Garante per la protezione dei dati personali (Italy) - 10039570

Garante per la protezione dei dati personali - 10039570

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6 GDPR Art. 2-ter(3) d.lgs. 196/2003
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	20.06.2024
Published:
Fine:	n/a
Parties:	Comune di Torri del Benaco
National Case Number/Name:	10039570
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	fb

The DPA reprimanded a municipality for disclosing a Member of Parliament’s personal data after she publicly complained about speeding fines. The DPA held that the municipality had no legal basis to disclose the data even if the information was already publicly available.

English Summary

Facts

A Member of the Parliament was issued several speed camera fines by a municipality, the controller in the case at hand. Since she found these fines unfair, she decided to discuss this matter during a Parliament session and had interviews with some newspapers.

A newspaper asked the mayor of the municipality for an interview, during which he confirmed how much fines were issued to the data subject and that her driving license had not been revoked.

After that, the data subject filed a complaint with the DPA, arguing that the disclosure of this data was unlawful.

Firstly, the mayor objected that he disclosed this data as a private person and not as a representative of the municipality

Secondly, the controller argued that the data subject herself disclosed to the press basically all the information contained in the newspaper articles. Therefore, the mayor commented on something that had already become public and did not reveal any further personal data.

Holding

First of all, the DPA found that the mayor was acting as a representative of the municipality and, therefore, the latter can be regarded as controller.

Secondly, the DPA noted that Article 2-ter(3) of the Italian Data Protection Code allows a public administration to disclose personal data to third parties only when a piece of legislation authorises to do so.

Therefore, it is irrelevant whether this data had already made public or not, since such an exception is not foreseen by any law.

On these grounds, the DPA found a violation of Article 5(1)(a), 5(1)(c) and 6 GDPR and issued a reprimand to the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[web doc. no. 10039570]

Provision of 20 June 2024

Register of provisions
no. 376 of 20 June 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”);

HAVING SEEN Legislative Decree no. 196 of 30 June 2003, containing the “Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and which repeals Directive 95/46/EC (hereinafter “Code”);

HAVING SEEN Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Data Protection Authority, approved with resolution no. 98 of 4/4/2019, published in the Official Journal no. 106 of 8/5/2019 and in www.gpdp.it, web doc. no. 9107633 (hereinafter “Regulation of the Guarantor no. 1/2019”);

Having seen the documentation in the files;

Having seen the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, web doc. no. 1098801;

Rapporteur Prof. Pasquale Stanzione;

WHEREAS

1. Introduction.

With a complaint submitted pursuant to art. 77 of the Regulation, the Hon. XX complained about the communication of his personal data, through the press and during a public conference, by the Mayor of the Municipality of Torri del Benaco (hereinafter, the “Municipality”).

In particular, the complainant refers to some press articles, published between 29 April and 3 May 2023, in which some statements by the Mayor of the Municipality were reported regarding some infringements imposed on the complainant for violations of Legislative Decree 30 April 1992, no. 285, containing the new Highway Code (hereinafter “c.d.s.”).

2. The investigative activity.

With a note dated 4 December 2023, the Mayor of the Municipality, in response to the Authority's request for information dated 6 November 2023, declared that:

“the acquisition of the data of the Hon. XX, the disclosure of which the same complains, occurred in a manner completely independent of the processing of personal data carried out by the Municipality of Torri del Benaco. No use of the Municipality's databases is, in fact, at the origin of the facts complained of; no processing, much less unlawful, occurred […]”;

“[…] on January 23, the Hon. XX contacts me […] to come to the town hall and asks me to accompany her to the offices of the Local Police; the officer [omissis] was present at the office, to whom the Hon. XX, in my presence - without waiting or asking me to leave - asked for information; the officer anticipated to the Hon. XX the number of reports, the amount of fines imposed and the number of points deducted, reporting, again in my presence, the need for a formal request for access to the documents, for the acquisition of the documentation […]”;

“On February 13, 2023, the Hon. XX presents a parliamentary question, with which he once again insinuated doubts about the regularity of the Torri del Benaco device (not of other Municipalities) and asked the Ministers of the Interior, of Enterprise and Made in Italy and of Infrastructure and Transport what initiatives they intended to undertake […]”;

“On February 17, the Verona Sera newspaper reported that the Hon. XX had received fines for speeding detected by the Torri del Benaco speed camera and that he had presented a parliamentary question, with an article entitled “Pai speed camera, question in Parliament: Is it actually approved?” and the subtitle “It was presented by MP XX, also among the many fined […]”;

“on February 22, the latter newspaper published a further statement by the Hon. XX: “[…] the fines, since I too have received several even though I am not speeding”;

“On February 27, 2023, the president of Adiconsum Verona, Mr. [omissis], declared that Adiconsum was “studying a complaint to send to the Public Prosecutor’s Office and the Court of Auditors for abuse of office” and had promoted a petition. On March 31, 2023, the Hon. XX, together with the city councilor [omissis], and the Senator [omissis], participated in a public meeting organized by the consumer association Adiconsum, on the topic of the “dubious” regularity of the Pai speed camera. The climate was heated. Numerous newspaper articles were published on the legitimacy of the actions of the public administration and on the initiatives of motorists and the Hon. XX played a leading role in confirming the sanctions received, herself disseminating the data that concerned her and relating precisely to the sanctions received”;

“Further declarations regarding the recipient of the fines were made on April 27, 2023”;

“On 30 April 2023, the undersigned, questioned on the topic and the accusations levelled at the municipal administration, gave an interview to the newspaper “Il Corriere di Verona”, during which he defended the actions of the Municipality and explained the reasons for such determination, communicating to journalists the data now public because it had already been released by XX itself through the press, as it was now known to the public because it had been publicly and repeatedly released by the same during its initiatives to oppose the activity of the local administration. I certainly did not think of violating the privacy of the Hon. XX, both because of the public role she holds and because of the numerous and strong initiatives she has publicly undertaken, as well as because of the data she herself released that concerned her personally. In fact, the detailed data that I limited myself to releasing to the Corriere di Verona were already known”;

“The statements made during the interview were then taken up by the other newspapers cited in the complaint”;

“The numerical data indicated therefore fall within the right to correct information and the right to political criticism and do not have a denigrating or violative effect on the rights of the MP in the face of a topic that has become of public interest by the will of XX itself […]”.

On the basis of the elements acquired, the Office notified, with a note dated 11 March 2024, the Mayor of the Municipality, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, paragraph 2, of the Regulation. In particular, the Office considered that the communication of certain information regarding the complainant was carried out in the absence of a legal basis and in violation of the principles of “lawfulness, correctness and transparency” and “minimization” (articles 5, paragraph 1, letters a) and c) and 6 of the Regulation).

The Office invited the Mayor of the Municipality to produce defensive documents or documents or to request to be heard by the Authority (art. 166, paragraphs 6 and 7, of the Code; as well as art. 18, paragraph 1, of Law no. 689 of 24/11/1981).

The Mayor of the Municipality sent his defensive briefs with a note dated 8 April 2024, stating that:

“the intent that animated me was certainly not malicious or grossly negligent as I had decided to reveal data that was already known because it was made such by the interested party, and I had not therefore thought of violating his rights or causing him harm, as in any case I revealed them only following the disclosures with which [the complainant] intervened in the newspapers, and therefore with a subsequent action in response to the political debate raised and certainly not preordained or antecedent”;

“this body implements training on the processing of personal data and I myself acted in the belief that I was not causing harm, as I mistakenly believed that it was a permitted data processing since, as stated, the data had already been revealed [by the complainant] as they were communicated indirectly with reference to the speed camera and the statement “I have received several” (fines)”;

Finally, on 7 May 2024, the hearing requested pursuant to art. 166, paragraph 6, of the Code was held, during which the Municipality declared, among other things, the following:

