Data Protection Authority Sanction Against the Bar Association: The Right to Be Forgotten Prevails Over the Register

1. The fact

   As reported by Terzultima Fermata and Diritto e Giustizia, the case concerns a final administrative sanctioning measure issued by the Data Protection Authority against the Bari Bar Council (COA).

   A lawyer filed a complaint claiming that a professional suspension dating back to 2008 was still indexed by search engines and freely accessible on the Bar Association's website in 2023. The COA defended its conduct by arguing that data retention was justified by public interest tasks and professional law, interpreted as a basis for indefinite transparency.

   However, the Authority confirmed the violation, imposing a 10,000 euro fine on the grounds that the legal publicity function had long expired.

2. 

   The rules at play

   The core provisions belong to the General Data Protection Regulation (GDPR). The Regulation establishes the principles of data minimization and storage limitation: data cannot be kept in an identifiable form once the processing purpose has been fulfilled.

   The framework governs the lawfulness of processing, requiring that the public interest be balanced against individual rights. Finally, the provisions establish the right to erasure (right to be forgotten), which obliges the data controller to remove data when they are no longer necessary.

   In the legal context, professional legislation mandates the maintenance of the official register, but the Authority clarified that this obligation does not authorize the perpetual publication of historical disciplinary sanctions.

3. What case law says

   The Supreme Court case law has clarified that the right to be forgotten is a fundamental aspect of the right to privacy, which prevails over the public interest in knowing a past event as time elapses.

   Established case law distinguishes between the dynamic register, which must reflect the professional's current status, and the historical archive, which must not be indiscriminately accessible via search engines.

   European jurisprudence has likewise reiterated that website operators and data controllers must take active steps to ensure that information that is no longer relevant or excessive in light of the passage of time is not directly accessible to third parties.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Professional Boards must implement automated procedures to limit the visibility of disciplinary sanctions once they have been fully served.
   2. It is essential to distinguish between the administrative retention obligation in internal archives (permanent) and the external publicity regime (temporary).
   3. Upon receiving a request from a member, the entity must assess the elapsed time; denying the right to be forgotten without proven current relevance exposes the entity to severe penalties.
   4. It is advisable to use *robots.txt files or specific meta-tags* to prevent search engines from indexing website sections containing historical measures.

References: Regolamento generale sulla protezione dei datiLegge professionale forenseCodice in materia di protezione dei dati personali

Editorial oversight: Avv. Federico Papa·ICAMUpdated 30 July 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction