745/2026

[Web Doc. No. 10309202] Decision of October 7, 2026 Register of Decisions No. 745 of October 7, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “Regulation”); HAVING REGARD TO the Code on the Protection of Personal Data (Legislative Decree No. 196 of June 30, 2003), (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation No. 1/2019 of the Data Protection Authority”); HAVING REGARD TO the documentation on file; HAVING REGARD TO the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the Office of the Data Protection Authority, adopted by resolution of June 28, 2000 (web doc. No. 1098801); RAPPORTEUR: Prof. Pasquale Stanzione; 1. FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1. Origin of the preliminary investigation In a complaint filed on XX pursuant to Art. 77 of the Regulation, Mr. XX stated that in 2021 he had participated in a competitive selection process “for the hiring of one (1) employee in the professional profile of Administrative Officer, specializing in public communication and institutional relations—Category III—and two staff members on full-time, fixed-term employment contracts in the professional profile of Administrative Assistant—Category II—for the needs of the “Smarter Italy” program at the Agency for Digital Italy (hereinafter “AGID”), and that he had requested the removal of his personal data from the administration’s website. The complainant stated that at the address https://trasparenza.agid.gov.it/download/8404.html, “the list of candidates admitted to the [oral] exam, including the complainant,” had been published. 1.2. Actions Taken. By letter dated XX, this Authority initiated a preliminary investigation, informing AGID that the aforementioned list was still present on its institutional website. Upon learning that the list, containing the names of participants admitted to the oral exam—including the complainant—was still visible on its institutional website, AGID took steps to remove the entire document within a few hours. 2. INITIATION OF PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND SANCTIONING MEASURES AND THE PARTY’S DEFENSE 2.1. Initiation of proceedings (Art. 166, paragraph 5, of the Code) Based on an examination of the evidence gathered during the activities described above and the verification of the alleged violations, by notice dated XX (Ref. No. XX) served pursuant to Article 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures referred to in Article 58, para 2, of the Regulation against the controller, inviting the controller to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The alleged violations, concerning the online dissemination of the aforementioned personal data, relate to Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code. 2.2. Defenses of the Controller (Article 166, paragraph 6, of the Code) In a letter dated XX, AGID—which did not request a hearing—stated that the personal data in the published document referred exclusively to “the candidate’s first name, last name, and score” and that the publication occurred “due to a mere operational oversight” that was entirely incidental. AGID’s representative stated that, “in accordance with established practice,” it communicates the results of competitive selection procedures “by using unique identification codes assigned to candidates.” Following the complainant’s request, having received no further communication from him, AGID “was convinced in good faith—albeit erroneously—that it had already positively and effectively granted the data subject’s request.” 3.1 Data Protection Legislation. The regulations governing data protection provide that public entities, even when conducting competitive, selection, or other evaluation procedures prior to the establishment of an employment relationship, may process the personal data of data subjects (Art. 4, No. 1, of the Regulation) if the processing is necessary “to comply with a legal obligation to which the controller is subject” (Articles 6(1)(c), 9(2)(b), and 4; 88 of the Regulation) or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6, para. 1, subpar. c) and e) of the Regulation and Art. 2-ter of the Code). Such processing must, however, be based on Union or Member State law, which must pursue a public interest objective and be proportionate to the pursuit of that objective. The processing purpose must be necessary for the performance of a task carried out in the public interest or related to the exercise of official authority vested in the controller (see Article 6(3) of the Regulation and Article 2-ter of the Code). The controller is required to comply with data protection principles, including those of “lawfulness, fairness, and transparency” as well as “data minimisation,” according to which personal data must be “processed lawfully, fairly, and in a transparent manner in relation to the data subject” and must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Article 5, paragraph 1, subparagraphs (a) and (c) of the Regulation). 3.2 The Online Disclosure of Personal Data in the Context of Insolvency Proceedings. Following the preliminary investigation into the complaint and the statements made by the controller—who also assumed accountability pursuant to Article 168 of the Code—it emerged that AGID published, on the “Transparent Administration Portal” of its institutional website, up until the date the Authority’s notice initiating the investigation was received, the list of candidates admitted to the oral exam of the aforementioned procedure, containing the personal data (first name, last name, and score) of fifteen data subjects who were eligible, including the complainant. Although AGID was convinced that it had correctly replaced the published document with another one lacking identifying information, due to the “failure to complete the document replacement,” the aforementioned list—which also contained the complainant’s identifying information—remained published online “due to a mere operational oversight.” In this regard, it should be noted that, within a regulatory framework characterized by rules that have evolved over time, the legal provisions establishing, in general, the publication of rankings for competitive examinations and selection processes serve to enable data subjects—participants in such competitive or selection procedures— to exercise their rights and verify the legality of administrative actions; and they stipulate, first and foremost, that only the final rankings of competition winners are to be published online, and not the list of candidates admitted to the intermediate rounds (see Art. 35 et seq. of Legislative Decree No. 165 of March 30, 2001, as last amended by Decree-Law No. 25 of March 14, 2025, converted with amendments by Law No. 69 of May 9, 2025; see also Art. 7 of Presidential Decree No. 3 of January 10, 1957; as well as Presidential Decree No. 487 of May 9, 1994). As is well known, the Data Protection Authority has, over time, provided specific guidance to public administrations regarding the precautions to be taken when disseminating personal data on the internet for the purposes of transparency and public disclosure of administrative actions in the specific guidelines (“Guidelines on the processing of personal data, including data contained in administrative acts and documents, carried out for the purposes of publicity and transparency on the web by public entities and other obligated bodies,” Provision No. 243 of May 15, 2014, web doc. No. 3134436, specifically Parts I and II, para. 3.b; see also the “Guidelines on the Processing of Personal Data of Employees for the Purpose of Managing Employment Relationships in the Public Sector,” Provision No. 161 of June 14, 2007, web doc. No. 1417809), as well as in numerous provisions concerning the processing of personal data in the context of insolvency proceedings, in which it noted the unlawful disclosure of personal data contained in the interim documents of such proceedings (see, e.g., Provision No. 114 of February 26, 2026, web doc. No. 10234960, and the provisions cited therein). The provisions on administrative transparency also establish specific publication requirements regarding final rankings in the “Transparent Administration” section of government agencies’ official websites. In fact, pursuant to Legislative Decree No. 33 of March 14, 2013, “without prejudice to other legal disclosure obligations, public administrations shall publish notices of competitive examinations for the recruitment, for any purpose, of personnel within the administration, as well as the Commission’s evaluation criteria, the exam questions, and the final rankings, updated to reflect any advancement of eligible candidates who were not selected.” "Public administrations shall publish and keep constantly updated the data referred to in paragraph 1" (Art. 19, paragraphs 1 and 2; see Provision No. 235 of April 11, 2024, web doc. 10019523, see also the newsletter of June 6, 2024, Provision No. 404 of July 4, 2024, web doc. No. 10050145, June 20, 2024, No. 372, web doc. No. 10039471, April 11, 2024, No. 235, web doc. No. 10019523, April 28, 2022, No. 151, web doc. No. 9778996, and the previous measures referred to therein, including, in particular, Measure No. 407 of November 25, 2021, web doc. 9732406). These provisions define, from a data protection perspective, the scope of permitted processing and constitute its legal basis by establishing limits, conditions, and prerequisites for the online publication of personal data in the context of insolvency proceedings. In line with the Authority’s guidelines in this area of data processing and with a view to drawing the attention of public administrations to strict compliance with data protection principles and sector-specific regulations—also in light of recent legislative action (see the aforementioned Legislative Decree No. 25 of March 14, 2025, converted into Law No. 69 of May 9, 2025), please note that specific FAQs are available on the Data Protection Authority’s website, shared with the Department of Public Administration, aimed at providing guidance and clarification to prevent non-compliant initiatives and processing of personal data in this specific context, with a view to effectively balancing data protection with transparency and public disclosure of competitive selection procedures (see “FAQs on the Processing of Personal Data of Participants in Competitive Selection Procedures for the Purpose of Publicity and Transparency in Light of Recent Regulatory Provisions,” web doc. No. 10187304). Even with reference to the aforementioned current regulatory framework—which, in any case, does not apply to the case at hand—it should be noted that personal data contained in procedural records or documents must not be published online. It remains understood, however, that the test log, the scores obtained, any notices to appear for the exams, and the list of candidates who passed the exam, along with their respective scores, must be made available exclusively to participants in the procedure in a restricted-access area, using the specific features of the InPA Portal (see the aforementioned FAQs, No. 8). With regard to the case at hand, it has been established that AGID, however, published online—until the XX, albeit due to “an oversight that [according to its statement] must be considered unusual”—on its institutional website the list of candidates admitted to the oral exam of the aforementioned procedure, containing the personal data (first name, last name, and score) of fifteen data subjects, including the complainant. In light of all the foregoing considerations, it must be concluded that AGID disclosed personal data on its institutional website in a manner inconsistent with the principles of “lawfulness, fairness, and transparency,” as well as “data minimisation,” in violation of Art. 5, paragraph 1, subparagraphs (a) and (c) of the Regulation and in the absence of an appropriate legal basis, in violation of Article 6, paragraph 1, subparagraphs (c) and (e), of the Regulation and Article 2-ter, paragraphs 1 and 3, of the Code. 4. CONCLUSIONS In light of these considerations, the allegations set forth in the notice initiating the proceedings pursuant to Art. 166 of the Code are upheld, since the statements made during the preliminary investigation and the defenses raised are insufficient to rebut the findings made by the Office, and, moreover, none of the cases provided for in Art. 11 of Regulation No. 1/2019 apply. Therefore, the Authority finds that the conduct of the controller was unlawful, as it disclosed the list of candidates admitted to the oral exam (15 data subjects) participating in the aforementioned procedure, including the complainant, in violation of Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code. The established violation, as described in the reasoning, cannot in any way be considered “minor,” particularly given that the processing nevertheless resulted in the online disclosure of personal data—albeit due to a mere error—which ceased only upon receipt of the Authority’s notice initiating the investigation (see Recital 148 of the Regulation). 5. CORRECTIVE MEASURES Considering that the conduct has ceased to have any effect —given that AGID promptly removed the aforementioned list from its institutional website upon receiving the request from the Office—the conditions for adopting further corrective measures under Article 58(2) of the Regulation do not apply. 6. ORDER-INJUNCTION Pursuant to Article 58(2)(i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction order (see Articles 18 of Law No. 689 of November 24, 1981, and 16(1) of the Data Protection Authority’s Regulation No. 1/2019). 6.1. Assessment of the Conduct and Determination of the Applicable Penalty Given that the violation of the aforementioned provisions resulted from a single act, Art. 83(3) of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. In the present case, the most serious violations are subject to the penalty provided for in Art. 83(5) of the Regulation. 6.2 Determination of the administrative fine (Art. 83(2) of the Regulation) The amount of the administrative fine must be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account that: - the processing in question involved fifteen data subjects and continued from 2021 until January 23, 2026, even though AGID erroneously believed it had deleted the data subject’s personal data in 2025 (Article 83(2)(a) of the Regulation); - the violation was due to negligence, as the processing of personal data occurred due to a mere error on the part of AGID (see Article 83(2)(b) of the Regulation); - the processing involved the online disclosure of general data concerning the data subjects (see Article 83(2)(g) of the Regulation), it is considered that, in the present case, the severity of the violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, it is considered that, for the purposes of determining the amount of the fine, the following circumstances must be taken into account: - AGID acknowledged that it removed the aforementioned list within hours of becoming aware that it was still published on its institutional website, having verified “the proper publication of all measures for publicity purposes” (Art. 83, para. 2, subpar. c), of the Regulation); - it cooperated fully with the Authority during the investigation (Art. 83, para. 2, subpar. f), of the Regulation); - there are no previous relevant violations committed by the controller regarding the processing of personal data in the same context for the purposes of publicity and transparency of competitive selection procedures (Article 83, para 2, subparagraph e), of the Regulation); In light of the foregoing factors, assessed as a whole, it is determined that the amount of the administrative fine shall be set at 15,000.00 (fifteen thousand/00) for the violation of Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code, and as an administrative fine deemed, pursuant to Article 83, para 1, of the Regulation, to be effective, proportionate, and dissuasive. In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the additional sanction of publishing this section of the decision containing the injunction on the Data Protection Authority’s website must be applied, in particular due to the dissemination of personal data that was published online for an extended period of time without an appropriate legal basis. FOR THESE REASONS declares, pursuant to Art 57(1)(f) of the Regulation, that the processing carried out by AGID (Agency for Digital Italy), in the person of its pro tempore representative, with registered office at Via Liszt 21 - 00144 Rome (RM), Tax ID No. 97735020584, for violation of Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code, as set forth in the reasoning; IT IS HEREBY ORDERED pursuant to Articles 58, para 2, subparagraph i) and 83 of the Regulation, as well as Article 166 of the Code, that the aforementioned data controller pay the sum of 15,000.00 euros (fifteen thousand/00) as an administrative fine for the violations indicated in the grounds; IT IS ORDERED that the aforementioned data controller, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, pay the sum of 15,000.00 euros (fifteen thousand/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the imposed penalty within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; IT IS HEREBY ORDERED - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; - Pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; - Pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an objection to this decision may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10; failure to do so within thirty days from the date of notification of the decision—or within sixty days if the appellant resides abroad—will result in the appeal being deemed inadmissible. Rome, October 7, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori [Web Doc. No. 10309202] Order of October 7, 2026 Register of Orders No. 745 of October 7, 2026 THE DATA PROTECTION COMMISSIONER AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “Regulation”); HAVING REGARD TO the Code on Personal Data Protection (Legislative Decree No. 196 of June 30, 2003), (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation No. 1/2019 of the Data Protection Authority”); HAVING REGARD TO the documentation on file; HAVING REGARD TO the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, adopted by resolution of June 28, 2000 (web doc. No. 1098801); RAPPORTEUR: Prof. Pasquale Stanzione; 1. FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1. Origin of the preliminary investigation In a complaint filed on XX pursuant to Art. 77 of the Regulation, Mr. XX stated that in 2021 he had participated in a competitive selection process “for the hiring of one (1) employee in the professional profile of Administrative Officer, specializing in public communication and institutional relations—Category III—and two staff members on full-time, fixed-term employment contracts in the professional profile of Administrative Assistant—Category II—for the needs of the “Smarter Italy” program at the Agency for Digital Italy (hereinafter “AGID”), and that he had requested the removal of his personal data from the administration’s website. The complainant stated that at the address https://trasparenza.agid.gov.it/download/8404.html, “the list of candidates admitted to the [oral] exam, including the complainant,” had been published. 1.2. Actions Taken. By letter dated XX, this Authority initiated a preliminary investigation, informing AGID that the aforementioned list was still present on its institutional website. Upon learning that the list, containing the names of participants admitted to the oral exam—including the complainant—was still visible on its institutional website, AGID took steps to remove the entire document within a few hours. 2. INITIATION OF PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND SANCTIONING MEASURES AND THE PARTY’S DEFENSE 2.1. Initiation of proceedings (Art. 166, paragraph 5, of the Code) Based on an examination of the evidence gathered during the activities described above and the verification of the alleged violations, by notice dated XX (Ref. No. XX) served pursuant to Article 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures referred to in Article 58, para 2, of the Regulation against the controller, inviting the controller to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The alleged violations, concerning the online dissemination of the aforementioned personal data, relate to Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code. 2.2. Defenses of the Controller (Article 166, paragraph 6, of the Code) In a letter dated XX, AGID—which did not request a hearing—stated that the personal data in the published document referred exclusively to “the candidate’s first name, last name, and score” and that the publication occurred “due to a mere operational oversight” that was entirely incidental. AGID’s representative stated that, “in accordance with established practice,” it communicates the results of competitive selection procedures “by using unique identification codes assigned to candidates.” Following the complainant’s request, having received no further communication from him, AGID “was convinced in good faith—albeit erroneously—that it had already positively and effectively granted the data subject’s request.” 3.1 Data Protection Legislation. The regulations governing data protection provide that public entities, even when conducting competitive, selection, or other evaluation procedures prior to the establishment of an employment relationship, may process the personal data of data subjects (Art. 4, No. 1, of the Regulation) if the processing is necessary “to comply with a legal obligation to which the controller is subject” (Articles 6(1)(c), 9(2)(b), and 4; 88 of the Regulation) or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6, para. 1, subpar. c) and e) of the Regulation and Art. 2-ter of the Code). Such processing must, however, be based on Union or Member State law, which must pursue a public interest objective and be proportionate to the pursuit of that objective. The processing purpose must be necessary for the performance of a task carried out in the public interest or related to the exercise of official authority vested in the controller (see Article 6(3) of the Regulation and Article 2-ter of the Code). The controller is required to comply with data protection principles, including those of “lawfulness, fairness, and transparency” as well as “data minimisation,” according to which personal data must be “processed lawfully, fairly, and in a transparent manner in relation to the data subject” and must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Article 5, paragraph 1, subparagraphs (a) and (c) of the Regulation). 3.2 The Online Disclosure of Personal Data in the Context of Insolvency Proceedings. Following the preliminary investigation into the complaint and the statements made by the controller—who also assumed accountability pursuant to Article 168 of the Code—it emerged that AGID published, on the “Transparent Administration Portal” of its institutional website, up until the date the Authority’s notice initiating the investigation was received, the list of candidates admitted to the oral exam of the aforementioned procedure, containing the personal data (first name, last name, and score) of fifteen data subjects who were deemed eligible, including the complainant. Although AGID was convinced that it had correctly replaced the published document with another one lacking identifying information, due to the “failure to complete the document replacement,” the aforementioned list—which also contained the complainant’s identifying information—remained published online “due to a mere operational oversight.” In this regard, it should be noted that, within a regulatory framework characterized by rules that have evolved over time, the legal provisions establishing, in general, the publication of rankings for competitive examinations and selection processes serve to enable data subjects—participants in such competitive or selection procedures— to exercise their rights and verify the legality of administrative actions; and they stipulate, first and foremost, that only the final rankings of competition winners are to be published online, and not the list of candidates admitted to the intermediate rounds (see Art. 35 et seq. of Legislative Decree No. 165 of March 30, 2001, as last amended by Decree-Law No. 25 of March 14, 2025, converted with amendments by Law No. 69 of May 9, 2025; see also Art. 7 of Presidential Decree No. 3 of January 10, 1957; as well as Presidential Decree No. 487 of May 9, 1994). As is well known, the Data Protection Authority has, over time, provided specific guidance to public administrations regarding the precautions to be taken when disseminating personal data on the internet for the purposes of transparency and public disclosure of administrative actions in the specific guidelines (“Guidelines on the processing of personal data, including data contained in administrative acts and documents, carried out for the purposes of publicity and transparency on the web by public entities and other obligated bodies,” Provision No. 243 of May 15, 2014, web doc. No. 3134436, specifically Parts I and II, para. 3.b; see also the “Guidelines on the Processing of Personal Data of Employees for the Purpose of Managing Employment Relationships in the Public Sector,” Provision No. 161 of June 14, 2007, web doc. No. 1417809), as well as in numerous provisions concerning the processing of personal data in the context of