Garante per la protezione dei dati personali (Italy) - 10037849

Garante per la protezione dei dati personali - 10037849

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 6 GDPR Article 9 GDPR Article 57(1)(f) GDPR Article 58(2)(b) GDPR Article 83(2) GDPR Article 88(2) GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:
Decided:	06.06.2024
Published:
Fine:	n/a
Parties:	Ministero delle Infrastrutture e dei Trasporti
National Case Number/Name:	10037849
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	ligialagev

The DPA issued a reprimand to the Ministry of Infrastructure and Transport after it unlawfully transferred data about an alleged mental illness of an employee to another Ministry in order to inquire if he had a gun licence.

English Summary

Facts

The data subject initiated legal proceeding against his employer (the controller in the case at hand), the Ministry of Infrastructure and Transport (Ministero delle Infrastrutture e dei Trasporti - MIT), complaining that he was experiencing mobbing at his workplace. During the case, he filed a medical report containing information about his mental health issues.

Subsequently, the data subject received a note from the Interior Ministry, informing him about the need to undergo a medical examination in order to ascertain if he still possessed the requirements to keep his firearms licence he previously received for sporting purposes.

After submitting an access request to the controller, the data subject learned that the head of the unit in which he was working contacted the Interior Ministry to know if the data subject actually had a gun licence. In this note, the controller expressly referred to the dispute existing with the data subject, as well as to the medical certificates filed by the latter.

The controller stated that the data subject allegedly suffered from mental health issues. The controller also disclosed certificates and medical reports attesting the presence of psychological disorders in the data subject.

Moreover, the controller argued that it was concerned about the mental health status of the data subject and the danger that he could use his gun to shoot someone in the workplace or at home.

Finally, the controller argued that, since this information concerning the data subject's health was examined during the trial, Article 9(2)(e) GDPR applies.

Holding

First, the DPA noted that a public institution may process workers' personal data, including those falling under Article 9 GDPR, only if the processing is necessary to comply with a legal obligation to which the controller is subject under Article 6(1)(c) GDPR and Article 9(2)(b) GDPR or under Article 6(1)(e) GDPR “for the performance of a task carried out in the public interest or in the exercise of official authority” or "official authority vested in the controller".

Moreover, according to the DPA, the processing of data belonging to special categories in the employment context may legitimately be carried out only when it meets the requirements set by Article 9(2)(b) and 88 GDPR.

However, the DPA noted that the controller did not refer to any specific provision obliging or allowing it to share this data with the Interior Ministry. Therefore, the DPA found the controller processed personal data without the proper legal basis and considered that there was a violation of Article 5(1)(a) and 6 GDPR as the controller did not comply with the principle of lawfulness.

As for the controller's argument referred to Article 9(2)(e) GDPR, the DPA rejected it. The DPA recalled that the fact that around 40 people among lawyers and judges were present during the hearing cannot be regarded as a case where personal data are manifestly made public by the data subject.

As a side note, the DPA further pointed out that, under national law, the controller does not have any role in ensuring that only mentally-fit people can hold a gun licence. On the contrary, the obligation to report to the Interior Ministry that a person is undergoing mental health issues lies with the health professional that is taking care of the person.

Finally, the DPA noted that the controller later received some further personal data about the data subject by the Interior Ministry, i.e. the fact that the data subject possessed 3 guns. On this point, the DPA found that the controller had no legal basis to process this data, since the data subject's job does not involve using firearms.

On these grounds, the DPA issued a reprimand to the controller.

Comment

The DPA, in a separate decision, issued a reprimand to the Interior Ministry as well. See: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10037819

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10037849]

Provision of 6 June 2024

Register of provisions
no. 336 of 6 June 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”);

HAVING SEEN Legislative Decree no. 196 of 30 June 2003, containing the “Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and which repeals Directive 95/46/EC (hereinafter “Code”);

HAVING SEEN Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor for the protection of personal data, approved with resolution no. 98 of 4 April 2019, published in the Official Journal no. 106 of 8 May 2019 and in www.gpdp.it, web doc. no. 9107633 (hereinafter “Regulation of the Guarantor no. 1/2019”);

Having seen the documentation in the files;

Having seen the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, web doc. no. 1098801;

Rapporteur Prof. Ginevra Cerrina Feroni;

WHEREAS

1. Introduction.

With a complaint submitted pursuant to art. 77 of the Regulation, Mr. XX, an employee of the Ministry of Infrastructure and Transport (hereinafter, the “Ministry”), working at the Civil Motorization Office (UMC) of Livorno, represented that, in the context of a legal dispute with the Ministry, he had filed a medical report containing data relating to his health.

Subsequently, the complainant received a note from the Livorno Police Headquarters, in which the latter communicated that it had learned that the complainant "during some hearings held at the local Civil Court, presented among the evidence of his appeal for "mobbing" against the Ministry of Infrastructure and Transport - Civil Motorization Office of Lucca, a series of medical certificates from which a disorder emerges [...]", which is why the complainant was sent to contact the Office of Legal Medicine of the local USL to undergo a collegial medical examination, in order to ascertain the continued possession of the psychophysical requirements prescribed by law for the maintenance of the license to carry weapons already in his possession for sporting purposes (skeet shooting).

Having submitted a request for access to the documents to the Livorno Police Headquarters, the complainant subsequently learned that the then Director of UMC 4 of Lucca and of the coordinated sections of Pisa, Massa Carrara and Livorno (hereinafter, the “Director of UMC”), where he worked, had sent a specific written request to the Prefecture of Livorno and the Livorno Police Headquarters to find out “whether or not the complainant was in possession of a gun license for a pistol or rifle and, if so, for what use”, as well as whether the complainant “had ever been notified of any administrative measure or formal notice relating to the aforementioned license”. With the note in question, the Ministry made express reference to the ongoing dispute with the complainant, as well as to the medical certificates filed by the latter (with an indication of the diagnosis). The UMC's request to the Police Headquarters was motivated by the argument that the applicant, "also in his capacity as employer, [would have] the primary task of obtaining the [...] information [in question] to protect not only the employee [...] but all the personnel of the Livorno Civil Motorization Office". The note in question also mentioned that "subsequently [it would] [proceed] to request the Medical Verification Commission of Florence to carry out the appropriate checks relating to the employee's pathology in question [...] in order to understand his actual suitability for work".

Moreover, as stated in the complaint, "the request of the [UMC Manager] [...] [would] have occurred a full two years after the filing of the appeal, a time frame that could not be justified if there had been a real need to protect the workers and users of the Livorno Civil Motorization Office - and, consequently, a real need to obtain such information from the competent administrations".

2. The investigative activity.

In response to a request for information from this Authority (see note prot. no. XX of XX), the Ministry of Infrastructure and Transport (with note from the Director of the UMC of XX), stated, in particular, that:

“the [complainant] is an employee of the Ministry of Infrastructure and Sustainable Mobility”;

“the [complainant] filed an appeal, pursuant to art. 414 of the Italian Code of Civil Procedure […] before the Labour Court of Livorno […] for alleged mobbing […]”, which would have resulted in pathologies affecting the same;

in the context of this trial, the complainant “spontaneously produced, as attachments to the appeal, in support of his arguments, medical certificates and reports […] [, certifying] the presence of psychological disorders”;

“[…] the [UMC Manager] had been informed, via a confidential email [from] the Civil Motorization Office of Livorno, […] that the [complainant] had been seen, for several days, sitting in front of the desk leafing through a magazine in which only weapons were depicted. Subsequently […] it was reported [to the UMC Manager] by several individuals that the [complainant], on several occasions, had represented, sometimes even boasting, of possessing a gun license”;

“in light of the aforementioned statements and the simultaneous knowledge of the medical certificates, the […] UMC Manager [, also in her capacity] as Employer could not refrain from asking both the Livorno Police Headquarters and the Livorno Prefecture whether the appellant was actually in possession of any gun license or not and, if so, for what use. This occurred with note prot. no. XX […]: the note was addressed to both the Prefecture and the Police Headquarters because both Administrations are competent to issue the aforementioned licenses depending on the type of weapon one intends to request and who is the person requesting them”;

“with note prot. no. XX of XX the Livorno Police Headquarters - P.A.S./ARMI Office […] communicated that the appellant was the holder of a gun license for clay pigeon shooting, issued […] on […] and the holder of no. 3 regularly registered firearms. On XX the same Police Headquarters invited the appellant to go for a joint medical examination at the local USL in order to ascertain that he possesses the psychophysical requirements prescribed by the Decree of the Ministry of Health of 04.28.1998 […]. The appellant, instead of going to a collegial visit, preferred to permanently hand over the aforementioned weapons to [an] armory […] while the gun license was returned to the Livorno Police Headquarters”;

“subsequently, the [UMC Manager] asked the Livorno Police Headquarters - P.A.S./Weapons office, with note prot. no. XX of XX, […] the methods with which the health certificates are normally issued, pursuant to the Decree of the Ministry of Health of 28.4.1998, preliminary and necessary for the gun license and with subsequent note prot. no. XX of XX […] always asked the Livorno Police Headquarters - P.A.S./WEAPONS Office to be able to obtain a copy of the health certificate issued pursuant to the Decree of the Ministry of Health of 28.4.1998. All the above requests were motivated to understand the discrepancy between the medical certificates that were the subject of evidence in the “mobbing” complaint and the medical-health certification issued when obtaining the gun license for the purposes of determining whether there were any false declarations with criminal relevance”;

“with note prot. no. XX of XX, the Livorno Police Headquarters - P.A.S./ARMI Office” clarified the legal framework of reference and “then added [that] the Livorno Police Headquarters […], with respect to the release of the preliminary health documentation for the release of the gun license, could not adhere [to the request] in accordance with Legislative Decree no. 196/2003 and that the medical certification of suitability obtained by the [complainant] can be viewed exclusively upon the instructions of the AG or the Privacy Guarantor, as it is sensitive data and therefore exempt from the right of access”;

it was intended to “preserve and protect […] public safety since the maintenance of the gun license and the simultaneous possession of firearms could have generated the incorrect use of the latter with serious consequences for the person of the [complainant], his family, his work colleagues, the users of the Livorno Civil Motorization and the community in general: tragedies that unfortunately we witness frequently in Italy […]”;

it was intended to “then provide useful information to the Livorno Police Headquarters for a possible verification of the evident contradiction between the medical-health certification issued on the occasion of obtaining the gun license and the declarations of the [complainant] made to the doctors and attached to the appeal and therefore verify the possible presence of false acts or declarations of criminal relevance”.

With note of XX (ref. no. XX of XX), the Office, on the basis of the elements acquired, the checks carried out and the facts that emerged following the investigation, notified the Ministry of Infrastructure and Transport, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the provisions referred to in art. 58, paragraph 2, of the Regulation, for having:

communicated to the Prefecture of Livorno and the Police Headquarters of Livorno the complainant's personal data (i.e. the circumstance that the complainant had represented that he was in possession of a gun license, as well as the existence of a civil dispute between this Ministry and the complainant for alleged mobbing, mentioning in full the diagnosis reported in medical certificates produced by the complainant in the context of the aforementioned dispute), in a manner not compliant with the principle of "lawfulness, correctness and transparency" and in the absence of a legal basis, in violation of art. 5, par. 1, letter a), 6 and 9 of the Regulation, as well as 2-ter and 2-sexies of the Code (in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021);

acquired from the Livorno Police Headquarters - P.A.S./ARMI Office personal data relating to the complainant (i.e. the information that the complainant was the holder of a license to carry weapons for clay pigeon shooting and the owner of 3 regularly registered firearms, as well as information on the initiatives taken by the Police Headquarters following the report made by the UMC Manager) and processed such data in a manner that did not comply with the principle of "lawfulness, correctness and transparency" and in the absence of a legal basis, in violation of articles 5, par. 1, letter a), 6 and 88, par. 2, of the Regulation, as well as 2-ter and 113 of the Code (in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021).

With the same note, the aforementioned Ministry was invited to produce defensive writings or documents to the Guarantor or to request to be heard by the Authority (art. 166, paragraphs 6 and 7, of the Code, as well as art. 18, paragraph 1, by Law no. 689 of 24 November 1981).

