{"id":3690,"date":"2026-11-13T14:32:54","date_gmt":"2026-11-13T13:32:54","guid":{"rendered":"https:\/\/www.edito-pdf.com\/?p=3690"},"modified":"2026-11-13T15:18:21","modified_gmt":"2026-11-13T14:18:21","slug":"how-an-italian-municipality-paid-9000-euros-for-two-words-too-many","status":"publish","type":"post","link":"https:\/\/www.edito-pdf.com\/en\/how-an-italian-municipality-paid-9000-euros-for-two-words-too-many\/","title":{"rendered":"How an Italian municipality paid \u20ac9,000 for two words too many"},"content":{"rendered":"
\n

The case in brief.<\/strong> Court of Appeal of Palermo (Sicily), First Civil Division, judgment no. 1399 filed on 6 October 2025. A municipality had published on its Albo Pretorio<\/em> (the official notice board every Italian municipality must keep, today online) and on its website documents showing in clear text the name of an employee and information about her health, such as her days of sick leave: among them act no. 4 of 28 April 2009, on display from 23 May to 6 June 2009. Outcome: \u20ac7,000 in compensation for non-pecuniary damage, upheld on appeal, plus \u20ac2,000 in costs for the appeal, on top of the first-instance costs and the municipality\u2019s own legal fees.<\/p>\n<\/blockquote>\n

\"AI-generated
From the physical notice board to the online one: the same mistake, with an infinitely larger audience. AI-generated illustration: documents, names and screens are invented and do not reproduce real documents.<\/em><\/figcaption><\/figure>\n

The Court of Appeal of Palermo has upheld a ruling that should make anyone who manages public documents stop and think. An Italian municipality must compensate an employee for publishing administrative acts showing that she had been absent due to illness. No diagnosis, no condition named: her name and the reference to illness were enough. Cost: at least \u20ac9,000, not counting the overall legal expenses.<\/p>\n

\n

Why this matters outside Italy.<\/strong> The case is Italian, but the mechanism is European. Public bodies across the EU are required to publish many of their decisions, and all of them apply the GDPR, which treats health data as a special category (Article 9) and gives anyone harmed by a breach the right to compensation (Article 82). The names of the laws change; the mistake, and the bill, do not.<\/p>\n<\/blockquote>\n

The short circuit between transparency and privacy<\/h2>\n

The paradox is that the municipality thought it was doing its duty: publishing its acts to ensure transparency and make spending traceable. On appeal it defended itself in exactly this way, citing the publication duties in Italy\u2019s consolidated law on local authorities. The problem is that it did it badly.<\/p>\n

Transparency duties require certain acts to be made public. But data protection law requires, with equal force, that personal data be protected, health data above all. The facts date back to 2009, so the Court applied Italy\u2019s national data protection code (Legislative Decree 196\/2003<\/a>, known as the Privacy Code) as in force at the time, which already prohibited public bodies from disseminating health data. Today the picture is the same, and even clearer: the GDPR<\/a> treats health data as a \u201cspecial category\u201d, and the Italian code, as amended in 2018, repeats that health data may not be disseminated.<\/p>\n

The principle is clear, and the Court took it from the Court of Cassation, Italy\u2019s supreme court (judgment no. 18980\/2013<\/a>): publishing an employee\u2019s sick leave on the official notice board or on the institutional website is unlawful dissemination of personal data, even when no specific condition is mentioned<\/strong>. You do not need to go into clinical details to breach someone\u2019s privacy. Revealing that the person was ill is enough.<\/p>\n

What it would have taken<\/h2>\n

The fix was trivial. Instead of writing \u201cabsence of employee Rossi due to illness\u201d (the name here is invented), it was enough to write \u201cjustified absence\u201d or \u201cabsence for personal reasons\u201d. Or to redact the name or the reason and replace it with OMISSIS<\/strong>, the word Italian legal and administrative documents use to mark text that has been left out. The document would have stayed public, the transparency duty would have been met and the employee\u2019s privacy protected. The Italian data protection authority (the Garante<\/em>) says the same in its 2014 guidelines<\/a> on the online publication of official documents: data that is not necessary must be redacted or replaced with general wording.<\/p>\n

But when you have to handle hundreds of acts a year, human error becomes statistically inevitable. A distracted official, a moment of haste, an outdated document template, and the damage is done: \u20ac7,000 in compensation, set by the court on an equitable basis, \u20ac2,000 in costs for the appeal alone, plus the first-instance costs and its own lawyers.<\/p>\n

The hidden cost of non-compliance<\/h2>\n

This case dates from 2009, but today the problem is hugely amplified. Official notice boards are online, open to anyone, from anywhere, around the clock. Documents are indexed by search engines. Once a piece of health data is published, even if you remove it after a few days, it may already have been archived, copied and shared.<\/p>\n

Italian municipalities publish thousands of acts a year. Companies running public services, publicly owned companies, local health authorities and universities have similar duties. And they all run the same risks: GDPR fines of up to \u20ac20 million (how fines apply to public bodies varies from country to country), compensation to the people harmed and, above all, damage to the organisation\u2019s reputation.<\/p>\n

The lesson<\/h2>\n

Data protection compliance is not bureaucracy for its own sake. It is the concrete protection of fundamental rights, but it also protects the organisation.<\/p>\n

In this case the Court based the municipality\u2019s liability on Article 15 of the old Privacy Code, which referred to the Italian Civil Code\u2019s rule on dangerous activities (Article 2050). In practice, the employee only had to prove the damage and its link to the publication; it was for the municipality to show that it had taken all suitable technical and organisational measures to prevent it. It is the same logic the GDPR now calls accountability<\/em>: saying you were careful is not enough, you must be able to demonstrate it.<\/p>\n

The municipality could not. And it paid.<\/p>\n

Administrative transparency and personal data protection are not in conflict. They must coexist. But that takes structured processes, the right tools and the awareness that, over large volumes of documents, human error is not a remote possibility: it is a statistical certainty.<\/p>\n

\n

Do you publish official documents every day? Find the personal data before it goes online.<\/p>\n

Request an Omissis demo<\/a>It detects personal data in your documents and helps you redact it permanently, leaving the final say to the operator.<\/span><\/p>\n

For a handful of documents, PDF Editor<\/a> is enough, free with a free account: redaction happens on your own computer and is irreversible.<\/p>\n<\/div>\n

\n

Sources and further reading<\/h2>\n

The sources are in Italian.<\/p>\n