Issue #15 | October 2026, Week 4

Italian privacy authority fines a publishing company over crime scene photos

Jurisdiction

Italy

Infringer Legal Name

Cairo Editore

Infringer Domicile

Italy

Alleged Violation

Privacy violation

Enforcement Action

A non-disclosed fine

Case Status

An administrative action

Italy’s Data Protection Authority has fined publishing company Cairo Editore for publishing graphic images of a crime victim’s blood-stained body in its weekly magazine.

The decision, issued on September 23, 2026, followed a complaint from the victim’s family. The magazine published the photos on March 26, 2026, showing where she was found dead and her body lying on the stairs, with part of her face covered. The family said the images caused them deep distress and violated the dignity of their daughter and her memory.

The authority ruled that the images were unnecessary to report on the case and added no significant new information. It said the publication violated the regulations on the personal data.

The regulator also noted that journalists must respect the dignity of victims and their families, even after a person has died. It warned that excessive media attention can cross the line between reporting the news and sensationalism.

In a separate decision, the authority also fined a YouTube channel over similar content related to the case.

The Garante didn’t disclose the amount of fines issued in each case.

Ofqual fines ABRSM £150,000 over data retention failures

Jurisdiction

The UK

Infringer Legal Name

ABRSM

Infringer Domicile

The UK

Alleged Violation

Data retention failure

Enforcement Action

A £150,000 fine

Case Status

An administrative action

The UK qualifications regulator Ofqual (The Office of Qualifications and Examinations Regulation) has fined the Associated Board of the Royal Schools of Music (ABRSM) £150,000 (€177,900) for failing to properly retain assessment records and evidence. ABRSM provides music qualifications through face-to-face and digital assessments.

Ofqual found three incidents between 2024 and 2025 in which important assessment records were lost or deleted. In the first case, 8,539 audio recordings were not retained because of a software error, affecting 20 learners who requested a review of their marks. In another incident, recordings and marking records for 16 learners were deleted by mistake, delaying results and making it harder for them to challenge their marks.

The third incident involved a suspected malpractice case linked to a tutor overseas who entered 710 learners for assessments. However, 231 recordings were missing, limiting ABRSM’s ability to investigate the case fully.

Ofqual also found that around 72,000 certificates were issued with incorrect qualification titles, creating a risk of confusion for learners, employers and education providers. ABRSM later corrected the error, informed learners and offered replacement certificates.

As part of the settlement, ABRSM will pay the £150,000 fine, contribute £10,000 (€11,860) towards Ofqual’s investigation costs and commission an independent audit of its record-retention systems.

Health companies to pay $2.7M after data breach exposed patient information

Jurisdiction

The United States

Infringer Legal Name

BCHP; XTIUM

Infringer Domicile

The United States

Alleged Violation

Failure to protect patient data

Enforcement Action

A $2.7 million fine

Case Status

An administrative action

Boston Children’s Health Physicians (BCHP) and IT company XTIUM will pay $2.7 million after a data breach exposed the private information of approximately 825,000 New York residents and 62,871 Connecticut residents.

The breach occurred in August 2024, when hackers gained access to XTIUM’s systems and stole information from 18 clients, including BCHP.

The stolen data included personal, medical and financial information. More than 170,000 New York residents had their Social Security and driver’s license numbers exposed. The investigation found that BCHP failed to implement basic security measures, despite being aware of problems discovered in a 2023 audit. The company also left an unencrypted archive containing more than one million patient billing records largely unprotected.

XTIUM was also found to have weak security controls and insufficient monitoring to detect suspicious activity. Under the settlement, the companies will pay $2.1 million to New York and $540,000 to Connecticut. The companies are also required to strengthen their cybersecurity systems, improve monitoring and develop better plans to respond to future threats.

Romania fines Myconnector Platform €6,000 after a cyber-attack

Jurisdiction

Romania

Infringer Legal Name

Myconnector
Platform SRL

Infringer Domicile

Romania

Alleged Violation

GDPR violation

Enforcement Action

A 31,451 lei fine

Case Status

An administrative action

Romania’s National Supervisory Authority for Personal Data Processing has fined technology and event management platform Myconnector Platform SRL 31,451 lei (€6,000) for violating Article 32(1)(b) and Article 32(2) of the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.

The investigation was launched after the company reported a personal data breach under Article 33 of the GDPR. Authorities found that a cyber-attack on the company’s test server allowed an unauthorized third party to access users’ personal data.

The exposed information included email addresses, phone numbers, full names, personal numerical codes, and identity document details. The investigation also found that the company used real personal data instead of fictitious data when testing its MyConnector Platform application.

According to the authority, the incident was the result of a failure to implement appropriate technical and organizational security measures to protect personal data and ensure the confidentiality and integrity of its systems, as required by Article 32 of the GDPR.

In addition to the fine, the authority ordered the company, under Article 58(2)(d) of the GDPR, to use only fictitious data in development and testing environments.

The ICO reprimands Met Police over unlawful sharing of personal data

Jurisdiction

The UK

Infringer Legal Name

MPS

Infringer Domicile

The UK

Alleged Violation

Personal data protection violation

Enforcement Action

Regulatory action — no fine announced

Case Status

An administrative action

The UK’s Information Commissioner’s Office (ICO) has issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after officers and staff shared personal information through an unapproved crime intelligence platform.

The ICO found that the platform was used between March 2023 and September 2024 without proper data protection safeguards or oversight. Around 500 accounts were created, with 375 actively used for policing.

Between January and September 2024, personal information relating to 179 people, including three under the age of 18, was uploaded to help identify suspected shoplifters. The information included names, dates of birth and, in a small number of cases, home addresses.

The investigation found that the force had shared personal data unlawfully, failed to carry out a required data protection assessment and did not have suitable measures in place to control the use of third-party technology.

The MPS suspended the platform in September 2024 and reintroduced it in January 2026 after making changes, including improved oversight, staff training and stronger contractual controls.

However, the ICO said further action was needed to address wider concerns about how the force approves and manages third-party technology.