The case, explained
Data Protection Authority Sanction Against the Bar Association: The Right to Be Forgotten Prevails Over the Register
6 min read · Updated July 2026 · Editorial oversight: Avv. Federico Papa
The latest developments in this case draw attention back to the management of personal data by public bodies and professional associations. According to press reports (notably Terzultima Fermata and Diritto e Giustizia), the matter originates from a sanctioning measure issued by the Data Protection Authority, which fined a Bar Council for keeping online data regarding disciplinary sanctions that occurred long ago. The contested facts concern the continued visibility on the institutional website of information regarding a professional suspension executed more than a decade before the dispute. This article reconstructs the legal and jurisprudential framework that led to this decision, highlighting how administrative transparency cannot turn into a perpetual pillory for the registered member. By presenting a didactic "twin case", we analyze the operational consequences for professionals tasked with managing digital archives and online registers, providing clear guidance on managing the right to erasure and the de-indexing of content from search engines.
In brief
The analysis examines the 10,000 euro fine imposed by the Data Protection Authority on the Bari Bar Council for violating the right to be forgotten. The ruling clarifies that legal publicity for disciplinary sanctions must be limited to the time necessary for their execution. Once the sanction has been served, the data must no longer be accessible via search engines or public online registers, while remaining in the entity's internal archives for administrative purposes.
The fact
As reported by Terzultima Fermata and Diritto e Giustizia, the case concerns a final administrative sanctioning measure issued by the Data Protection Authority against the Bari Bar Council (COA).
A lawyer filed a complaint claiming that a professional suspension dating back to 2008 was still indexed by search engines and freely accessible on the Bar Association's website in 2023. The COA defended its conduct, arguing that retaining the data was justified by public interest duties and professional law, interpreted as a legal basis for indefinite transparency.
However, the Authority confirmed the violation, imposing a fine of 10,000 euros on the grounds that the legal publicity function had long expired.
The rules at play
The core provisions are set out in the General Data Protection Regulation (GDPR). The Regulation establishes the principles of data minimization and storage limitation: personal data cannot be retained in an identifiable form once the underlying purpose has been fulfilled.
The rules governing the lawfulness of processing require public interest considerations to be balanced against individual rights. Within this framework, the right to erasure (right to be forgotten) obliges the data controller to delete data when they are no longer necessary.
In the legal sector, professional law mandates the maintenance of the official register, but the Data Protection Authority clarified that this duty does not justify the perpetual publication of historical disciplinary sanctions.
What case law says
The Supreme Court case law has clarified that the right to be forgotten is an essential dimension of the right to privacy, which prevails over the public interest in accessing historical facts as time passes.
Established jurisprudence distinguishes between the dynamic register, which must reflect the professional's current standing, and the historical archive, which must not be indiscriminately accessible via search engines.
European jurisprudence has likewise reiterated that website operators and data controllers must actively ensure that information that is no longer relevant or is excessive relative to the elapsed time is not readily accessible to third parties.
- Try edit.legal AI
Analysis drafted and verified with edit.legal
To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.
What it teaches professionals
- Professional bodies must implement automated procedures to terminate the external visibility of disciplinary sanctions once served.
- A strict distinction must be drawn between administrative record retention duties (permanent) and external legal publicity duties (temporary).
- Upon receiving an application from a registered member, the authority must evaluate the time elapsed; denying the right to be forgotten without current public interest grounds exposes the body to severe fines.
- Technical measures, such as *robots.txt files or meta tags*, should be deployed to prevent search engines from indexing pages containing historical measures.
References: Regolamento generale sulla protezione dei datiLegge professionale forenseCodice in materia di protezione dei dati personali
Related cases
Frequently asked questions
What are the penalties for GDPR violations by a public entity?
Under the General Data Protection Regulation, administrative fines can reach up to 20 million euros or, for undertakings, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. For Italian public bodies, the fine is calculated by the Data Protection Authority on a case-by-case basis based on principles of proportionality, effectiveness, and deterrence.
How much time must pass to invoke the right to be forgotten regarding a professional sanction?
There is no statutory fixed time limit set by law. However, settled jurisprudence and Authority guidance indicate that once the sanction has been served and a reasonable period has elapsed relative to the offense's severity without further infractions, the individual's right to privacy outweighs the public interest in accessing the data.
What can a professional do if an old sanction still appears on Google?
The professional may submit a formal request for erasure or de-indexing to the data controller (e.g., the relevant Bar Association or professional Board) and, where appropriate, to search engine operators. In the event of an unsatisfactory response or failure to reply within the statutory timeframe, the individual may lodge a complaint with the Data Protection Authority or initiate court proceedings.
Verified legal research and drafting with edit.legal
Legal research and drafting with citations checked against official databases. edit.legal is free to try, no credit card.
Try edit.legal for free