Garante per la protezione dei dati personali (Italy) - 10037819

Garante per la protezione dei dati personali - 10037819
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 6 GDPR Article 57(1)(f) GDPR Article 58(2)(b) GDPR Article 77 GDPR Article 78 GDPR EDPB Endorsement 1/2018 Regulation no. 1/2019
Type:	Complaint
Outcome:	Other Outcome
Started:
Decided:
Published:	06.06.2024
Fine:	n/a
Parties:	Ministry of Sustainable Infrastructure and Mobility Livorno Police Headquarters
National Case Number/Name:	10037819
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	ligialagev

The DPA issued a reprimand to the Interior Ministry after it unlawfully processed personal data related to the revocation of a gun license

English Summary

Facts

A data subject, an employee from the Ministry of Infrastructure and Transport, submitted a complaint claiming an alleged violation of protection of his personal data by the Ministry of Infrastructure.

As part of the preliminary investigation into the complaint, it emerged that a request made by the then manager of the Ministry with a view to ascertaining if the "the data subject was in possession of a license to carry a pistol or a rifle and, if so, for what use" and whether the data subject "had ever been notified of any administrative measure or warning relating to the aforementioned license",

The Interior Ministry ('Controller') communicated to the Ministry information concerning the data subject's ownership of a firearms license for target shooting and his possession of firearms. The same communication also provided information on the circumstance that the data subject, after having been invited to undergo a medical examination at the local health unit (structure of the Italian National Health Service) in order to ascertain the psychophysical requirements prescribed by a national decree, had sold his weapons to an armoury and returned his firearms licence to the Police Headquarters.

In response to a request for information from the DPA, the Controller first stated that the sharing of information about the data subject was justified to ensure the safety of the data subject himself and other employees, based on elements that supposedly indicate the aggressive behaviour of the data subject.

The Controller also alleged that it was necessary to verify if the data subject still had psychophysical requisites for the maintenance of the license and for the possession of weapons and, consequently, to avert the danger of unconscionable actions by the data subject against himself and others, invited the data subject to undergo a medical examination.

After receiving notice of the need to undergo a medical examination, the data subject chose to return his firearms license and sell the three weapons he owned.

The Controller was invited to produce to the DPA written defence or to ask to be heard by the DPA. Having submitted a statement of defence, it was stated, in particular, that the information concerning the ownership of a firearms licence and the possession of firearms had been made public by the complainant himself, who, on several occasions, had made it known to his work colleagues. It was also alleged that the personal data had been made manifestly public by the data subject and this would appear to be capable of fulfilling the specific condition of lawfulness laid down for "sensitive data" in Article 9(2)(e)GDPR and should be considered as "common data".

The Controller also claimed that the information regarding the invitation to undergo a medical examination, the surrender of a firearms licence and the transfer of firearms were shared in a perspective of due 'cooperation' between public administrations following Article 6(1)(e) GDPR.

Holding

The DPA held the absence of a legal basis and it was considered that there was a violation of Article 5(1)(a)GDPR and Article 6 GDPR as the Controller did not comply with the principle of "lawfulness, fairness and transparency".

The conduct that caused the breach was considered culpable, as the Controller acted without a sufficient legal framework.

Following the guidelines contained in Article 83(2)(c) GDPR, it was assessed that the data subject apparently did not face any specific repercussions as a result of the processing of personal data carried out. Furthermore, it was taken into account that the Controller has cooperated well with the DPA during the investigation and that were not previous relevant violations committed by the administration in a similar context. The infringement was considered a specific internal structure of the Controller and not its overall organisation.

After analysing all these elements, the DPA considered the concrete case as a "minor breach", and that it was sufficient to admonish the Controller for breach of the above provisions, pursuant to Article 58 (2)(b)GDPR

Comment

This decision is linked to another statement from the DPA, which can be checked at the link: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10037849

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members and the councilor. Fabio Mattei, general secretary;

HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data and which repeals Directive 95/46/ EC, “General Data Protection Regulation” (hereinafter, “Regulation”);

HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 containing "Code regarding the protection of personal data, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data, as well as the free circulation of such data and which repeals Directive 95/46/EC (hereinafter the “Code”);

GIVEN Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved with resolution no. 98 of 4 April 2019, published in the Official Gazette. n. 106 of 8 May 2019 and in www.gpdp.it, doc. web no. 9107633 (hereinafter “Guarantor Regulation no. 1/2019”);

Having seen the documentation in the documents;

Having seen the observations made by the general secretary pursuant to art. 15 of the Guarantor Regulation n. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, doc. web no. 1098801;

Speaker Prof. Pasquale Stanzione;

GIVEN

1. Introduction.

With a complaint presented pursuant to art. 77 of the Regulation, Mr. XX, employee of the Ministry of Infrastructure and Transport (hereinafter, the "Ministry"), serving at the Civil Motorization Office (UMC) of Livorno, was complained of an alleged violation of the discipline on the protection of personal data by the Ministry of Sustainable Infrastructure and Mobility.

