requirements of transparency, that is, ensuring full and unconditional access to data and documents held by public administrations, in order to protect citizens’ rights and promote their active participation in administrative activities, are consistent with the provisions of Legislative Decree No. 33/2013.” In a letter dated the XX, the Authority, based on the information gathered, the audits conducted, and the facts that emerged as a result of the preliminary investigation, notified the Regional Agency, pursuant to Article 166, paragraph 5, of the Code, the initiation of proceedings to adopt the measures referred to in Article 58, para 2, of the Regulation, for having published on its institutional website—and indexed on major search engines— Decision No. XX of XX, containing the names of those recognized as eligible to participate in the selection process pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of a technical receptionist at the-University Hospital of Bologna IRCCS, Sant’Orsola Polyclinic, in violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code. In the same notice, the aforementioned head was invited to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). In a letter dated XX, the Regional Agency—which did not request a hearing—submitted a defense brief, stating, in particular, that: - by Decision No. XX of XX “this Agency, through the Bologna Employment Center, approved the final ranking list for the selection process pursuant to Art. 16 of Law 56/1987 for permanent hires at the Sant’Orsola Polyclinic in Bologna”; - “In this type of procedure, the Agency does not conduct any assessment regarding the employee’s suitability to perform the duties specified in the job posting; this task, in fact, falls to the final hiring entity responsible for making the appointments. On the other hand, it is clear that the Agency conducts a comparative assessment of the candidates’ qualifications—not related to professional competencies but to conditions self-certified by the various participants, who are in the position of actual competitors, as in a selection procedure based solely on qualifications”; - “In order to clarify the issue, it is necessary to briefly review the system set forth in Art. 16 of Law 56/1987, which establishes a special legal framework for hiring by public administrative agencies (PP.AA. for staff to be assigned to positions requiring only compulsory education”; - “For this particular type of hiring, two public administrations are involved: the locally competent employment center and the hiring entity, and they carry out the process through two distinct administrative procedures, initiated independently and concluded independently”; - “The entity intending to hire submits its request for personnel to the Employment Center [CPI], which is responsible for compiling a ranking list of candidates for the requesting entity so that the latter may conduct the subsequent assessment of suitability for the required position, and only thereafter formally hires the candidate into its ranks”; - Following the requesting entity’s application, the competent CPI, after verifying the fairness and completeness of the application, approves a specific public notice, the contents of which mirror those typically found in a public competitive examination announcement. The process then continues with the collection of applications and the completion of further preliminary investigations, such as verifying the eligibility of citizens’ applications and their compliance with the self-declared participation requirements under Presidential Decree 445/2000. Finally, the process concludes with the creation of a ranking list based solely on qualifications, drawn up by applying the scores specified in the notice based on predetermined evaluation criteria, while also applying mechanisms typical of public competitive examinations, such as preference criteria”; - “For this initial procedure, the Agency draws up a ranking list that has the characteristics of a provisional ranking list, as it is subject to review through self-regulatory measures, upon request by a party, within the first few days following publication, solely for errors in the transcription of scores. This period allows the administration to take action should there be any disputes regarding the scores assigned or the exclusion of participants. Once the review is complete, the final ranking list is approved, published, and forwarded to the entity responsible for the separate recruitment process, as provided for in Articles 25 and 26 of Presidential Decree 487/1994”; - Once the final ranking list has been finalized, the hiring entity verifies the suitability for the position as self-certified by the individual on the list, and must strictly adhere to—as the order of call for interviews— the order established in the ranking list drawn up by the CPI, in this case without a comparative evaluation and without creating any additional ranking lists of its own (pursuant to Article 27, paragraph 3, of Presidential Decree 487/1994)”; - “Therefore, in recital 3, the ARL deemed it necessary to align its conduct with the principles set forth in paragraph 3 of Article 35 of Legislative Decree 165/2001, including the principle of transparency, and, consequently, to comply with the disclosure requirements set forth in Art. 19, paragraph 1, of Legislative Decree 33/2013 regarding the final rankings”; - “With regard to the allegation concerning the Labor Agency’s failure to cite any specific legal provision requiring online publication, it should be noted that, pursuant to Art. 26 of Presidential Decree 487/94—cited in a footnote by the GPDP itself—which provides in paragraph 7 that ‘the ranking list shall be made public in the same manner as provided for the job posting,’ since the call for applications was published online and applications had to be submitted exclusively via an online application system, with identification via SPID, it was deemed that the final ranking list should also be published in accordance with Art. 19 of Legislative Decree 33/2013.” 3 Outcome of the Preliminary Investigation. Applicable Regulations. Data protection regulations provide that public entities, even when conducting competitive, selective, or otherwise evaluative procedures prior to the establishment of an employment relationship, may process the personal data of data subjects (Art. 4(1) of the Regulation) if the processing is necessary “to comply with a legal obligation to which the controller is subject” (such as specific obligations under national law “for recruitment purposes,” Articles 6(1)(c), 9(2)(b), and 9(4); 88 of the Regulation) or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6(1)(c) and (e) of the Regulation and Art. 2-ter of the Code). Such processing must, however, be based on Union or Member State law, which must pursue a public interest objective and be proportionate to the pursuit of that objective. The processing purpose must be necessary for the performance of a task carried out in the public interest or related to the exercise of official authority vested in the controller (see Article 6(3) of the Regulation and Article 2-ter of the Code). With regard to special categories of personal data, including data concerning health (for which there is a general prohibition on processing, except in the cases specified in Art. 9(2) of the Regulation, and, in any event, a regime providing greater safeguards than for other types of data (see Article 9(4) as well as Article 2-septies, paragraph 8, of the Code), processing is permitted where it is “necessary for reasons of substantial public interest on the basis of Union or Member State law, which must be proportionate to the purpose pursued, respect the essence of the right to data protection, and provide for appropriate and specific measures to safeguard the data subject rights and interests” (Article 9, para 2, subparagraph (g), of the Regulation). The controller is required to comply with data protection principles, including those of “lawfulness, fairness, and transparency” as well as “data minimisation,” according to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject” and must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Article 5, paragraph 1, subparagraphs (a) and (c) of the Regulation). 3.1 The online dissemination of personal data. As evidenced by the documents and statements provided by the controller during the preliminary investigation, as well as by the findings based on the evidence gathered, it appears that the Regional Agency published, on its official website—which is indexed by major search engines—Decision No. XX of XX containing the names (approximately 700 individuals) of those recognized as eligible to proceed to the selection phase pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of technical reception staff at theUniversity Hospital of Bologna IRCCS, Sant’Orsola Polyclinic. With regard to the legal basis that would have justified the online dissemination of the aforementioned data, the Regional Agency has not provided evidence of any specific legal provision requiring the online publication, on its institutional website—and the resulting indexing on the most common search engines—of the names of participants in a recruitment process for personnel registered with employment centers, pursuant to Art. 16 of Law No. 56 of 1987. With specific reference, in fact, to Art. 35 of Legislative Decree No. 165 of 2001, cited by the Regional Agency, it should be noted that this provision makes a specific distinction between the type of hiring “through the placement of individuals registered on employment lists” (Art 35, paragraph 1, subparagraph b) and hiring “through selection procedures” (Article 35, paragraph 1, subparagraph a), and only in the latter case is there an explicit reference to paragraph 3 of the same article, which lists the principles to which recruitment procedures in public administrations must conform, while the other form of recruitment is not covered because it is instead subject to different and more specific regulations. Presidential Decree No. 487 of 1994 also includes a section specifically dedicated to this particular form of hiring (see Chapter III: Hiring through District Employment Offices pursuant to Article 16 of Law No. 56 of February 28, 1987), which establishes rules distinct from those governing hiring through selection procedures in the general sense. In fact, in numerous cases handled by the Data Protection Authority concerning the disclosure of personal data in the context of selection procedures, the regulatory references pertain to forms of recruitment in the Public