With note of XX (prot. no. XX), the Ministry filed a note from the UMC Manager, who stated, in particular, that:

“the existence of the pathology of the [complainant] […] [within the] civil process of “Mobbing” discussed in civil proceedings before the Court of Livorno – Labour Judge has absolutely not been ascertained. In fact, the appeal presented by the [complainant] was essentially based on the existence or otherwise of the pathology”;

“it was necessary to intervene immediately due to the evident and widespread fear among employees and users of the Livorno Civil Motorization Office of violent actions by the [complainant] since the latter boasted of having a license to carry weapons and walked around the Motorization Office with weapons magazines. Unfortunately, tragedies are not lacking and are often repeated in Italy too”;

“there was an evident crime […] of forgery with the need to communicate it to the Livorno Police Headquarters - the judicial body - which had issued the license to carry weapons. The aforementioned license had also been issued on the basis of a preliminary medical certificate that necessarily could not diagnose pathologies and therefore in total contrast with what the [complainant] declared in the civil case in question and in the various hearings”; “the data were widely disseminated at the public hearing […] in the presence of over 40 people (including lawyers, witnesses, appellants and respondents from other hearings on the same day)”.

During the hearing, requested pursuant to art. 166, paragraph 6, of the Code and held on XX (see minutes prot. no. XX of XX), the aforementioned Ministry declared, in particular, that:

“the interested party attached his own medical documentation in the context of a civil dispute for mobbing, which he had brought against the Ministry, certifying some pathologies of a psychiatric nature”;

“between October and November 2019, the interested party had declared to several people inside the offices of the Motorization that he was in possession of a gun license, a circumstance that was clearly incompatible with the pathologies from which he had declared to suffer in the context of the aforementioned dispute”;

“based on the general conduct of the interested party in the workplace, as reported on several occasions to the UMC Manager by his colleagues, and the aforementioned statements, as well as taking into account that he was seen consulting weapons magazines, there was a high level of alarm among his colleagues regarding the possible actions he could have taken in the workplace”;

“during a hearing of the aforementioned judicial proceeding, approximately forty people became aware of the fact that the interested party complained of suffering from pathologies clearly incompatible with carrying weapons”;

“there are rulings of the Court of Cassation, in particular that of 22 September 2021, no. 25597 (which takes up rulings 12863/2004, 14066/2019 and 30679/2019), which have clarified that the employer must adopt all necessary measures to guarantee the psycho-physical integrity of employees”;

“also in consideration of the numerous news stories relating to the improper use of firearms in the workplace, the then Director of the UMC […] had the duty to inform the competent authorities of the possible risk to the safety of workers and public safety”;

“the communication to the Prefecture and the Police Headquarters was made in any case with a confidential protocol, to protect the interested party. To confirm that the same was due, it is highlighted that the competent authorities immediately took action to verify the conditions provided by law for the purposes of holding a gun license”.

3. Outcome of the investigation.

3.1 The legislation on the protection of personal data.

Within the framework of the Regulation and the Code, the employer may process the personal data of workers (see art. 4, no. 1, of the Regulation), including those relating to “special categories”, if the processing is necessary “for compliance with a legal obligation to which the data controller is subject” (art. 6, par. 1, letter c), and 2 and 3, and art. 9, par. 2, letter b) and 4; 88 of the Regulation) or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller” (art. 6, par. 1, letter e), 2 and 3, and art. 9, par. 2, letter g), of the Regulation; art. 2-ter and 2-sexies of the Code).

The processing of data belonging to special categories, in the workplace, may be legitimately carried out only when it is “necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, insofar as it is authorised by Union or Member State law or by a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject” (Article 9, paragraph 2, letter b), of the Regulation; see also Article 88, and recitals 51-53 of the Regulation; see, “Provision containing the requirements relating to the processing of special categories of data, pursuant to Article 21, paragraph 1, of Legislative Decree 10 August 2018, no. 101”, web doc no. 9124510) as well as, in some cases, when there are “reasons of significant public interest” (Article 9, paragraph 2, letter g) of the Regulation and Article 2-sexies, especially letter dd), of the Code).

With regard to the operation of “communication” of personal data (Article 2-ter, paragraph 4, letter a), of the Code), it should be noted that European legislation provides that “Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing, in accordance with paragraph 1, letters c) and e), by determining more precisely specific requirements for processing and other measures to ensure lawful and fair processing […]” (Article 6, paragraph 2, of the Regulation). In this context, the communication of personal data by public bodies is permitted only when provided for by a law or, in the cases provided for by law, by regulation (art. 2-ter, paragraphs 1 and 3, of the Code, in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021, in force at the time of the facts that are the subject of the complaint, without prejudice to the fact that, where the communication concerns data belonging to particular categories, the specific provisions of the Regulation and the Code referred to above apply).

The employer must also comply with the more specific national rules regarding the processing of data in the context of employment relationships (Article 88 and paragraph 155 of the Regulation), and, in particular, the provisions prohibiting the employer from acquiring, including through third parties, and processing information on the political, religious or trade union opinions of the worker, as well as on facts that are not relevant for the purposes of assessing the professional aptitude of the worker (see Article 113 of the Code, which refers to Article 8 of Law No. 300 of 20 May 1970 and Article 10 of Legislative Decree No. 276 of 10 September 2003). As a result of this referral, and taking into account Article 88, paragraph 2, of the Regulation, compliance with Article 8 of Law No. 300 of 20 May 1970 and Article 10 of Legislative Decree no. 276 of 10 September 2003 (in cases where the conditions are met) constitutes a condition for the lawfulness of processing. These provisions constitute, in the internal legal system, the more specific and more guaranteeing provisions referred to in art. 88 of the Regulation - for this purpose the subject of specific notification by the Guarantor to the European Commission, pursuant to art. 88, par. 3, of the Regulation - compliance with which constitutes a condition for the lawfulness of processing and the violation of which - similarly to the specific processing situations of Chapter IX of the Regulation - determines, in addition to criminal liability (see art. 171 of the Code), also the application of administrative pecuniary sanctions pursuant to art. 83, par. 5, letter a). d), of the Regulation (see, with regard to the public workplace, most recently, Court of Justice of the European Union, judgment of 30 March 2023, case C-34/21; see also the case law of the European Court of Human Rights, in the case Antovic and Mirković v. Montenegro, no. 70838/13 of 28 November 2017, which established that respect for “private life” must also be extended to public workplaces, highlighting the necessary compliance with the guarantees provided for by the applicable national law).

The employer is then, in any case, required to comply with the principles of data protection (art. 5 of the Regulation) and must be able to demonstrate that the processing is carried out in accordance with the Regulation (art. 5, par. 2, and 24 of the Regulation).

3.2. The communication of the complainant's personal data to the Territorial Office of the Government of Livorno and to the Police Headquarters of Livorno.

Following the investigation into the complaint, it emerged that the Director of the UMC, with note prot. no. XX of XX, sent to the Prefecture of Livorno and the Police Headquarters of Livorno, having as its subject “request for information on a gun license”, communicated to the aforementioned recipients personal data relating to the complainant (i.e. the circumstance that the complainant had represented being in possession of a gun license, as well as the existence of a civil dispute between the Ministry of Infrastructure and Transport and the complainant for alleged mobbing), mentioning in full the diagnosis reported in medical certificates produced by the complainant in the context of the aforementioned dispute.

In this context, the Director of the UMC then obtained from the Police Headquarters of Livorno, following her specific request, specific information relating to the ownership by the complainant of a gun license for clay pigeon shooting and the possession of n. 3 firearms regularly reported by the complainant (see the following paragraph 3.3).

As regards the communication of the complainant's personal data to the Prefecture and the Police Headquarters of Livorno, it should be noted that the Authority, since 2007 (see paragraph 5 of the "Guidelines on the processing of personal data of workers for purposes of managing the employment relationship in the public sector", provision of 14 June 2007, web doc. no. 1417809), has invited public administrations to adopt the necessary measures to prevent the unjustified disclosure of personal data, especially if sensitive or judicial, by third parties outside the administration or in any case by persons who, within the administration, cannot be considered authorised to process them.

In this case, the Ministry of Infrastructure and Transport did not indicate any law that could legitimise it, in its capacity as employer, to make the aforementioned communication to the Prefecture of Livorno and the Police Headquarters of Livorno of personal data, including data relating to the state of health, of one of its employees.

As for the processing purposes pursued, during the investigation the Ministry referred to different needs and, in some cases, mutually contradictory ones, namely, in particular, the need to bring out the untruthfulness of the alleged pathological condition asserted by the interested party in the context of the civil court proceedings and that of safeguarding the safety of workers in the workplace, due to the alleged dangerousness of the complainant.

In this regard, it must be noted that the communication of the health data of the complainant occurred in the XX and, therefore, a long time after the date (19 July 2018) on which the complainant had filed an appeal before the Labour Court and filed the medical documentation certifying his pathologies, which, given the passage of time, could well have been no longer current.

As for the defensive argument put forward by the Ministry, according to which the pathology complained of by the complainant had not yet been ascertained in civil proceedings, it must be noted that this pathology was documented in specific medical certificates, the ascertainment in civil proceedings of a causal link between the complained mobbing conduct and the onset of this pathology being irrelevant.

With regard, however, to the circumstance that "there was an evident crime [...] of forgery with the need to communicate it to the Livorno Police Headquarters - the judicial police body. - who had issued the gun license” (see defense brief), it should be noted that the UMC note of XX (prot. no. XX), with which the complainant’s personal data were communicated, does not have the nature of a complaint and makes no reference to a possible crime of forgery attributable to the complainant.

The Ministry also argued that “the data were widely disseminated during the public hearing […] in the presence of over 40 people (including lawyers, witnesses, appellants and respondents from other hearings on the same day)” (see defense brief). This defensive argument cannot be accepted either, given that, in the context of the civil proceedings, the complainant's personal data were not disclosed by the complainant, i.e. brought to the "[...] knowledge of unspecified subjects [...]" (see the definition of "dissemination" in art. 2-ter, paragraph 4, letter b), of the Code), but only communicated to the subjects who in various capacities took part in the public hearing, having the right or duty to do so, and therefore the exception to the prohibition of processing under art. 9, paragraph 2, letter e), of the Regulation, relating to the case in which "the processing concerns personal data which are manifestly made public by the data subject", cannot be invoked. In any case, the legitimate acquisition of information by the employer in the context of an ongoing dispute with one of its employees cannot constitute a relevant argument in order to justify the subsequent communication of such information to a third party, external to the aforementioned dispute, on the assumption that the hearing was public.

It must then be noted, more generally, that, for the purposes of protecting public safety, art. 153 of the royal decree of 18 June 1931, no. 773 provides that "for the purposes of supervision by the public safety authority, those practicing a health profession are obliged to report to the local public safety authority, within two days, the people they assist or examine who are suffering from mental illness or serious mental illness, who demonstrate or give suspicion of being a danger to themselves or others". This provision therefore delegates to healthcare professionals - and not, instead, to the employer - the obligation to make the necessary reports to the competent authorities (see provision 23 March 2023, no. 82, web doc. no. 9885151, relating to a partially similar situation).

Moreover, the Ministry, represented by the Director of the UMC, did not limit itself to sending a generic report to the Prefecture of Livorno and the Police Headquarters of Livorno regarding the possible failure of the complainant to meet the requirements set by law for the possession of a gun license and the possession of weapons, urging the aforementioned Bodies to initiate the investigations within their competence, but communicated to them personal data relating to the complainant that were in any case not necessary for the purposes of such report (i.e. the circumstance that the complainant had represented being in possession of a gun license, as well as the existence of a civil dispute between this Ministry and the complainant for alleged mobbing), as well as data relating to health (diagnosis reported in the medical certificates produced by the complainant in the context of the aforementioned dispute).

In light of all the above considerations, it must be concluded that the communication of the complainant's personal data, including health data, did not comply with the principle of "lawfulness, correctness and transparency" and in the absence of a legal basis, in violation of Articles 5, paragraph 1, letter a), 6 and 9 of the Regulation, as well as 2-ter and 2-sexies of the Code (in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021).

3.3. The processing of the complainant's personal data provided by the Livorno Police Headquarters.

The investigation into the complaint also revealed that the UMC Manager acquired from the Livorno Police Headquarters - P.A.S./ARMI Office the information relating to the circumstance that the complainant was the holder of a firearms license for clay pigeon shooting, issued by the same Office on XX, and that he was the holder of no. 3 regularly reported firearms, as well as information on the initiatives taken by the Police Headquarters following receipt of the note from the UMC Manager (i.e. that on XX the same Police Headquarters had sent the complainant to go for a collegial medical examination at the local USL in order to ascertain that he possessed the psychophysical requirements prescribed by the Decree of the Ministry of Health of 28 April 1998, and that the complainant, instead of going for a collegial examination, had preferred to permanently hand over the weapons in his possession to a gun shop, while the gun license had been returned to the Livorno Police Headquarters; see note from the Livorno Police Headquarters prot. no. XX of XX).

