Garante per la protezione dei dati personali (Italy) - 10052798
From GDPRhub
| Garante per la protezione dei dati personali - 10052798 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 58(2) GDPR Article 83 GDPR Article 137 Article 50 Article 52 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 27.06.2023 |
| Decided: | 13.09.2024 |
| Published: | 13.09.2024 |
| Fine: | 10,000 EUR |
| Parties: | Nomodidattica S.r.l. (owner of the Moltocomuni website) |
| National Case Number/Name: | 10052798 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | Mgrd |
The Italian DPA, Garante, issued a 10,000€ fine to journal publisher after it published a non-anonymised judgement containing personal data of children, violating Article 5 GDPR and the Italian Data Protection Code.
English Summary
Facts
On February 13, 2023, Nomodidattica S.r.l., a company managing the Moltocomuni website, published an article linking to a court judgment from the Tribunal of Vicenza. This judgment, accessible via the link, contained sensitive, unredacted information about minors involved in a legal dispute between two municipalities regarding social assistance costs. The judgment included identifiable information, such as minors' names, places of residence, the care facilities they were placed in, and details of their stays.
On June 27, 2023, The Regional Ombudsman for Veneto (an independent public office within the Veneto region of Italy that serves to protect the rights and interests of individuals), reported the publication to Garante, highlighting that the judgment’s full content was available online without any anonymization, violating GDPR and the Italian Data Protection Code, especially considering the minors’ information.
On November 9, 2023, Garante contacted the controller to address the issue and they immediately removed the article and the court judgment. The controller argued that the article aligned with journalistic standards, aiming to inform public administration employees on relevant cases. However, they admitted an error in assuming the judgment had already been anonymized by the court.
On April 15, 2024, Garante formally notified the controller of potential data protection violations and opened a formal inquiry. The controller provided a formal response, explaining the free-access nature of the website, focused on public sector issues. They reiterated that they intended to inform without directly identifying the minors, but they acknowledged failing to anonymize the linked judgment.
Holding
Garante ruled that Nomodidattica’s handling of minors’ data was unlawful, breaching principles of lawfulness, fairness, data minimization, and essential anonymization, violating Article 5 GDPR. For this reason, the DPA issued a fine of €10,000 imposed on Nomodidattica S.r.l. under Article 83 GDPR.
In its decision, Garante highlighted the violation of several Articles of the Italian Data Protection Code, such as Article 50, that prohibits the publication of information that could identify a minor involved in any judicial proceeding, not limited to criminal cases; Article 52(5) determining that when judicial rulings or other legal documents are published, all identifying information regarding minors and certain sensitive parties must be removed; and Article 137(3), requiring that personal data used for journalistic purposes must be limited to what is necessary and must follow the principle of essenzialità dell’informazione (the “essentiality of information” principle).
Consequently, the Garante ordered the immediate prohibition of further data processing related to the children, except for preservation for potential judicial use.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
SEE ALSO: Newsletter of September 13, 2024 [web doc. no. 10052798] Measure of July 4, 2024 Register of measures no. 411 of July 4, 2024 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General; SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”); SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”); SEEN the note of 27 June 2023 with which the Regional Guarantor of the rights of the person at the Veneto Region reported to this Authority the availability online of a ruling of the Court of Vicenza, published in full and without any anonymization of the minors mentioned therein - in the form of a link accompanying a commentary article (https://...) - concerning a dispute between two municipalities regarding the expenses incurred for the maintenance of some minors in "day or semi-residential" facilities (Law no. 328/2000 and Veneto Region Law no. 5/1996); SEEN the request for information sent by the Office on 9 November 2023 (prot. 151176) to Nomodidattica S.r.l. and the note of the same day with which the Company communicated the elimination of the article; SEEN the subsequent note of 27 November with which the Company represented in particular that: - the publication of the disputed article constituted a legitimate manifestation of the exercise of the right to report, carried out in compliance with the canons of public interest and restraint on a topic of particular interest for the local authorities to which the magazine “Moltocomuni” is directed, having as its subject «an important precedent in the context of the interpretation of state and regional regulations relating to economic integration for assistance interventions in residential facilities»; - the processing of personal data occurred in compliance with art. 21 of the Constitution, art. 10 ECHR and the balancing provided for in art. 17, paragraph 3, letter a) of Regulation 2016/679/EU, as well as in compliance with the principles of lawfulness and correctness of the processing and minimization referred to in art. 5, paragraph 1, letters a) and c) of the aforementioned Regulation; - the data processing was carried out to the extent necessary for the journalistic purpose, in compliance