DATA PROTECTION
Data Protection Authority: In public contests the Public Administrations may only publish online the final rankings of the winners, under penalty of unlawful disclosure of personal data.
Publishing on the web the results of intermediate tests or the personal data of competitors who have not won or have not been admitted to a contest is a breach of the data protection rights.
This is how the Italian Data Protection Authority ruled following a complaint lodged by a participant in a public contest organized by the Italian Institute per Social Security (INPS).
The complainant had complained about the publication on the Institute's website of numerous acts and documents, including the lists of those admitted and not admitted to the written test and oral test, and the list of participants, containing the assessment of qualifications by the Contest Committee, with an indication of the marks awarded to each candidate. These documents would then also end up on social networks by third parties.
The Italian Data Protection Authority recalled that Public Administrations, when they operate in the performance of contests procedures, must process the personal data of the persons concerned in compliance with the applicable sector regulations, and therefore it is not possible to publish online data of participants in competitions that are not required by law. In fact, differentiated levels of protection of personal data are not allowed, neither on a territorial basis nor at the level of individual administrations, especially when the matter has already been balanced and regulated by the legislator with uniform provisions at national level.
In quantifying the amount of the fine to INPS at EUR 20,000, the Authority took into account the nature, duration and seriousness of the breach, as well as the large number of persons concerned and the cooperative attitude of the Institute, which removed the lists in question, albeit following the Italian Data Protection Authority's request for information.
This is how the Italian Data Protection Authority ruled following a complaint lodged by a participant in a public contest organized by the Italian Institute per Social Security (INPS).
The complainant had complained about the publication on the Institute's website of numerous acts and documents, including the lists of those admitted and not admitted to the written test and oral test, and the list of participants, containing the assessment of qualifications by the Contest Committee, with an indication of the marks awarded to each candidate. These documents would then also end up on social networks by third parties.
The Italian Data Protection Authority recalled that Public Administrations, when they operate in the performance of contests procedures, must process the personal data of the persons concerned in compliance with the applicable sector regulations, and therefore it is not possible to publish online data of participants in competitions that are not required by law. In fact, differentiated levels of protection of personal data are not allowed, neither on a territorial basis nor at the level of individual administrations, especially when the matter has already been balanced and regulated by the legislator with uniform provisions at national level.
In quantifying the amount of the fine to INPS at EUR 20,000, the Authority took into account the nature, duration and seriousness of the breach, as well as the large number of persons concerned and the cooperative attitude of the Institute, which removed the lists in question, albeit following the Italian Data Protection Authority's request for information.