Administration “through selection procedures” as defined in Article 35(1)(a) and therefore not applicable to this form of hiring through placement via individuals registered on employment placement lists (see Decision No. 235 of April 11, 2024, web doc. 10019523; Provision No. 116 of February 26, 2026, web doc. 10235715). In this regard, therefore, it should be noted that Art. 19 of Legislative Decree No. 33 of March 14, 2013, in requiring the publication of only “final rankings,” refers exclusively to competitive selection procedures arising from “recruitment calls for applications” and not to those conducted “through the placement of registered individuals on employment lists.” Consequently, the reference to Article 8, paragraph 3, of Legislative Decree No. 33 of 2013, which the Regional Agency cited in order to identify “a dissemination period” that would allow for the publication of the aforementioned rankings for five years, is irrelevant, given that the specific form of hiring provided for in Art. 16 of the aforementioned Law No. 56 of 1987—for the reasons set forth above—cannot be equated with “a public competitive examination” such as the competitive procedures to which Art. 19 of the aforementioned decree applies. Having clarified, therefore, that Legislative Decree No. 33 of 2013 contains no provision requiring the online publication of the aforementioned lists—with particular reference, specifically, the forms of publicity and transparency regarding the names of participants in this particular form of hiring, it should be noted that although Art. 26, paragraph 7, of Presidential Decree No. 487 of 1994 provides that such “rankings” be “made public” in order to ensure protection for the data subject concerned should they deem it necessary to file an objection regarding their position on the ranking list, this does not imply that each person’s personal data must be accessible to anyone. Similarly, Article 25, paragraph 2, which stipulates that the single ranking list must be made public “by posting it on the bulletin boards of the relevant offices and sections,” does not permit such information to be published online or indexed by common search engines. In particular, with regard to obligations to publish data, information, and documents of the public administration online—as provided for by specific sector-specific provisions other than those concerning transparency—such as, among other things, those aimed at ensuring that administrative acts or measures are made available to data subjects—it should be noted that “where the online publication of data, information, and documents involves the processing of personal data, the requirements of publicity and transparency must be appropriately balanced against the fundamental rights and freedoms, as well as the dignity of the data subject, with particular reference to confidentiality, personal identity, and the right to data protection” (see “Guidelines on the processing of personal data, including that contained in administrative acts and documents, carried out for the purposes of publicity and transparency on the web by public entities and other obligated bodies” Provision No. 243 of May 15, 2014, Web Doc. No. 3134436). The Regional Agency could have complied with the requirements of the law by anonymizing the personal data in such a way that only the data subject could identify their own position on the ranking list. This measure is to be considered indispensable in the case of the online dissemination of personal data, with the consequent indexing of such data by common search engines, as in the present case, given that, as the Data Protection Authority has traditionally pointed out on numerous occasions, the publication of personal data online, unlike traditional forms of publicity, constitutes a particularly invasive form of data dissemination because it allows anyone, through common search engines external to the websites, to indiscriminately and in real time access a substantial amount of personal information made available online—information that is not always up to date and varies in nature. Once published, in fact, the data risks remaining online indefinitely and can be used—including by cross-referencing it with other information available on the web—by anyone. When using this dissemination tool, it is therefore necessary to establish appropriate mechanisms for selecting information that might otherwise be aggregated on a massive scale via a common search engine external to the websites and susceptible to further use. Even if, therefore, the sector’s regulatory framework—which is sometimes quite outdated, as in the present case—expressly provides for specific and limited forms of dissemination, such forms of publication do not, in and of themselves, authorize the posting of the data subjects’ personal data on the institution’s official website. Instead, the controller must ensure differentiated levels of publicity and transparency such that the accessibility of the information can be tailored according to the specific underlying interest, thereby avoiding disproportionate interference in the private lives of the data subjects (Articles 7 and 8 of the Charter of Nice; see also Recital 156 of the Regulation and “Guidelines on the Processing of Personal Data of Employees for the Purpose of Managing Employment Relationships in the Public Sector,” Provision No. 161 of June 14, 2007, Web Doc. No. 1417809). Furthermore, with particular regard to the information contained in the aforementioned lists, it should be noted that Art. 24 of Presidential Decree No. 487 of 1994 stipulates that employment centers shall compile “rankings […] based on the elements set forth in the table attached to this decree,” which also refers to special categories of personal data, such as the “degree of disability” (see the annex to Presidential Decree No. 487 of 1994, “CRITERIA FOR THE COMPILATION OF RANKING LISTS”). In this regard, although it is not possible to determine, based on the published list, the reason for each data subject’s participation in the aforementioned procedure—that is, whether it is due to a disability or an unfavorable financial or income situation— the mere participation in this procedure may imply that the data subjects have a disability. This information—not all of which falls under special categories of data but rather pertains to the specific personal circumstances of participants in the aforementioned procedure—must undoubtedly be processed by the administration; however, in light of the relevant regulatory framework, the conditions for its disclosure through online publication are not met. In fact, with regard to selection processes involving special categories of workers (e.g., “automatic placements for public administration employees under Law 68/99”), the Regional Agency has stated that such rankings “deserve a higher level of protection in terms of disclosure, as these rankings are fully anonymized by the Employment Agency,” a principle which, by analogy, must be applied to all information of a special nature that could be disclosed online, as in the present case. In this specific regard, it should be noted that in order to identify information that might reveal the health status of the data subjects concerned—the disclosure of which is expressly prohibited (Art. 2-septies, paragraph 8)—it is always necessary to conduct a specific assessment. In particular, the Data Protection Authority has stated, regarding this specific form of selection, that “it is not, for example, permitted to disclose the names of those eligible for mandatory placement contained in lists and rankings,” given that it is not possible to invoke generic publicity requirements related to the transparency of procedures concerning the organization of personnel and offices (see para 6 of the Guidelines of June 14, 2007, No. 161, cited above). In any case, the processing in question—even when it does not directly refer to data concerning health of the data subjects—could, since it nonetheless involves the disclosure of personal data revealing sensitive economic or social aspects, have prejudicial effects on them, thereby compromising their dignity. While taking into account the wording of the regulatory text, which dates back some time, and the absence of specific operational guidelines, circumstances that may have led to an erroneous interpretation by the Regional Agency regarding the publication of the aforementioned names, it must be concluded that the processing carried out constituted an unlawful disclosure of personal data, as it was performed without an adequate legal basis. In light of the foregoing considerations, the online publication on the Regional Agency’s institutional website and the subsequent indexing by search engines of Decision No. XX of XX—containing the “unmasked” names of those registered on the employment lists (approx. 700)—was carried out without anappropriate legal basis and in a manner inconsistent with the principles of “lawfulness, fairness, and transparency,” as well as “data minimisation,” in violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code. 3.2 Conclusions. In light of the assessments outlined above, it is noted that the statements made by the controller during the preliminary investigation—for the veracity of which the controller may be held accountable pursuant to Article 168 of the Code—although worthy of consideration, do not resolve the findings notified by the Office in the notice initiating the proceedings and are insufficient to allow for the dismissal of these proceedings pursuant to the combined provisions of Articles 11 and 14 of the Data Protection Authority’s Regulation No. 1/2019. The Office’s preliminary findings are therefore confirmed, and the processing is deemed unlawful with regard to the disclosure of the personal data of more than seven hundred data subjects, as contained in Decision No. XX of XX, as part of the selection process conducted pursuant to Art. 16 of Law No. 56 of 1987 for the permanent hiring of a technical receptionist at the IRCCS University Hospital of Bologna, Sant’Orsola Polyclinic, in violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code. Given that the violation of the aforementioned provisions occurred as a result of a single act (the same processing or related processes), Article 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, the most serious violations—relating to Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code—are subject to the penalty provided for in Article 83, para 5, of the Regulation, as also referred to in Art 166, paragraph 2, of the Code, the total amount of the fine shall be set at up to 20,000,000 euros. In any case, considering that the conduct has exhausted its effects—given that the Regional Agency, as soon as it received notice of the initiation of the investigation, removed Decision No. XX of XX from its institutional website and also requested de-indexing —the conditions for adopting corrective measures, as provided for in Article 58, para 2, of the Regulation, do not apply. 4 Adoption of the injunction order for the imposition of the administrative fine and ancillary sanctions (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction, by which it also orders the application of the ancillary administrative sanction of its publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). In this regard, taking into account Article 83(3) of the Regulation, in the present case, the violation of the aforementioned provisions is subject to the application of the administrative fine provided for in Article 83(5) of the Regulation. The amount of the aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Art. 83(2) of the Regulation. It is considered that, in the present case, the severity of this violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60), given that: - the processing in question, which took place from XX to XX, involved the publication of personal data of approximately 700 data subjects (Article 83(2)(a) of the Regulation); - the violation occurred in good faith based on the mistaken belief that it was acting in accordance with the applicable sector-specific regulations, given that the Regional Agency operated under the mistaken belief that it could pursue purposes of publicity and transparency in administrative action, especially given that the applicable sector-specific regulations are outdated and not easily interpretable in light of personal data protection laws, but without taking into account the guidance provided over time by the Data Protection Authority to all public entities on this matter (Article 83(2)(b) of the Regulation); - the publication also concerned, albeit indirectly, personal data belonging to the special categories referred to in Article 9 of the Regulation (see Article 83, para 2, subparagraph g), of the Regulation). That said, the following mitigating circumstances must be taken into account: - The Regional Agency took specific measures by removing the aforementioned personal data from its institutional website and de-indexing it from search engines, and stated that it had implemented technical and organizational measures aimed at complying with applicable regulations and the Data Protection Authority’s guidelines (Art 83, para 2, subparagraph c) of the Regulation); - the Regional Agency cooperated fully with the Authority (Art. 83, paragraph 2, subparagraph f) of the Regulation); - there are no previous relevant violations committed by the controller that are of the same nature as those ascertained in connection with the facts of the complaint (see Article 83, para 2, letter e) of the Regulation). In light of the aforementioned factors, assessed as a whole, it is determined that the amount of the administrative fine shall be set at 30,000.00 (thirty thousand/00) euros for the violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code, as an administrative fine deemed, pursuant to Article 83(1) of the Regulation, to be effective, proportionate, and dissuasive. In this context, it is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the large amount of personal data—including sensitive personal data—pertaining to approximately seven hundred data subjects that was published online and indexed by search engines. Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 are met. NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by the Regional Agency, as described in the grounds of this decision, is unlawful due to a violation of Articles 5, 6, and 9 of the Regulation, as well as Articles 2-ter and 2-septies, paragraph 8, of the Code; ORDERS pursuant to Article 58(2)(i) of the Regulation, that the Emilia Romagna Regional Employment Agency, represented by its pro tempore legal representative, with headquarters at Viale Aldo Moro, 38 - 40127 Bologna (BO), Tax ID No. 91388210378, to pay the sum of 30,000.00 euros (thirty thousand/00) as an administrative fine for the violations set forth in this order; THUS ORDERS the Regional Agency to pay the aforementioned sum of 30,000.00 euros (thirty thousand/00) in accordance with the procedures set forth in the attachment, within thirty days of service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying —always in accordance with the procedures set forth in the attachment—of an amount equal to half the imposed penalty within the time limit specified in Art. 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; ORDERS a) pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; b) pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this order be published on the Authority’s website; c) pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, para 2 of the Regulation, in the Authority’s internal register provided for in Article 57, para 1, letter u) of the Regulation. Pursuant to Article 78 of the Regulation, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts; failure to do so within within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori