Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Conservatorio di Musica S. Cecilia di Roma: Insufficient legal basis for data processing

€6,000 Fine
Conservatorio di Musica S. Cecilia di Roma
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 38 GDPR Art. 2 GDPR
Notified Body Responsibilities and Operational Obligations Education Public Authority Controllers Personal Data IP Address Supervisory Authorities Processing Agreement
Nov 10, 2022 Source

How it connects

Related across sources

Guidance Guidelines 04/2021 on Codes of Conduct as tools for transfers EDPB News What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum News Data Protection Officer or Chief Privacy Officer?The rise of the Data Protection Officer White Label Consultancy Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review

Full text

The Italian DPA has imposed a fine of EUR 6,000 on 'Conservatorio di Musica S. Cecilia di Roma'. A student of the educational institution had filed a complaint with the DPA for having received a disciplinary sanction for a statement made during a student assembly. Although it was not supposed to be, the assembly was recorded and the institution used the recordings to base the disciplinary action on it. During its investigation, the DPA determined that the controller did not have a valid legal basis to use the assembly recordings and, therefore, the processing of the student's personal data was unlawful. Also, the DPA found that the educational institution's data protection officer was also the institution's director. The DPA considered this to be an unlawful conflict of interest.

Industry: Public Sector and Education

Original document at the source www.garanteprivacy.it

Similar Content