The Italian data protection authority (GPDP) issued a decision against the Ministry of Justice for breaches related to the publication of the written exam results of a notary competition.

Facts and context

The case began following press articles concerning the disclosure of a document containing the list of winners of a notary competition, accompanied by personal comments on certain candidates. However, the authority's investigation focused on the methods of publication of the results by the Ministry itself.

Grounds for the decision

• Obligation of lawfulness, fairness and transparency (Article 5(1)(a) of the GDPR) and to have a legal basis for processing (Article 6 of the GDPR): The Ministry published a list containing the names of admitted and non-admitted candidates, whereas the applicable sector regulation (Royal Decree No. 1326 of 1914) only authorizes the posting of the list of candidates admitted to the oral exam. Furthermore, making this list available on a table in an entrance hall accessible to all, before security checks, constituted a "disclosure" of personal data not provided for by law. The authority found that this processing, exceeding the legal framework both in content and publication methods, lacked a valid legal basis within the meaning of Articles 6(1)(c) and (e) of the GDPR and Article 2-ter of the Italian Data Protection Code, and recalls that the legal basis must be clear, precise and foreseeable for the data subjects (Recital 41 of the GDPR).
• Data minimization obligation (Article 5(1)(c) of the GDPR): The published list contained information unnecessary for the purpose of publishing the results, such as candidates' dates of birth, file and envelope numbers, as well as detailed scores for each test and the total score. The inclusion of these additional data was deemed excessive and non-compliant with the minimization principle.

Authority's decision

Consequently, the authority declared unlawful the processing of personal data carried out by the Ministry of Justice and fined it 20,000 euros.

Lessons learned

This decision reminds that:

• The publication of public competition results must be strictly limited to what the applicable legal basis provides, notably by not disclosing the names of non-admitted candidates if the law does not explicitly require it.
• Information published in selection procedures must be limited to what is strictly necessary to achieve transparency, excluding irrelevant data such as full date of birth or internal file numbers.
• The methods of publishing results must ensure that only persons with a legitimate interest have access; leaving a list freely accessible in a public place constitutes unlawful disclosure of personal data.