As part of the investigation relating to the complaint, it emerged that, following a request from the then Manager of UMC 4 of Lucca and the coordinated sections of Pisa, Massa Carrara and Livorno (hereinafter, the "Manager of UMC" ), aimed at finding out "whether or not the complainant was in possession of a firearms license for a pistol or rifle and, if necessary, for what use" and whether the complainant "had ever been notified of any administrative measure or warning relating to the aforementioned license ”, the Livorno Police Headquarters, with note prot. n. XX of the XX, communicated to the UMC and, in copy for information, to the Prefecture of Livorno, information regarding the ownership of the complainant of a license to carry weapons for clay target shooting and the possession of firearms by the same. With the same communication, information was also provided in relation to the circumstance that the complainant, after having been invited to undergo a collegial medical examination at the local USL to ascertain the psychophysical requirements prescribed by the Decree of the Ministry of Health of 28 April 1998, had he sold his weapons to an armory and had returned his weapons license to the Police Headquarters.

2. The preliminary investigation activity.

In response to a request for information from the Authority (see note prot. n.XX of XX), the Livorno Police Headquarters, with note dated XX (prot. n. XX), declared, in particular, that:

“on XX dated […] the note from the Director of the UMC […] was received, with which he was asked to make known whether the [complainant], an employee of the Ministry of Infrastructure and Transport, serving at the headquarters of the Civil Motorization of Livorno, was in possession of a license to carry weapons and if he had ever been notified of an administrative measure or warning in relation to the possession of said licence";

“this request was justified by the fact that the [complainant], who, in several circumstances, had represented to his colleagues that he was in possession of a weapons licence, among the evidence produced in the context of an appeal presented for “mobbing "against the Civil Motorization of Livorno, had presented a series of certificates indicating a psychopathology related to occupational stress, characterized by depressive and anxiety symptoms";

"since from the examination of the Office documents the [complainant] was found to be the holder of weapons and the holder of a license to carry weapons for clay target shooting, in order to verify the continued possession of the psychophysical requirements, indispensable for maintaining the license" of here” and to the possession of weapons and, consequently, to avoid the danger of reckless gestures by the [complainant], towards himself and others, this Office, with note no. XX dated XX, sent for information to the local Prefecture (office responsible for any provision prohibiting possession of weapons), notified to the interested party the following XX, invited to undergo a collegial examination at the Forensic Medicine Office of the local USL ”;

“on date XX this Office, with note XX (and_ not n. XX of the XX), informed the Civil Motorization of Lucca, informing the Prefecture of Livorno for information, of the previous ownership of the license to carry weapons and of the possession of n. 3 firearms by the [complainant] and the fact that following the requested medical-collegiate examination he had returned his police title and surrendered the weapons in his possession";

“on date XX the aforementioned Civil Motorization Office requested to acquire a copy of the health certificate issued to the [complainant], pursuant to the Decree of the Ministry of Health of 28.4.1998, necessary for the issue/renewal of the license to carry weapons, in order to ascertain a discrepancy between the medical certificates being tested in the "mobbing" appeal and the psychophysical suitability certificate obtained by the interested party for the issue of a weapons licence";

"with a further request dated XX the Director of the UMC [...] requested to know further information on the weapons licenses issued over the years to the [complainant], as well as the methods with which the medical certificates referred to in the Decree of the Ministry of Health of 28.4.1998";

“on date XX this Office, with note no. XX, in simultaneously processing the requests of the XX and XX, provided the requested clarifications to the Lucca Motorisation, specifying that it would not have been able to transmit the certification relating to the medical suitability obtained by the [complainant] for the issue of the firearms licence. , as it is considered “sensitive data”;

"the circumstance of the possession of a license to carry weapons had been made known by the [complainant] himself to his "work colleagues, and not only", as specified by the Director of the Civil Motorization of Lucca and it is entirely clear that the [UMC Manager], in his capacity as Employer, had the power-duty to verify the aforementioned condition, in order to protect as a priority the employee himself and consequently all the staff of the work structure as well as the users of that office”;

“furthermore, pursuant to art. 13, paragraph 3, of the Presidential Decree. 15/2018 "the communication of personal data to public administrations or public bodies and to private individuals is also permitted when it responds to the interest of the person to whom the data refers and, in any case, in individual cases in which it is necessary to avoid a serious danger and imminent to public safety, or to the protection of the life and physical integrity of a third party”;

"in the first response provided to the Civil Motorization Office, this Office limited itself to providing information regarding the ownership of the license by the [complainant], assessing, in balancing the opposing interests, the pre-eminence of the safeguarding of public safety also in consideration of the ongoing dispute, while, in response to a subsequent specific request for access to documents by the same body relating to health data, the sensitive nature of the documentation requested to guarantee the interested party's right to confidentiality was raised".

