Italian Data Protection Authority (Garante) · 4 December 2025
Roverbella Comprehensive School
Insufficient legal basis for data processing
Fine€1,000Fine issued
- Regulator
- Italian Data Protection Authority (Garante)
- Decided
- 4 December 2025
- Country
- Italy
- Sector
- Public Sector and Education
- Regulator’s reference
- Not recorded
- Fino case number
- 2025/IT/004
What happened
The DPA fined a school €1,000 for unlawfully disclosing students’ personal data by sending an email about vaccination obligations in which all recipients’ email addresses were visible. The DPA held that the indication that students had not received specific vaccinations constituted unlawful processing of sensitive data.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Data principles
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2025/IT/004.