A minor male student at a school in Italy had his private medical information regarding a positive COVID-19 test exposed to his classmates and their parents. A teacher at the school sent the notification and the official public health document containing the minor’s identity via the school’s electronic register. The incident led the student’s father to file a formal complaint with the Italian Data Protection Authority (Garante), which subsequently investigated and issued an official warning to the school for unlawful data communication.