# Istituto di Istruzione Superiore Della Corte Vanvitelli: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2026-10-20
- Original: https://www.enforcementtracker.com/ETid-3412
- Canonical: https://overview.legal/posts/607771
- Topics: Education, Personal Data, Health Data, Healthcare, Supervision, Supervisory Authorities, Public Authority

## Summary

The Italian Data Protection Authority (Garante) fined Istituto di Istruzione Superiore Della Corte Vanvitelli €4,000 for insufficient legal basis for personal data processing in violation of GDPR Articles 5(1)(a), 6, and 9. The Garante found that the educational institution failed to establish a valid legal basis and improperly handled special category data, violating principles of lawfulness and fairness. The enforcement action resulted in a monetary penalty addressing the public sector school's non-compliance with foundational GDPR processing requirements.

## Full text

Italian Data Protection Authority (Garante) fined Istituto di Istruzione Superiore Della Corte Vanvitelli €4,000 on 2026-10-20 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR
Sector: Public Sector and Education
Country: Italy
Source: https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10314795

---
Generated by overview.legal · https://overview.legal/posts/607771 · 2026-11-14