“We learned of the parliamentary question proposed by the complainant from the press. With regard to the matter that was the subject of the complaint, […] the Mayor received a phone call from a journalist from Corriere di Verona, who, having learned the news already revealed by the Honourable to the press, asked whether the charges against her were 12 or 14 and whether her driving licence had been withdrawn”;

“the Mayor responded in good faith, to correct the inaccuracies indicated by the journalist, that there were only 7 and that there were no grounds for the withdrawal of the driving licence”;

“The clarification as to whether the fines had been 7 or 12 was made in good faith, as a result of the way in which the questions had been asked. These statements, far from having been made to stigmatise or embarrass an Honourable, were made in good faith, in response to questions asked in a pressing manner […]”; “the news in any case related to elements already made known by the interested party. The journalist's question was asked about speed and the connection to the number of points connected to the violation and the possible withdrawal of the license";

"the treatment that is the subject of the complaint does not concern an activity carried out in an institutional context, but was done in the capacity of Mayor in response to a question to a journalist. The Mayor is also the head of the local police";

"it is not the database of the municipality that was consulted by the Mayor who then communicated the data to the journalist, but the same were learned by the Mayor during the interview, from the comments of the same to the information received at the office. The complainant has no complaints regarding the treatment carried out by the Municipality".

3. Outcome of the investigation.

3.1 Applicable legislation.

The processing of personal data must be carried out in compliance with the applicable legislation on the protection of personal data and, in particular, with the provisions of the Regulation and the Code.

With particular reference to the question raised, it is highlighted that the processing of personal data carried out by public entities is lawful only if necessary "to comply with a legal obligation to which the data controller is subject" or "for the performance of a task carried out in the public interest or in connection with the exercise of public powers vested in the data controller" (Article 6, paragraph 1, letters c) and e), of the Regulation), and the legal basis, in the Italian legal system, "is constituted by a provision of law or regulation or by general administrative acts" (Article 2-ter, paragraph 1, of the Code).

Processing operations consisting in the “dissemination” of personal data (such as online publication) and in “communication” (as in the case in question) are permitted only when provided for by a law or regulation or by general administrative acts (art. 2-ter of the Code).

The data controller is then, in any case, required to comply with the principles of data protection, including that of “lawfulness, fairness and transparency” as well as “minimization”, according to which personal data must be “processed lawfully, fairly and in a transparent manner in relation to the data subject” and must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed” (art. 5, par. 1, letters a) and c) of the Regulation).

3.2 The processing of personal data carried out by the Municipality

Preliminarily, on the basis of the declarations made by the data controller, as well as the investigation carried out on the basis of the elements acquired following the investigation and subsequent assessments of this Department, it is established that the acquisition of information regarding the complainant occurred on the basis of a personal initiative of the same, who, having received notification of some sanctions, asked the Mayor, "as a personal favor", to be accompanied to the offices of the Local Police in order to "find out how many more would, in the future, arrive" and in this circumstance, in the presence of the Mayor and at the request of the complainant "the officer anticipated to the Hon. XX the number of reports, the amount of sanctions imposed and the number of points deducted".

Furthermore, from the statements in the documents, it is established that, contrary to what was complained about in the complaint:

- the “press dissemination” is not attributable to the Mayor, but rather to the various newspapers that spread the news;

- the Mayor did not “spread” information “during a public conference”.

From the ascertainment of the facts as reconstructed in the investigation, the Mayor limited himself to answering some questions posed by telephone by the newspaper “Il Corriere di Verona”, in relation to the matter of the fines for speeding imposed on the complainant and already spread by the press. The treatment carried out by the Mayor therefore consisted in the “communication” of some clarifications to the journalist, who was already aware of the fact that the complainant had received several fines for speeding detected by the speed camera device that was the subject of the dispute by the users and of the parliamentary question presented by the complainant.

In this regard, it should be noted that the Mayor of the Municipality questioned on 30 April 2023 by the journalist of “Il Corriere di Verona”, acted as a representative of the Municipality and, in order to defend its actions, communicated information partly made public by the complainant herself in interviews and initiatives promoted to contrast the activity of the local administration, as well as some additional information (exact number of sanctions, driving license points deducted and speed). Therefore, it is not possible to agree with what was declared during the investigation in relation to the fact that the treatment carried out by the Mayor is connected “only coincidentally to the role that the [… omitted] plays”, since such treatment is carried out for purposes strictly connected to this role (and not for personal purposes), and, therefore, attributable to the Municipality of Torri del Benaco and not to the subject - natural person who holds the role of representative of the Body.

Finally, the circumstances in which the incident and some information were already known within the local community and reported by some local press organs cannot be considered sufficient to justify the communication of the complainant's personal data. As clarified in numerous decisions by the Guarantor, in fact, public bodies may disseminate personal data only where permitted by the legal framework of reference (art. 2-ter, paragraphs 1 and 3, of the Code, in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021) without regard to whether the same data may have been made public elsewhere for other purposes (see Provision no. 45 of 10 February 2022, web doc. no. 9751549 (see provision no. 118 of 2 July 2020, web doc. no. 9440025; provision no. 68 of 25 February 2021, web doc. no. 9567429).

Thus circumscribed the conduct, with reference to such “additional information”, it appears, therefore, that the processing was carried out in the absence of a legal basis and in violation of the principles of “lawfulness, fairness and transparency” and “minimization” (Articles 5, paragraph 1, letters a) and c) and 6 of the Regulation).

4. Conclusions.

In light of the assessments referred to above, taking into account the statements made by the data controller during the investigation ˗ the truthfulness of which may be held accountable pursuant to Article 168 of the Code ˗ it is represented that the elements provided by the data controller in the defensive briefs do not allow the findings notified by the Office with the act of initiation of the proceeding to be overcome and are insufficient to allow the archiving of the present proceeding, since none of the cases provided for by Article 11 of the Regulation of the Guarantor no. 1/2019 apply.

Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by the Mayor of the Municipality in violation of Articles. Articles. 5, par. 1, lett. a) and c) and 6 of the Regulation.

Having said this, taking into account that:

- the unlawful conduct involved only one interested party who contributed to the dissemination of some personal information;

- the communication in question occurred in a context of contestation of the actions of the local authority and, therefore, the communication made by the Mayor occurred in good faith with a view to defending the choices made by the municipal administration;

- the data controller cooperated fully with the Authority during the investigation;

- there are no previous relevant violations committed by the data controller or previous measures pursuant to art. 58 of the Regulation;

- the circumstances of the specific case lead to qualifying the same as a “minor violation”, pursuant to cons. 148 of the Regulation and the “Guidelines on the application and provision of administrative pecuniary sanctions for the purposes of Regulation (EU) no. 2016/679”, adopted by the Art. 29 Working Party on 3 October 2017, WP 253, and endorsed by the European Data Protection Board with “Endorsement 1/2018” of 25 May 2018.

It is therefore believed, with respect to the case in question, that it is sufficient to warn the data controller pursuant to Articles 58, par. 2, letter b), and 83, par. 2, of the Regulation, for having violated Articles 5, par. 1, letter a) and c) and 6 of the Regulation.

Considering that the conduct has exhausted its effects, the conditions for the adoption of further corrective measures pursuant to Article 58, par. 2, of the Regulation do not apply.

Finally, it is noted that the conditions pursuant to Article 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

GIVEN ALL THE ABOVE, THE GUARANTOR

a) pursuant to art. 57, par. 1, letter f), declares the conduct of the Municipality of Torri del Benaco (VR), with registered office in Viale F.lli Lavanda, n. 3, 37010 – C.F. 00661030239, described in the terms set out in the motivation, to be unlawful, consisting in the violation of art. 5, par. 1, letters a) and c) and 6 of the Regulation;

b) pursuant to art. 58, par. 2, letter b) of the Regulation, warns the Municipality of Torri del Benaco, as the data controller in question, for having violated art. 5, par. 1, letter a) and c) and 6 of the Regulation as described above;

c) considers that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers assigned to the Guarantor, are met.

