The Italian authority sanctions a hospital for publishing online the complete list of candidates, including those deemed unfit, in a recruitment procedure. It considers that the transparency obligation applicable to public competitions does not extend to this type of selection and that the publication was therefore without legal basis, violating the principles of lawfulness and data minimization.

Facts and context

The Italian data protection authority (GPDP) has today published a sanction decision against the IRCCS University Hospital of Bologna for breaches related to the unlawful publication of personal data of candidates in a recruitment procedure.

The case originated from a complaint by a candidate whose personal data, including a judgment of unfitness, were published on the hospital's website and indexed by search engines.

Grounds for the decision

The authority found several GDPR violations, based on the following reasoning:

• Lawfulness of processing obligation (Article 6 of the GDPR): The authority ruled that the online publication of the list of fit and unfit candidates lacked a legal basis. The hospital wrongly invoked Article 19 of Legislative Decree No. 33/2013 on transparency, as this provision applies only to public competitions and requires only the publication of the final lists of winners. However, the procedure in question was a personnel selection from employment agency lists, which does not constitute a public competition within the meaning of the aforementioned law. The dissemination of data of all participants, especially non-selected candidates, was therefore not provided for by any legal provision.
• Data minimization obligation (Article 5(1)(c) of the GDPR): By publishing the names of all participants, including those deemed unfit, the hospital processed data that were not adequate, relevant, and limited to what was necessary in relation to the transparency purposes. The authority recalls, based on its transparency guidelines (provv. No. 243 of 15 May 2014), that even when a legal basis for publication exists, the dissemination of data of non-selected candidates is disproportionate and irrelevant.
• Prohibition to process special categories of data (Article 9 of the GDPR): In its notification of allegations, the authority noted that participation in this selection procedure, originating from employment agency lists, could indirectly reveal data relating to health or a vulnerability situation. Although the hospital contested this qualification, the authority considered that the publication of the complete list, in the absence of an adequate legal basis, created a risk of disclosure of sensitive information.

Authority's decision

Consequently, the authority imposed a sanction on the IRCCS University Hospital of Bologna, the amount of which is not specified in the published decision.

Lessons learned

This decision reminds that:

• Publication obligations regarding administrative transparency must be interpreted strictly and cannot be extended by analogy to recruitment procedures not explicitly covered by law, such as selection based on employment agency lists.
• The publication of the results of a selection procedure must respect the minimization principle: only the names of selected candidates should be disclosed, and only if a specific legal basis provides for it, excluding candidates deemed unfit or not selected.
• The context of processing, such as a recruitment procedure reserved for persons registered on specific lists, may indirectly reveal sensitive information about data subjects, which requires increased vigilance regarding the lawfulness and modalities of any publication.