Unauthorized Online Disclosure of Minor Student’s Medical Information by Italian School District
The Italian Data Protection Authority fined a school district in Italy €4,000 for a privacy breach. The school published a teacher selection circular on its public institutional website that included the initials, class, and references to medical documentation of a minor student who required home-based instruction. This online publication effectively exposed the student’s private health […]
Unauthorized Disclosure of Student’s Disability Status via School Email
An instructor at a high school in Italy mistakenly sent three email communications regarding a student’s Individualized Education Program (PEI) to all of the student’s classmates. As a result of this error, the student’s sensitive disability and medical status were exposed to their peers without authorization.
Unauthorized Exposure of Special Education Students’ Status via School Register Platform
A public school in Italy distributed operational meeting schedules via its school register platform. The documents contained the initials of 52 certified students with disabilities, making their sensitive medical-educational status recognizable to unauthorized parents, teachers, and students. As a result, the sensitive health data of these students was exposed to the wider school community, leading […]
Exposure of Minor Student’s COVID-19 Status via School Electronic Register
A minor male student at a school in Italy had his private medical information regarding a positive COVID-19 test exposed to his classmates and their parents. A teacher at the school sent the notification and the official public health document containing the minor’s identity via the school’s electronic register. The incident led the student’s father […]
Exposure of student’s special education and health details on school electronic registry portal
An administrative assistant at a high school in Italy made a selection error on the school’s electronic registry portal, accidentally publishing a confidential meeting notice to all parents of a class instead of only the target student’s parents. As a result, the female student’s sensitive personal and health-related data, including her special education status and […]
School Electronic Register Error Exposes Minor Student’s Individualized Education Plan to Class Parents
A support teacher at a school in Italy mistakenly configured the visibility settings on the school’s electronic register while uploading an Individualized Education Plan (PEI). This error made a minor student’s sensitive educational and disability records visible to all parents of the classroom for approximately 22 minutes. During this window, another parent saw the notification, […]
School email to about 37 families with visible addresses reveals children missing vaccination paperwork; school asks email software vendor for a warning, Lombardy, Italy
Parents complained through a lawyer that the school sent a vaccination-compliance reminder to about 37 families with all addresses visible, revealing which children were not in order. The school notified a data breach, retrained staff, and asked the software house that supplies its email program to add a warning whenever several recipients are entered. The […]
Danish Data Protection Authority Reprimands Five Municipalities over AULA Security Failures
The Danish Data Protection Authority (Datatilsynet) issued formal reprimands and enforcement orders to five Danish municipalities—Lolland, Esbjerg, Hillerød, Randers, and Frederikshavn—following an audit of their security practices on the school communication platform AULA. The regulator found that the municipalities failed to document adequate risk assessments and did not meet the minimum requirements for Data Protection […]
Copenhagen Municipality Reprimanded by Datatilsynet Over Aula Security Failures
The Danish Data Protection Authority (Datatilsynet) issued a formal reprimand to Copenhagen Municipality (Københavns Kommune) regarding its use of the school communication platform Aula. The regulator determined that the municipality failed to conduct a compliant data protection impact assessment and did not fully demonstrate that appropriate security measures were implemented to mitigate risks such as […]