with the principle of essentiality of information, as set out in articles 6 and 8 of the Deontological Rules relating to the processing of personal data in the exercise of journalistic activity, by the pronouncements of the Guarantor and by case law; - the article commenting on the sentence did not report the names of the people involved, nor those of the minors; - the alleged harmful effects were immediately removed; - the Journal, with free access, has never received comments on data confidentiality and, on the other hand, has a specific column dedicated to this matter, carrying out a function of disseminating culture and rules in this dedicated area; however, it has undertaken to "call the authors to pay particular attention and in any case to obscure the data of natural persons in the text of the sentences, as published or received by others". SEEN the Office note of 15 April (prot. no. 46595/24) with which, pursuant to art. 166, paragraph 5, of the Code, Nomodidattica S.r.l. was notified of the initiation of the procedure for the possible adoption of the provisions referred to in art. 58, paragraph 2, of the Regulation and notified of the possible violations of the law in relation to the general principles regarding processing (art. 5, paragraph 1, letters a and c) of the Regulation), to arts. 50 and 52 of the Code and to the specific provisions regarding processing carried out in the exercise of journalistic activity with particular reference to art. 137, paragraph 3, of the Code, arts. 6 and 7 of the Deontological Rules); SEEN the note of 9 May 2024 with which the Company, in referring to the previous defensive documents, intended to specify that: - the Journal, which can be consulted free of charge by users (usually limited in number and mainly made up of public employees) «makes use of the contributions of various authors, who, usually free of charge and without any commitment to continuity, contribute to implementing its content with the publication of news, articles, notes on judgments and in-depth analyses on matters of interest to the local government system»; - the text of the article, «does not contain any personal data and much less the names of minors» and «faithfully reflects the content of the judicial provision, of significant public interest especially for the system of municipalities»; - «the judgment (linkable), however, as correctly contested by this Authority, reports the names of some foreign minors; the data were not anonymized due to a mere involuntary error, due to the (erroneous) belief that, as is customary, the data had already been rendered unintelligible in the provision by the judicial authority»; - the alleged harmful effects of the violation were in any case removed by the immediate blacking out of the article, the consequent de-indexing, as well as the elimination of the text of the judgment in pdf format; CONSIDERING that, unless the fact constitutes a more serious crime, anyone who, in a proceeding before the Guarantor, falsely declares or certifies information or circumstances or produces false acts or documents is liable pursuant to art. 168 of the Code “False declarations to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”; CONSIDERING that it is not disputed that, on the website “www.moltocomuni.it”, published by Nomodidattica S.r.l., on 13 February 2023 a jurisdictional provision was published in full regarding a dispute between 2 Municipalities regarding the distribution of expenses incurred for social assistance interventions for the benefit of some minors; CONSIDERING that the published provision reports the identification data of the minors, as well as additional information such as their places of residence, the various facilities where they were hosted and the periods of stay in the latter; CONSIDERING that: - art. 50 of the Code prohibits the publication of information capable of allowing the identification of a minor even in judicial proceedings in matters other than criminal matters; - art. 52, paragraph 5, of the Code establishes that "anyone who disseminates judgments or other jurisdictional provisions of judicial authorities of any order and degree is required to omit in any case, even in the absence of the annotation referred to in paragraph 2, the personal details, other identifying data or other data also relating to third parties from which the identity of minors, or of the parties in proceedings concerning family relationships and personal status, can be deduced even indirectly"; - art. 137, paragraph 3, of the Code requires that the dissemination of data for journalistic purposes occurs in compliance with the parameter of the "essentiality of the information regarding facts of public interest"; - the ethical rules referred to in Annex A1 of the Code and, in particular, art. 7 recognize the primacy of the right to privacy of the minor over the right to report and prescribe the adoption of precautions aimed at guaranteeing their anonymity; - the same reasons for the protection of minors are invoked by the Treviso Charter, referred to in the aforementioned art. 7 - in relation to the representation of life events that may cause damage to their personality; - art. 2-quater of the Code provides that compliance with the Rules of Ethics constitutes an "essential condition for the lawfulness and correctness of the processing". HAVING ACKNOWLEDGED the removal measures adopted by the Company; CONSIDERING that the processing described constitutes a violation of the general principles of processing pursuant to art. 5, par. 1, of the Regulation and, in particular, the principle of lawfulness and correctness of the processing and data minimization (letters a) and c), as well as a violation of the aforementioned provisions (see also provision no. 157 of 28 April 2022, web doc. no. 9779098); CONSIDERING therefore, pursuant to art. 57, par. 1, letter f), of