Pursuant to art. 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, an appeal against this provision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 20 June 2024

THE PRESIDENT
Stanzione

THE REPORTER
Stanzione

THE GENERAL SECRETARY
Mattei

[web doc. no. 10039570]

Provision of 20 June 2024

Register of provisions
n. 376 of 20 June 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”);

HAVING SEEN Legislative Decree no. 196 of 30 June 2003, containing the “Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and which repeals Directive 95/46/EC (hereinafter “Code”);

HAVING SEEN Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Data Protection Authority, approved with resolution no. 98 of 4/4/2019, published in the Official Journal no. 106 of 8/5/2019 and in www.gpdp.it, web doc. no. 9107633 (hereinafter “Regulation of the Guarantor no. 1/2019”);

Having seen the documentation in the files;

Having seen the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, web doc. no. 1098801;

Rapporteur Prof. Pasquale Stanzione;

WHEREAS

1. Introduction.

With a complaint filed pursuant to art. 77 of the Regulation, the Hon. XX complained about the communication of his personal data, through the press and during a public conference, by the Mayor of the Municipality of Torri del Benaco (hereinafter, the “Municipality”).

In particular, the complainant refers to some press articles, published between 29 April and 3 May 2023, in which some statements by the Mayor of the Municipality were reported relating to some infringements imposed on the complainant for violations of Legislative Decree 30 April 1992, no. 285, containing the new Highway Code (hereinafter “C.D.S.”).

2. The investigation activity.

With a note dated 4 December 2023, the Mayor of the Municipality, in response to the Authority’s request for information dated 6 November 2023, declared that:

“the acquisition of the data of the Hon. XX, the disclosure of which she complains about, occurred in a manner that was completely independent of the processing of personal data carried out by the Municipality of Torri del Benaco. In fact, no use of the Municipality's databases is at the origin of the facts complained of; no processing, much less illegal, occurred […]”;

“[…] on 23 January, the Hon. XX contacts me […] to come to the town hall and asks me to accompany her to the offices of the Local Police; the officer [omissis] was present at the office, to whom the Hon. XX, in my presence - without waiting or asking me to leave - asked for information; the officer anticipated to the Hon. XX the number of reports, the amount of sanctions imposed and the number of points deducted, reporting, again in my presence, the need for a formal request for access to the documents, for the acquisition of the documentation […]”;

“On 13 February 2023, the Hon. XX presents a parliamentary question, with which he once again insinuated doubts about the regularity of the Torri del Benaco device (not of other Municipalities) and asked the Ministers of the Interior, of Enterprise and Made in Italy and of Infrastructure and Transport what initiatives they intended to undertake […]”;

“On 17 February, the Verona Sera newspaper reported that the Hon. XX had received fines for speeding detected by the Torri del Benaco speed camera and that he had presented a parliamentary question, with an article entitled “Pai speed camera, question in Parliament: Is it actually approved?” and the subtitle “It was presented by MP XX, also among the many fined […]”;

“on 22 February, the latter newspaper published a further statement by the Hon. XX: “[…] the fines, given that I too have received several even though I am not racing”;

“On February 27, 2023, the president of Adiconsum Verona, Mr. [omissis], declared that Adiconsum was “studying a complaint to send to the Public Prosecutor’s Office and the Court of Auditors for abuse of office” and had promoted a signature collection. On March 31, 2023, the Hon. XX, together with the city councilor [omissis], and the Senator [omissis], participated in a public meeting organized by the consumer association Adiconsum, on the topic of the “dubious” regularity of the Pai speed camera. The climate was heated. Numerous newspaper articles were published on the legitimacy of the actions of the public administration and on the initiatives of motorists and the Hon. XX played a leading role, confirming the fines received, herself disseminating the data concerning her and relating specifically to the fines received”;

“Further declarations regarding being the recipient of the fines were made on April 27, 2023”;