The Italian data protection authority sanctioned a regional employment agency for publishing online and making searchable by search engines the list of candidates in a recruitment procedure, in the absence of a specific legal basis justifying such disclosure.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) has today published a sanction decision against the Regional Employment Agency of Emilia-Romagna for breaches related to the online publication of the list of participants in a recruitment procedure.

The case originated from a complaint by a person whose name and surname appeared in a ranking list published online and indexed by search engines, as part of a selection for technical reception operator positions within the hospital-university company of Bologna.

Grounds for the decision

• Obligation of lawfulness and data minimisation (Article 5(1)(a) and (c) of the GDPR and Article 6 of the GDPR): The regional agency published on its website, allowing indexing by search engines, the names of about 700 candidates in a specific recruitment procedure. The authority found this processing unlawful, as the agency could not demonstrate the existence of a legal or regulatory provision requiring such online publication. The authority rejected the agency's argument based on transparency obligations, specifying that these obligations apply only to classic competition procedures and not to the specific recruitment procedure by orientation from employment centre lists (Art. 16 of Law No. 56/1987). Likewise, although the regulation (D.P.R. 487/1994) provides for "making these lists public," it specifies a limited method (posting on an information board) and not a generalized online dissemination, thus also violating the principle of minimisation.

Decision of the authority

Consequently, the authority imposed a sanction against the Regional Employment Agency of Emilia-Romagna.

Lessons learned

This decision reminds that:

• The online disclosure of personal data by a public body must be based on an explicit and specific legal basis; general transparency principles are not sufficient to justify generalized publication.
• The publicity methods provided by a regulation (such as posting on an information board) must be respected and cannot be disproportionately extended, such as online publication accessible via search engines, without legal authorization.
• A precise legal analysis of the nature of each administrative procedure is essential to determine the applicable publication obligations, as distinct regimes may coexist (for example, between a public competition and recruitment from a list).