Also with respect to the processing of such personal data transmitted by the Livorno Police Headquarters, which are completely unrelated to the employment relationship with the complainant, the Ministry did not indicate any legal basis that could justify the same.

In this regard, it should be noted that, in this specific case, invoking generic purposes connected with the need to protect the safety and security of other workers, as well as to ascertain an alleged discrepancy between the medical certificates that were the subject of evidence in the civil proceedings relating to the alleged mobbing and the certificate of psychophysical suitability obtained by the interested party for the issue of a gun license, the Ministry, in the person of the Director of the UMC, contacted the Livorno Police Headquarters in order to acquire information (concerning the possession of weapons and the ownership of a gun license) and documents (including health-related ones, the latter, however, not transmitted by the Police Headquarters). However, such treatments do not appear to be provided for by the sector provisions on the protection of health and safety in the workplace referred to in Legislative Decree no. 81 of 9 April 2008.

Furthermore, taking into account the duties performed by the complainant and the context in which they were carried out, which by their very nature do not require the possession of a gun license as a requirement for the work activity, it must be concluded that, in the case in question, for the profiles of competence in the field of personal data protection, the Ministry carried out checks on facts that were not relevant for the purposes of assessing the professional aptitude of the worker and in any case related to the extra-work sphere of the same (see art. 88, par. 2, of the Regulation and 113 of the Code, in reference to art. 8 of law 20 May 1970, n. 300 and art. 10 of Legislative Decree n. 297/2003).

Considering the response provided by the Livorno Police Headquarters regarding the aforementioned requests for information from the Ministry, in its capacity as employer, it must be concluded that the latter acquired and processed personal data relating to the employee's non-work sphere (i.e. the circumstance that the employee owned weapons and was a holder of a gun license, as well as the initiatives taken by the Livorno Police Headquarters following the report received and the behavior of the interested party in the context of the proceedings initiated against him by the Police Headquarters), in violation of the aforementioned sector provisions, which prohibit the employer from acquiring and processing such information.

It must therefore be concluded that this processing of personal data also occurred in a manner that did not comply with the principle of "lawfulness, correctness and transparency" and in the absence of a legal basis, in violation of Articles 5, paragraph 1, letter a), 6 and 88, paragraph 1, letter c). 2, of the Regulation, as well as 2-ter and 113 of the Code (in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021).

4. Conclusions.

In light of the assessments referred to above, it is noted that the declarations made by the data controller during the investigation ˗ the truthfulness of which may be held accountable pursuant to art. 168 of the Code ˗, although worthy of consideration, do not allow the findings notified by the Office with the act initiating the procedure to be overcome and are insufficient to allow the archiving of the present proceeding, since, moreover, none of the cases provided for by art. 11 of the Regulation of the Guarantor no. 1/2019 do not apply.

Therefore, the preliminary assessments of the Office are confirmed and the failure to comply with the data protection legislation is noted, for the Ministry of Infrastructure and Transport to have communicated and processed the complainant's personal data, including those relating to his/her state of health, in a manner that does not comply with the principle of lawfulness, correctness and transparency and in the absence of a legal basis, as well as for having carried out checks on facts that are not relevant for the purposes of assessing the worker's professional aptitude and in any case relating to his/her non-work sphere, in violation of Articles 5, paragraph 1, letter a), 6, 9 and 88, paragraph 2, of the Regulation, as well as 2-ter, 2-sexies and 113 of the Code (in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021).

That said, taking into account that:

the violation, in this case, concerned the personal data relating to a single data subject (see art. 83, par. 2, letter a), of the Regulation);

the conduct is negligent in nature, since the UMC Manager acted in good faith (see art. 83, par. 2, letter b), of the Regulation), even in the absence of a sufficient legal framework, in the mistaken belief that the processing of the complainant's personal data, including data relating to his/her state of health, was necessary to ensure safety in the workplace and, more generally, to protect public safety and the vital interests of the data subject (see in this regard, even in a context other than the workplace and in relation to the processing of personal data carried out not by a public body but by a natural person, Cass. civ. Sez. I, ord. 28 March 2022, no. 9922, regarding the lawfulness of the communication to the public security authorities, for the purposes of revoking the gun license, of personal data, including data relating to his/her state of health, lawfully acquired in the context of a civil proceeding, in order to protect a vital interest and pursue a legitimate interest of their own or of third parties);