With note dated XX (protocol no. XX), the Office, on the basis of the elements acquired, the checks carried out and the facts that emerged following the preliminary investigation, notified the Ministry of the Interior (Livorno Police Headquarters), the pursuant to the art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in the art. 58, par. 2, of the Regulation, for having communicated the personal data of the complainant to the Ministry of Infrastructure and Transport (UMC) in the absence of a legal basis, in violation of the articles. 5, par. 1, letter. a), and 6 of the Regulation, as well as 2-ter of the Code (in the text prior to the amendments made by Legislative Decree 8 October 2021, no. 139).

With the same note, the aforementioned Ministry was invited to produce defensive writings or documents to the Guarantor or to request to be heard by the Authority (art. 166, paragraphs 6 and 7, of the Code, as well as art. 18, paragraph 1, of the l. 24 November 1981, n. 689).

Having presented a defense brief, the Ministry of the Interior - which did not request to be pursuant to art. 166, paragraph 6, of the Code - declared, in particular, that:

“the information concerning the ownership of the firearms license and the possession of firearms […] had been made public by the complainant himself, who, in various circumstances, had made it known to his work colleagues”;

"precisely the fact that this circumstance was now known in the workplace had led the manager of the Pisa Motorization Office (for the purposes of "protecting not only the employee ... but of all the staff of the Livorno Civil Motorization as well as the users) to inform the Livorno Police Headquarters of the existence of medical certificates produced in the context of an appeal for mobbing against the local Motorization, concerning the psychopathological condition of the complainant";

"the response addressed to the Motorization Office [...] - limited to the ownership of the license and the possession of weapons - therefore does not appear to have given rise to a "communication between holders" (pursuant to art. 2-ter, paragraph 4, of Code), referring to information received from that Office and therefore devoid of the necessary cognitive content regarding it";

“in addition to this, the circumstance that the aforementioned personal data had previously been “manifestly made public by the interested party” seems to be able to materialize the specific condition of lawfulness contemplated for “sensitive data” by the art. 9, par. 2, letter. e), of the GDPR, which a fortiori must be considered applicable to the processing of "common data" (as in the present case)";

"as regards, then, the other information - concerning the invitation to undergo a medical examination, the return of the firearms license and the transfer of firearms [...] - the purpose of the "communication" seems to be identifiable in the need to warn the manager of the Motorization Office - with a view to dutiful "collaboration" between public administrations - that the "safety" of the work environment, previously threatened, had been restored, the conditions of potential danger to the life and individual safety of employees and office users, as well as the complainant himself. Collaborative intent which seems to be part of the need to comply with the institutional tasks of the State Police (ex art. 6, par. 1, letter e), of the RGPD)”;

"the communication of the information in question was addressed solely to the Civil Motorization Office of Lucca and, for information, to the Prefecture of Livorno (legislatively competent in matters of weapons), and consequently the knowledge of the personal data was limited to the Manager of said Motorization and, naturally, to the personnel employed by the organizational units of these peripheral units, duly "authorized" to carry out the processing of personal information and subject to the obligation of secrecy contemplated by the art. 15 of the Presidential Decree 10 January 1957, n. 3”;

"the only interested party in the processing [...] is the complainant and the personal data being communicated are attributable to the category of "common data"".

3. Outcome of the preliminary investigation.

Public entities may, as a rule, process personal data if the processing is necessary for compliance with a legal obligation to which the data controller is subject or for the execution of a task of public interest or connected to the exercise of public powers referred to. the data controller is vested (see art. 6, par. 1, letters c) and e), 2 and 3, of the Regulation, as well as art. 2-ter of the Code).

