The Italian data protection authority ('Garante') announced, on 18 February 2020, that it had published, in its monthly newsletter ('the Newsletter'), a decision ('the Decision') fining Sapienza Università di Roma €30,000 for violating Article 32 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In particular, the Decision highlights that Sapienza Università made the i