the data subject does not appear to have suffered specific repercussions in the work context as a result of the processing of personal data carried out (see art. 83, par. 2, letter c), of the Regulation);

as declared during the proceedings, the communication of personal data to the Prefecture of Livorno and the Police Headquarters of Livorno was carried out in any case with methods (confidential protocol) such as to limit the scope of knowledge of the personal data to a limited number of authorised subjects (see art. 83, par. 2, letter d), of the Regulation);

the Ministry offered good cooperation with the Authority during the investigation (see art. 83, par. 2, letter f), of the Regulation);

there are no previous relevant violations committed by the Ministry in a similar context (see art. 83, par. 2, letter e), of the Regulation);

the violation concerned a specific internal articulation of the data controller and not the overall organization of the same (art. 83, par. 2, letter k) of the Regulation);

the circumstances of the specific case lead to qualifying it as a “minor violation”, pursuant to art. 83, par. 2, and of the cons. 148 of the Regulation, as well as of the “Guidelines on the application and the provision of administrative pecuniary sanctions for the purposes of Regulation (EU) no. 2016/679”, adopted by the Art. 29 Working Party on 3 October 2017, WP 253, and endorsed by the European Data Protection Board with “Endorsement 1/2018” of 25 May 2018.

In light of all of the above, and of the overall terms of the case under examination, it is therefore considered sufficient to warn the Ministry of Infrastructure and Transport (UMC) for the violation of the above provisions, pursuant to art. 58, par. 2, letter b), of the Regulation.

In this context, considering, in any case, that the conduct has exhausted its effects, given that the video devices in question have been uninstalled, the conditions for the adoption of further corrective measures pursuant to art. 58, par. 2, of the Regulation do not exist.

Finally, it should be noted that the conditions pursuant to art. 17 of Regulation no. 1/2019.

GIVEN ALL THE ABOVE, THE GUARANTOR

a) declares, pursuant to art. 57, par. 1, letter f), of the Regulation, the unlawfulness of the processing of personal data carried out by the Ministry of Infrastructure and Transport (UMC), in the person of its legal representative pro-tempore, with registered office in Piazzale Porta Pia 1 - 00198 Rome (RM), C.F. 97532760580, for violation of arts. 5, par. 1, letter a), 6, 9 and 88, par. 2, of the Regulation, as well as 2-ter, 2-sexies and 113 of the Code (in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021), in the terms set out in the reasons;

b) pursuant to art. 58, par. 2, letter b) of the Regulation, warns the Ministry of Infrastructure and Transport (UMC), for having violated Articles 5, paragraph 1, letter a), 6, 9 and 88, paragraph 2, of the Regulation, as well as 2-ter, 2-sexies and 113 of the Code (in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021), as described above;

c) believes that the conditions set out in Article 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met.

Pursuant to Articles 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, an appeal against this provision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 6 June 2024

THE PRESIDENT
Stanzione

THE REPORTER
Cerrina Feroni

THE GENERAL SECRETARY
Mattei

[web doc. no. 10037849]

Provision of 6 June 2024

Register of provisions
no. 336 of 6 June 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN TODAY'S MEETING, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members and the Council Fabio Mattei, Secretary General;

HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”);

HAVING REGARD to Legislative Decree no. 196 of 30 June 2003, “Code on the protection of personal data, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter, “Code”);

HAVING REGARD to Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers assigned to the Guarantor for the protection of personal data, approved with resolution no. 98 of 4 April 2019, published in the Official Journal no. 106 of 8 May 2019 and in www.gpdp.it, web doc. no. 9107633 (hereinafter “Regulation of the Guarantor no. 1/2019”);

Having seen the documentation in the files;

Having seen the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, web doc. no. 1098801;

Rapporteur Prof. Ginevra Cerrina Feroni;

WHEREAS

1. Introduction.

With a complaint filed pursuant to art. 77 of the Regulation, Mr. XX, an employee of the Ministry of Infrastructure and Transport (hereinafter, the “Ministry”), working at the Civil Motorization Office (UMC) of Livorno, represented that, in the context of a legal dispute with the Ministry, he had filed a medical report containing data relating to his health.