insolvency proceedings, in which it noted the unlawful disclosure of personal data contained in the interim documents of such proceedings (see, e.g., Provision No. 114 of February 26, 2026, web doc. No. 10234960 and the provisions cited therein). The provisions on administrative transparency also establish specific publication requirements regarding final rankings in the “Transparent Administration” section of government agencies’ official websites. In fact, pursuant to Legislative Decree No. 33 of March 14, 2013, “without prejudice to other legal disclosure obligations, public administrations shall publish notices of competitive examinations for the recruitment, for any purpose, of personnel within the administration, as well as the evaluation criteria of the Selection Committee, the exam questions, and the final rankings, updated to reflect any advancement of eligible candidates who were not selected. Public administrations shall publish and keep constantly updated the data referred to in paragraph 1” (Art. 19, paragraphs 1 and 2; see Provision No. 235 of April 11, 2024, web doc. 10019523, see also the newsletter of June 6, 2024, Provision No. 404 of July 4, 2024, web doc. No. 10050145, June 20, 2024, No. 372, web doc. No. 10039471, April 11, 2024, No. 235, web doc. No. 10019523, April 28, 2022, No. 151, web doc. No. 9778996, and the previous measures referred to therein, including, in particular, Measure No. 407 of November 25, 2021, web doc. 9732406). These provisions define, from a data protection perspective, the scope of permitted processing and constitute its legal basis by establishing limits, conditions, and prerequisites for the online publication of personal data in the context of insolvency proceedings. In line with the Authority’s guidelines in this area of data processing and with a view to drawing the attention of public administrations to strict compliance with data protection principles and sector-specific regulations—also in light of recent legislative action (see the aforementioned Legislative Decree No. 25 of March 14, 2025, converted into Law No. 69 of May 9, 2025), please note that specific FAQs are available on the Data Protection Authority’s website, shared with the Department of Public Administration, aimed at providing guidance and clarification to prevent non-compliant initiatives and processing of personal data in this specific context, with a view to effectively balancing data protection with transparency and public disclosure of competitive selection procedures (see “FAQs on the Processing of Personal Data of Participants in Competitive Selection Procedures for the Purpose of Publicity and Transparency in Light of Recent Regulatory Provisions,” web doc. No. 10187304). Even with reference to the aforementioned current regulatory framework—which, in any case, does not apply to the case at hand—it should be noted that personal data contained in procedural records or documents must not be published online. It remains understood, however, that the test log, the scores obtained, any notices to appear for the exams, and the list of candidates who passed the exam, along with their respective scores, must be made available exclusively to participants in the procedure in a restricted-access area, using the specific features of the InPA Portal (see the aforementioned FAQs, No. 8). With regard to the case at hand, it has been established that AGID, however, published online—until the XX, albeit due to “an oversight that [according to its statement] must be considered unusual”—on its institutional website the list of candidates admitted to the oral exam of the aforementioned procedure, containing the personal data (first name, last name, and score) of fifteen data subjects, including the complainant. In light of all the foregoing considerations, it must be concluded that AGID disclosed personal data on its institutional website in a manner inconsistent with the principles of “lawfulness, fairness, and transparency,” as well as “data minimisation,” in violation of Art. 5, paragraph 1, subparagraphs (a) and (c) of the Regulation and in the absence of an appropriate legal basis, in violation of Article 6, paragraph 1, subparagraphs (c) and (e), of the Regulation and Article 2-ter, paragraphs 1 and 3, of the Code. 4. CONCLUSIONS In light of these considerations, the allegations set forth in the notice initiating the proceedings pursuant to Art. 166 of the Code are upheld, since the statements made during the preliminary investigation and the defenses raised are insufficient to rebut the findings made by the Office, and, moreover, none of the cases provided for in Art. 11 of Regulation No. 1/2019 apply. Therefore, the Authority finds that the conduct of the controller was unlawful, as it disclosed the list of candidates admitted to the oral exam (15 data subjects) participating in the aforementioned procedure, including the complainant, in violation of Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code. The established violation, as described in the reasoning, cannot in any way be considered “minor,” particularly given that the processing nonetheless resulted in the online disclosure of personal data—albeit due to a mere error—which ceased only upon receipt of the Authority’s notice initiating the investigation (see Recital 148 of the Regulation). 