As regards the operation of "communication" of personal data (art. 2-ter, paragraph 4, letter a), of the Code), it must be highlighted that European legislation provides that "member States may maintain or introduce more specific to adapt the application of the rules of this Regulation with regard to processing, in accordance with paragraph 1, points (c) and (e), by determining more precisely specific requirements for processing and other measures to ensure lawful and correct processing [ …]” (art. 6, par. 2, of the Regulation). In this framework, the communication of personal data by public entities is permitted only when provided for by a law or, in the cases provided for by law, by regulation (art. 2-ter, paragraphs 1 and 3, of the Code, in text prior to the amendments made by Legislative Decree 8 October 2021, n.

The data controller is then, in any case, required to respect the principles of data protection (art. 5 of the Regulation) and must be able to demonstrate that the processing is carried out in compliance with the Regulation (art. 5, par. 2, and 24 of the Regulation).

In the present case, following the outcome of the investigation relating to the complaint, it was ascertained that, following a request from the Director of the UMC, the Livorno Police Headquarters, with note prot. n. XX of the XX, communicated to the UMC numerous personal data relating to the complainant, and, in particular: that the complainant was the holder of a license to carry weapons for clay target use, issued by the same Office on 4 September 2019; that he was the owner of three duly reported firearms; that on XX the same Police Headquarters had sent the complainant to go for a collegial medical examination at the local USL in order to ascertain that he possessed the psychophysical requirements prescribed by the Decree of the Ministry of Health of 28 April 1998; that the complainant had preferred, rather than undergo such an examination, to definitively sell the aforementioned weapons to an armory and return the license to carry weapons to the Police Headquarters.

In this regard, noting that the Ministry of the Interior did not indicate during the investigation provisions of the law which could, within the framework of the legal bases of the Regulation and the Code, legitimize the communication of the complainant's personal data to the employer of the same.

On the other hand, said communication of personal data could not be considered necessary for the purposes of the general protection of public safety, a purpose attributable to the institutional activities of the authorities specifically responsible for this, and not to the tasks and powers of the employer. In this case, in fact, the Livorno Police Headquarters, on the basis of the report received, had promptly activated its powers to ascertain and revise the prerequisites for the issue of licenses to carry weapons, initiating specific proceedings against the complainant. There was, therefore, no need for the Ministry of Infrastructure and Transport (UMC), the complainant's employer, to be informed both of the fact that the complainant held a gun license and possessed weapons and of the outcome of the proceedings initiated by the Police Headquarters against him.

Furthermore, given that, as emerges from the note sent to the UMC, the complainant had already "permanently sold the aforementioned weapons to [an] armory [...], while the license to carry weapons [had] been returned [ to the Police Headquarters]", the possible reasons for potential danger to the safety of the complainant's colleagues and the community in general, invoked by the UMC during the investigation, had in fact no longer existed.

Coming to the defenses put forward by the Ministry of the Interior, it must be noted that, contrary to what was claimed, the personal data subject to communication (with particular regard to the ownership of the license to carry weapons and the possession of firearms) were not already known by the Ministry of Infrastructure and Transport (UMC), in its capacity as employer. In fact, from the documentation in the documents it emerges that the Director of the UMC, with note prot. n. XX of the XX, sent to the Prefecture of Livorno and the Police Headquarters of Livorno, concerning "request for information on the license to carry weapons", had asked to know "whether or not the [complainant] [...] is in possession of a license to carry weapons of weapons for pistol or rifle and possibly for what use", as well as whether "the [complainant] has ever been notified, in this case, of any administrative measure or warning relating to the aforementioned license(s [...]", a circumstance from which it can be deduced that he did not formally hold such information.

Nor does it note that, as claimed by the Ministry, the information in question had been shared by the complainant with some colleagues at the workplace. In fact, in any case, such information would not have been disseminated - that is to say brought to the attention of "[...] indeterminate subjects [...]" (see the definition of "dissemination" in art. 2- ter, paragraph 4, letter) of the Code) - but only communicated to third parties, as it is not, therefore, data made manifestly public by the interested party (see, although with regard to particular categories of data, art. 9, par. 2, letter e), of the Regulation). In any case, even if the worker spontaneously shares personal information concerning him with acquaintances or colleagues, this cannot in itself legitimize - in the absence of an appropriate legal basis - the communication of such information by third parties to the employer, expected that the latter can acquire and process workers' personal data within the limits and when the conditions established by the laws applicable to the employment relationship are met and, therefore, also in compliance with the more specific and greater protection provisions without prejudice to the art. 88 of the Regulation (see art. 113 of the Code).

In light of the foregoing considerations, it must therefore be concluded that the communication of the complainant's personal data by the Ministry of the Interior (Livorno Police Headquarters) to the Ministry of Infrastructure and Transport (UMC), the complainant's employer, is occurred in a manner that does not comply with the principle of "lawfulness, correctness and transparency" and in the absence of a legal basis, in violation of articles. 5, par. 1, letter. a), and 6 of the Regulation, as well as 2-ter of the Code (in the text prior to the amendments made by Legislative Decree 8 October 2021, no. 139).

