The publication of a ranking file for scholarships, containing excessive personal data in hidden columns, was deemed unlawful by the Italian data protection authority, which highlighted the misinterpretation of transparency legislation by the organization.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) today published a sanction decision against the "Rome Technopole" foundation (including the imposition of an €8,000 fine) for breaches related to the unlawful dissemination of personal data of scholarship recipients.

The case originated from a complaint by a student who discovered that the publication of a ranking revealed, through hidden columns in a spreadsheet file, numerous personal data concerning 480 recipients.

Grounds for the decision

• Obligation of lawfulness, fairness, transparency, and data minimization (Articles 5 and 6 of the GDPR): The authority found that the foundation had published on its website a file containing detailed data on 480 recipients, including residence address, tax code, date of birth, email address, identity document number, and bank details (IBAN). The foundation invoked a legal obligation of transparency arising from Legislative Decree No. 33/2013. The authority rejected this argument specifying that the cited provision (Article 19) concerns competitions for staff recruitment and not the granting of scholarships. It added that even if this legal basis had been applicable, it would have only authorized the publication of the name, first name, date of birth (in case of homonymy), and ranking, making the dissemination of other data manifestly excessive and not compliant with the minimization principle.

Authority's decision

Consequently, the authority imposed an €8,000 fine on the "Rome Technopole" foundation.

Furthermore, the authority ordered the publication of its decision on its website.

Lessons learned

This decision reminds that:

• A legal obligation of transparency must be interpreted strictly and cannot serve as a basis for data publication if the scope of the norm is not respected (in this case, a law on staff recruitment does not apply to the granting of scholarships).
• Even when a publication is legally required, the minimization principle requires only disseminating data strictly necessary for the transparency objective, excluding excessive information such as bank details or identity document numbers.
• Hiding columns in a spreadsheet does not constitute an adequate technical or organizational measure to protect data; files intended for publication must be separate extracts from internal working files and contain only minimized data.