5. CORRECTIVE MEASURES Considering that the conduct has ceased to have any effect —given that AGID promptly removed the aforementioned list from its institutional website upon receiving the request from the Office—the conditions for adopting further corrective measures under Article 58(2) of the Regulation do not apply. 6. ORDER-INJUNCTION Pursuant to Article 58(2)(i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction order (see Articles 18 of Law No. 689 of November 24, 1981, and 16(1) of the Data Protection Authority’s Regulation No. 1/2019). 6.1. Assessment of the Conduct and Determination of the Applicable Penalty Given that the violation of the aforementioned provisions resulted from a single act, Art. 83(3) of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. In the present case, the most serious violations are subject to the penalty provided for in Article 83(5) of the Regulation. 6.2 Determination of the administrative fine (Article 83(2) of the Regulation) The amount of the administrative fine must be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account that: - the processing in question involved fifteen data subjects and continued from 2021 until January 23, 2026, even though AGID erroneously believed it had deleted the data subject’s personal data in 2025 (Article 83(2)(a) of the Regulation); - the violation was due to negligence, as the processing of personal data occurred due to a mere error on the part of AGID (see Article 83(2)(b) of the Regulation); - the processing involved the online disclosure of general data concerning the data subjects (see Article 83(2)(g) of the Regulation), it is considered that, in the present case, the severity of the violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, it is considered that, for the purposes of determining the amount of the fine, the following circumstances must be taken into account: - AGID acknowledged that it removed the aforementioned list within hours of becoming aware that it was still published on its institutional website, having verified “the proper publication of all measures for publicity purposes” (Art. 83, para. 2, subpar. c), of the Regulation); - it cooperated fully with the Authority during the investigation (Art. 83, para. 2, subpar. f), of the Regulation); - there are no previous relevant violations committed by the controller regarding the processing of personal data in the same context for the purposes of publicity and transparency of competitive selection procedures (Article 83, para 2, subparagraph e), of the Regulation); In light of the foregoing factors, assessed as a whole, it is determined that the amount of the administrative fine shall be set at 15,000.00 (fifteen thousand/00) for the violation of Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code, and as an administrative fine deemed, pursuant to Article 83, para 1, of the Regulation, to be effective, proportionate, and dissuasive. In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the additional sanction of publishing this section of the decision containing the injunction on the Data Protection Authority’s website must be applied, in particular due to the dissemination of personal data that was published online for an extended period of time without an appropriate legal basis. FOR THESE REASONS declares, pursuant to Article 57(1)(f) of the Regulation, that the processing carried out by AGID (Agency for Digital Italy), in the person of its pro tempore representative, with registered office at Via Liszt 21 - 00144 Rome (RM), Tax ID No. 97735020584, for violation of Articles 5 and 6 of the Regulation, as well as Article 2-ter of the Code, as set forth in the reasoning; IT IS HEREBY ORDERED pursuant to Articles 58, para 2, subparagraph i) and 83 of the Regulation, as well as Article 166 of the Code, that the aforementioned data controller pay the sum of 15,000.00 euros (fifteen thousand/00) as an administrative fine for the violations indicated in the grounds; IT IS ORDERED that the aforementioned data controller, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, pay the sum of 15,000.00 euros (fifteen thousand/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is hereby noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—in accordance with the procedures set forth in the attachment – of an amount equal to half of the penalty imposed within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; IT IS HEREBY ORDERED - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; - Pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; - Pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation in the Authority’s internal register provided for by Article 57, para 1, letter u), of the Regulation. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction specified in the aforementioned Art 10, under penalty of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, October 7, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori