Professional association: Non-compliance with general data processing principles

The Italian DPA has imposed a fine of EUR 3,500 on a professional association. An individual had filed a complaint with the DPA, for the unlawful publication of their personal data. The individual had reported another person to the professional association for the unlawful use of a professional title. The association then forwarded the report to its disciplinary board and informed the accused and also put the complainant on CC with the result that their identity was also revealed to the accused.

GDPR Articles: Art. 5 (1) a), d) GDPR Art. 6 GDPR, Art. 27 (7) GDPR, Art. 2-ter Codice della privacy
Industry: Public Sector and Education