1. [News](/news) 2. Università eCampus suffers GDPR violation reported over facial recognition # Università eCampus suffers GDPR violation reported over facial recognition Università eCampus has violated GDPR policies by collecting student biometric data. See incident details, impact on customers, and recommended security measures. UpGuard Team April 13, 2026 Table of Contents * [What happened in the Università eCampus data breach?](#what-happened-in-the-università-ecampus-data-breach) * [Who is behind the incident?](#who-is-behind-the-incident) * [Impact and risks for Università eCampus customers](#impact-and-risks-for-università-ecampus-customers) * [How to protect against similar security incidents](#how-to-protect-against-similar-security-incidents) ## Key facts: Università eCampus data breach * Date occurred January 29, 2026 * Date reported April 13, 2026 * Target entity Università eCampus * Source of breach GDPR violation (Facial recognition technology) * Data types Biometric personal data * Status Confirmed; reported on April 13, 2026. * Severity Low; regulatory violation involving unauthorized biometric data processing without a valid legal basis. ## What happened in the Università eCampus data breach? Università eCampus (uniecampus.it) was involved in a security incident regarding a GDPR violation, publicly reported on April 13, 2026. This incident was not caused by an external threat actor but was instead identified by the Italian Data Protection Authority. The regulatory body found that the institution had failed to comply with privacy standards during its academic operations. On January 29, 2026, the regulator reported that the university used facial recognition technology to monitor attendance in a teaching qualification course. The university required participants to consent to the processing of biometric personal data, which was deemed illegal under several articles of the GDPR. As a result, the university was fined €50,000. The low severity rating reflects that this was a regulatory non-compliance issue rather than a malicious data theft. Typical risks in such scenarios involve the over-collection of sensitive biometric data and potential privacy infringements. ## Who is behind the incident? The attacker or cause of the incident has not been identified. ## Impact and risks for Università eCampus customers For students and course participants, the primary risk involves the unauthorized collection and processing of biometric data. While there is no evidence of a malicious leak or third-party access, the processing of facial recognition data without a valid legal basis raises concerns about privacy and long-term data retention. Individuals may feel their personal privacy has been compromised by intrusive monitoring practices. Such incidents often lead to increased regulatory scrutiny and a potential loss of trust in institutional data handling. Affected individuals should review the university’s privacy policy and inquire about the deletion of their biometric records. Transparency in how data is collected and used is essential for maintaining institutional security and student trust. ## How to protect against similar security incidents Following the GDPR violation at Università eCampus involving biometric data, it is crucial for users and organizations to prioritize privacy rights and data minimization. * **Review privacy consent forms.** Carefully read any consent forms related to biometric data collection. Ensure you understand the legal basis for processing sensitive information before providing consent. * **Monitor for policy updates.** Stay informed about any changes to your university’s data processing agreements and privacy policies. * **Implement continuous privacy monitoring.** Use privacy management tools to track how personal data is utilized across digital services. Organizations should deploy attack surface management to ensure compliance with global data regulations and prevent unauthorized data use. *Proactive engagement with privacy rights and regulatory updates helps mitigate the risks associated with unauthorized data processing.* ## Is your organization exposed to a similar risk? UpGuard continuously monitors vendors for exposed credentials and infrastructure risk, so you can catch the next breach before it becomes a headline. [Start your free trial](https://cyber-risk.upguard.com/register/trial) Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](https://www.upguard.com/instant-security-score?) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.