Skip to main content

SHIELD

Unauthorized Online Disclosure of Minor Student’s Medical Information by Italian School District

The Italian Data Protection Authority fined a school district in Italy €4,000 for a privacy breach. The school published a teacher selection circular on its public institutional website that included the initials, class, and references to medical documentation of a minor student who required home-based instruction. This online publication effectively exposed the student’s private health […]

Unauthorized Public Exposure of High School Exam Results and Schedules on School Website

The Italian Data Protection Authority (GPDP) fined a high school in the Lombardy region of Italy 2,000 after an administrative staff member mistakenly published intermediate exam results, final exam scores, and detailed oral exam schedules containing student names on the school’s public website. The data was intended to be restricted to the secure, private electronic […]

Unlawful Biometric Attendance Verification of Students at Università Telematica e-Campus

The Italian Data Protection Authority fined Università Telematica e-Campus 50,000 euros for unlawfully processing students’ biometric data between March and November 2024. The university used a facial recognition system integrated into its webinar platform to verify the attendance of adult students enrolled in its online teacher training courses. Students were required to provide mandatory consent […]

Unauthorized Exposure of Special Education Students’ Status via School Register Platform

A public school in Italy distributed operational meeting schedules via its school register platform. The documents contained the initials of 52 certified students with disabilities, making their sensitive medical-educational status recognizable to unauthorized parents, teachers, and students. As a result, the sensitive health data of these students was exposed to the wider school community, leading […]

Teacher Absences and Schedules Unlawfully Exposed on Public Website and Electronic Register

An Italian public school published the service hours and recess surveillance shifts of teachers, including an adult teacher, on its public website. Additionally, instead of using a restricted administrative module, the school utilized the public bulletin board function of an electronic register platform to manage teacher absences and substitutions, thereby exposing the teacher’s absences to […]

Unauthorized Disclosure of Student’s Disability Status via School Email

An instructor at a high school in Italy mistakenly sent three email communications regarding a student’s Individualized Education Program (PEI) to all of the student’s classmates. As a result of this error, the student’s sensitive disability and medical status were exposed to their peers without authorization.

School Employee’s Sensitive Medical Data Exposed via Document Management Software

An employee of a school in Italy had their highly sensitive medical information and labor dispute details exposed to 14 coworkers. The incident occurred when an administrative worker mistakenly uploaded the employee’s court documents onto the ordinary registry of the school’s document management software instead of the restricted, reserved protocol. Consequently, the employee filed a […]