the Regulation to declare the unlawfulness of the processing and, as a result, pursuant to art. 58, par. 2, letter f), of the Regulation, to order the prohibition of further processing of the complainants' personal data, with the exception of their storage, including for the purposes of possible use in court; CONSIDERING further that failure to comply with art. 5 is sanctioned by art. 83, par. 5, letter a), of the Regulation and that, similarly, failure to comply with the provisions of art. 52, paragraph 5, of the Code and the Rules of Ethics is sanctioned pursuant to the combined provisions of arts. 2-quater, 166, paragraph 2, of the Code, and 83, par. 5, of the Regulation; CONSIDERING, therefore, that an injunction order must be issued, pursuant to arts. 166, paragraph 7, of the Code and 18 of Law no. 689/1981, for the application to Nomodidattica S.r.l. of the administrative pecuniary sanction provided for by the combined provisions of Articles 2-quater, 166, paragraph 2, of the Code, and 83, paragraphs 3 and 5, of the Regulation; SEEN Article 83, paragraph 3, of the Regulation, pursuant to which if in relation to the same processing or connected processing, a data controller or a data processor violates, with intent or negligence, several provisions of the Regulation, the amount of the administrative pecuniary sanction does not exceed the amount applicable for the most serious violation; NOTING that in order to determine the amount of the pecuniary sanction, it is necessary to take into account the elements indicated in Article83, par. 2, of the Regulation and that in this case it is necessary to take into account, as aggravating circumstances: a) the seriousness of the violation (art. 83, par. 2, letter a), of the Regulation), taking into account the particular nature of the data processed capable of revealing the identity of minors in association with sensitive information, such as that which reveals their stay in social welfare facilities; b) always with reference to the seriousness of the violation, the circumstance that the dissemination of these data was carried out, without the knowledge of the interested parties and of those exercising parental authority, for the purpose of providing information on a profile/case study of the law that was totally independent of the identity of the interested parties; and, as mitigating factors: c) the purposes pursued by the owner, attributable - in general terms - to the freedom of information (art. 85) and to the Code (arts. 136 et seq.); d) the adoption of suitable measures to eliminate the consequences of the violation (Article 83, paragraph 2, letter c), of the Regulation), the owner having promptly removed the measure; e) the full cooperation shown in the proceedings (Article 83, paragraph 2, letter f), of the Regulation) and the absence of previous complaints by the Authority in the journalistic field (Article 83, paragraph 2, letter e), of the Regulation; f) the organizational, economic and professional conditions of the offender (Article 83, paragraph 2, letter k), of the Regulation) taking into account what was declared by the Company and emerged in the financial statements for the year 2022; CONSIDERING the above parameters and the principles of effectiveness, proportionality and dissuasiveness indicated in Article 83, paragraph 1, of the Regulation; CONSIDERING that, on the basis of the set of elements indicated above, the administrative pecuniary sanction of €10,000.00 (ten thousand) should be applied; CONSIDERING that the conditions exist for proceeding with the annotation in the internal register of the Authority referred to in art. 57, par. 1, letter u), of the Regulation, in relation to the measures adopted in the specific case in accordance with art. 58, par. 2, of the Regulation itself; SEEN the documentation in the files; SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000; REPORTER Dr. Agostino Ghiglia; CONSIDERING ALL THE ABOVE THE GUARANTOR pursuant to art. 57, par. 1, letter f), of the Regulation. declares the unlawfulness of the processing in the terms set out in the preamble and for the effect: a) pursuant to art. 58, paragraph 2, letter f) of the Regulation, prohibits further processing of the complainants' personal data, except for their storage, also for the purposes of possible use in court; ORDERS pursuant to art. 58, paragraph 2, letter i) and 83 of the Regulation to Nomodidattica S.r.l., with registered office in Verona, via Caserma Ospital Vecchio, 9 – Postcode 37122 - VAT and Tax Code: 0416245023 in the person of its legal representative pro-tempore, to pay the sum of Euro 10,000.00 (ten thousand) as an administrative fine for the violations indicated in the reasons, representing that the offender, pursuant to art. 166, paragraph 8, of the Code has the right to settle the dispute, by paying, within thirty days, an amount equal to half of the fine imposed; ORDERS Nomodidattica S.r.l., in the event of failure to settle the dispute pursuant to the aforementioned art. 166, paragraph 8, of the Code, to pay the sum of Euro 10,000.00 (ten thousand), according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of adopting the consequent executive actions pursuant to art. 27 of Law no. 689/1981. ORDERS the annotation in the internal register of the Authority referred to in art. 57, paragraph 1, letter u), of the Regulation, of the measures adopted against Nomodidattica S.r.l. in accordance with art. 58, paragraph 2, of the Regulation itself. Pursuant to art. 78 of the Regulation, as well as art. 152 of the Code and 10 of Legislative Decree no. 150 of 1 September 2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with that of the place of residence of the interested party within thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad. Rome, 4 July 2024 THE PRESIDENT Stanzione THE REPORTER Ghiglia THE GENERAL SECRETARY Mattei