4. Conclusions.

In light of the assessments mentioned above, it is noted that the declarations made by the data controller during the investigation are the truthfulness of which one may be called upon to respond to pursuant to art. 168 of the Code ˗, although worthy of consideration, do not allow us to overcome the findings notified by the Office with the act of initiating the proceeding and are insufficient to allow the dismissal of this proceeding, as, moreover, none of the cases provided for by the 'art. 11 of the Guarantor Regulation n. 1/2019.

Therefore, the preliminary assessments of the Office are confirmed and the failure to comply with the legislation on data protection is noted, due to the fact that the Ministry of the Interior (Livorno Police Headquarters) communicated the data to the Ministry of Infrastructure and Transport (UMC). personal data relating to the complainant in a manner that does not comply with the principle of "lawfulness, correctness and transparency" and in the absence of a legal basis, in violation of articles. 5, par. 1, letter. a), and 6 of the Regulation, as well as 2-ter of the Code (in the text prior to the amendments made by Legislative Decree 8 October 2021, no. 139).

Having said this, taking into account that:

the violation, in this case, concerned the personal data relating to a single interested party and the communication of the personal data in question was limited to the sole Manager of the UMC, who had addressed a specific request to the Police Headquarters (see art. 83, par. 2, letter a), of the Regulation);

the conduct is negligent in nature, as the Livorno Police Headquarters acted, even in the absence of a sufficient legal framework, in the erroneous belief, fueled by the specific request of the employer, that the communication of the complainant's personal data to the Ministry of Infrastructure and Transport transport (UMC), as an employer, was necessary in order to warn the same of the cessation of potential damage to safety at work (see art. 83, par. 2, letter b), of the Regulation);

it does not appear that the interested party has suffered specific repercussions following the processing of personal data carried out (see art. 83, par. 2, letter c), of the Regulation);

the Ministry offered good cooperation with the Authority during the investigation (see art. 83, par. 2, letter f), of the Regulation);

there are no previous relevant violations committed by the Ministry in a similar context (see art. 83, par. 2, letter e), of the Regulation);

the violation concerned a specific internal structure of the data controller and not the overall organization of the same (art. 83, par. 2, letter k) of the Regulation);

the circumstances of the specific case lead to classify it as a "minor violation", pursuant to art. 83, par. 2, and of the council. 148 of the Regulation, as well as the "Guidelines regarding the application and provision of administrative pecuniary sanctions for the purposes of Regulation (EU) no. 2016/679”, adopted by the Art. 29 Working Group on 3 October 2017, WP 253, and endorsed by the European Data Protection Committee with the “Endorsement 1/2018” of 25 May 2018.

In light of all of the above, and the overall terms of the matter in question, it is therefore considered sufficient to warn the Ministry of the Interior (Livorno Police Headquarters) for the violation of the aforementioned provisions, pursuant to art. 58, par. 2, letter. b), of the Regulation.

In this context, considering, in any case, that the conduct has exhausted its effects, given that the video devices in question have been uninstalled, the conditions for the adoption of further corrective measures pursuant to art. 58, par. 2, of the Regulation.

Finally, it is noted that the conditions set out in art. 17 of regulation no. 1/2019.

ALL THIS CONSIDERING THE GUARANTOR

a) declares, pursuant to art. 57, par. 1, letter. f), of the Regulation, the unlawfulness of the processing of personal data carried out by the Ministry of the Interior (Livorno Police Headquarters), in the person of the legal representative pro tempore, with registered office at Palazzo Viminale - 00184 Rome (RM), C.F. 97149560589, for violation of articles. 5, par. 1, letter. a), and 6 of the Regulation, as well as 2-ter of the Code (in the text prior to the amendments made by Legislative Decree 8 October 2021, no. 139), within the terms set out in the justification;

b) pursuant to art. 58, par. 2, letter. b) of the Regulation, warns the Ministry of the Interior (Livorno Police Headquarters) for violating the articles. 5, par. 1, letter. a), and 6 of the Regulation, as well as 2-ter of the Code (in the text prior to the amendments made by Legislative Decree 8 October 2021, n. 139), as described above;

c) believes that the conditions set out in the art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

Pursuant to the articles. 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, it is possible to appeal against this provision before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 6 June 2024

PRESIDENT
Stanzione

THE SPEAKER
Stantion

THE GENERAL SECRETARY
Mattei