Garante per la protezione dei dati personali (Italy) - 10072031
From GDPRhub
| Garante per la protezione dei dati personali - 10072031 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 12(1) GDPR Article 12(2) GDPR Article 13 GDPR Article 14 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 29.12.2023 |
| Decided: | 26.09.2024 |
| Published: | 26.09.2024 |
| Fine: | n/a |
| Parties: | Telerama News |
| National Case Number/Name: | 10072031 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | Mgrd |
Garante issued a reprimanded against a news website since it did not show any information pursuant to Article 13 and 14 GDPR.
English Summary
Facts
On 29 December 2023, a complaint was filed with Garante against T.A. Format S.r.l., the publisher of the news platform Telerama News. The complaint highlighted the lack of information regarding data processing on the company’s website (www.trnews.it), in violation of GDPR transparency requirements.
On 16 May 2024, Garante requested the controller to provide clarifications on the complaint, in which they responded claiming that the necessary privacy information was published on the website, but may have been temporarily inaccessible due to technical issues. The website had undergone a complete structural overhaul between late 2023 and May 2024, which could have led to occasional omissions.
On 11 June 2024, Garante formally initiated an investigation, notifying the company of potential violations of Article 5(1), Article 12(1)(2), Article 13 and Article 14.
Holding
During the investigation, the Garante confirmed that as of this date, the website lacked the required privacy notices under Articles 13 and Article 14 GDPR, hindering users' ability to exercise their rights.
Garante issued a formal reprimand to the controller, under Article 58(2)(b) GDPR, since the company failled to meet the principles of transparency and fairness under Article 5(1)(a), Article 12(1)(2), Article 13 and Article 14 GDPR by not providing users with the required information about data processing on its website for an extended period.
While acknowledging the violations, the Garante also considered mitigating factors, since the company acted promptly to address the issues once it became aware of them, they had no prior violations of data protection laws and the company cooperated throughout the investigation and provided clarifications.
The Garante ordered the inclusion of this case and the adopted measures in its internal registry under Article 57(1)(u) of the GDPR. This step ensures that the measures are documented for record-keeping and future reference.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[web doc. no. 10072031] Provision of 26 September 2024 Register of provisions no. 593 of 26 September 2024 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General; HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “Regulation”); HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter the “Code”); HAVING SEEN the proceedings initiated by the Authority on the basis of a report received on 29 December 2023 against T.A. Format S.r.l. (hereinafter also the “Company”), as publisher of the Telerama News newspaper, regarding the failure to publish on the relevant website www.trnews.it (hereinafter the “Site”) the information on the processing of personal data to be provided to data subjects pursuant to the Regulation; HAVING SEEN the note of 16 May 2024 with which the Authority invited the data controller to provide its observations in relation to what was represented in the report; SEEN the response of 30 May 2024 with which T.A. Format S.r.l. stated that the information on the processing of personal data pursuant to Articles 13 and 14 of the Regulation is published on the Site, also specifying that the Site has recently been completely redone, therefore it cannot be excluded that, due to technical problems, «the above information was occasionally and for a very short period omitted»; SEEN the Office note dated 11 June 2024 (prot. no. 71025/24) with which, pursuant to Article 166 paragraph 5 of the Code, T.A. Format S.r.l. was notified of the initiation of the procedure for the possible adoption of the measures pursuant to Article 58, paragraph 2, of the Regulation and the alleged violations of the law identified, in this case, in the violation of Articles 5, paragraph 1, letter a), c), d), e), f), c), d), e), d), e), e), f), e), e), f), e), e), f), e), e), g ... a), 12, paragraphs 1 and 2, 13 and 14 of the Regulation; SEEN the note of 3 July 2024 with which T.A. Format S.r.l., in referring to what was stated in the previous communication, intended to specify that: from the end of 2023 to May 2024 the Site was affected by technical-structural problems and was also subjected to a complete restructuring intervention; circumstances that have "made access to users somewhat complicated by not fully providing the information requested"; this state of inaccessibility of the Site has been communicated several times to the entity in charge of managing the related platform, through the opening of multiple reporting tickets indicating various reasons for the error; the opening of the tickets took place during the period December 2023-May 2024 and, for some reports, also at an earlier time, thus proving the good faith of the Company; having become aware of the malfunction of the Site, the Company immediately took action to resolve the problems encountered; this resolution, also aggravated by the restructuring of the Site, required a prolonged timeframe, starting in December 2023 and ending in June 2024; no liability can be attributed to the Company «since what occurred was not caused by its fault and/or negligence. Therefore, in this case, a violation of Articles 13 and 14 of EU Regulation 679/16 cannot be identified»; CONSIDERING that, unless the fact constitutes a more serious crime, anyone who, in a proceeding before the Guarantor, falsely declares or certifies information or circumstances or produces false deeds or documents is liable pursuant to Article 168 of the Code “False declarations to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”; CONSIDERING that: based on the checks and elements acquired during the preliminary investigation, it was found that, on 15 May 2024, the necessary information on the data processing required by Articles 13 and 14 of the Regulation was not provided to the interested parties on the Site, thus hindering their exercise of their rights; the arguments provided by the Company cannot be considered totally suitable to exclude, on its part, the liability for the failure to publish the aforementioned information on the processing on the Site; CONSIDERING, therefore, that the violation by T.A. Format S.r.l. of Articles 5, paragraph 1, letter a), 12, paragraphs 1 and 2, 13 and 14 of the Regulation has been ascertained; CONSIDERING, with respect to the ascertained violation, that: upon becoming aware of it, the Company immediately took action to resolve the problems encountered on the Site; T.A. Format S.r.l. has published on the Site the information required by Articles 13 and 14 of the Regulation; there are no previous violations against T.A. Format S.r.l.; the overall assessment of the elements described leads to the belief that the application of the warning measure is proportionate in the case in question; CONSIDERING therefore that it is necessary to address a warning to the data controller pursuant to Article 58, paragraph 2, letter b) of the Regulation, for failure to comply with the principles of fairness and transparency in relations with users, contained in Articles 12, paragraphs 1 and 2, 13 and 14 of the Regulation, which require the controller to provide interested parties with the necessary information on the processing, first and foremost the identification details of the controller and the contact details to contact him, as well as to facilitate the exercise of the rights pursuant to Articles 15-22 of the Regulation; CONSIDERING, pursuant to art. 17 of the regulation of the Guarantor no. 1/2019, that the conditions exist to proceed with the annotation in the internal register of the Authority referred to in art. 57, par. 1, letter u), of the Regulation, in relation to the measures adopted in this case against T.A. Format S.r.l. in accordance with art. 58, par. 2, of the Regulation; SEEN the documentation in the files; SEEN the observations formulated by the Secretary General pursuant to art. 15 of the regulation of the Guarantor no. 1/2000; REPORTER Prof. Pasquale Stanzione; CONSIDERING ALL THE ABOVE, THE GUARANTOR pursuant to art. 57, par. 1, letter a), of the Regulation: a) warns T.A. Format S.r.l. for failure to comply with the principles of fairness and transparency in relations with the interested parties, contained in articles 12, paragraphs 1 and 2, 13 and 14 of the Regulation, which require the owner to provide them with the necessary information on the processing and to facilitate the exercise of their rights pursuant to articles 15-22 of the Regulation; b) pursuant to art. 17 of the regulation of the Guarantor no. 1/2019, provides for the annotation in the internal register of the Authority referred to in art. 57, paragraph 1, letter u), of the Regulation, of the measures adopted against T.A. Format S.r.l., in compliance with art. 58, paragraph 2, of the Regulation. Pursuant to art. 78 of the Regulation, as well as articles 152 of the Code and 10 of Legislative Decree 1 September 2011, no. 150, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its headquarters or with that of the place of residence of the interested party within thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad. Rome, 26 September 2024 THE PRESIDENT Stanzione THE REPORTER Stanzione THE GENERAL SECRETARY Mattei [web doc. no. 10072031] Provision of 26 September 2024 Register of provisions no. 593 of 26 September 2024 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN TODAY'S meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, Members and Council Member Fabio Mattei, Secretary General; SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “Regulation”); SEEN the Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”); SEEN the proceedings initiated by the Authority on the basis of a report received on 29 December 2023 against T.A. Format S.r.l. (hereinafter also “Company”), as publisher of the Telerama News newspaper, regarding the failure to publish on the relevant website www.trnews.it (hereinafter “Site”) the information on the processing of personal data to be provided to data subjects pursuant to the Regulation; SEEN the note of 16 May 2024 with which the Authority invited the data controller to provide his/her observations in relation to what was reported; SEEN the response of 30 May 2024 with which T.A. Format S.r.l. stated that the Site contains information on the processing of personal data pursuant to Articles 13 and 14 of the Regulation, also specifying that the Site has recently been completely redone, and therefore it cannot be excluded that, due to technical problems, «the above information was occasionally and for a very short period of time omitted»; SEEN the Office note dated 11 June 2024 (prot. no. 71025/24) with which, pursuant to art. 166 paragraph 5 of the Code, T.A. Format S.r.l. was notified of the initiation of the procedure for the possible adoption of the provisions referred to in art. 58, par.2, of the Regulation and notified the alleged violations of the law identified, in this case, in the violation of Articles 5, paragraph 1, letter a), 12, paragraphs 1 and 2, 13 and 14 of the Regulation; SEEN the note of 3 July 2024 with which T.A. Format S.r.l., in referring to what was stated in the previous communication, intended to specify that: from the end of 2023 to May 2024 the Site was affected by technical-structural problems and was also subjected to a complete restructuring intervention; circumstances that have "made access to users somewhat complicated by not fully providing the information requested"; this state of inaccessibility of the Site has been communicated several times to the entity that manages the related platform, through the opening of multiple reporting tickets indicating various reasons for the error; the opening of the tickets occurred during the period December 2023-May 2024 and, for some reports, even at an earlier time, thus demonstrating the good faith of the Company; having become aware of the malfunction of the Site, the Company immediately took action to resolve the problems encountered; this resolution, also aggravated by the restructuring interventions of the Site, required a prolonged timeframe, starting in December 2023 and ending in June 2024; no liability can be attributed to the Company «since what occurred was not determined by its fault and/or negligence. Therefore, in this case, a violation of Articles 13 and 14 of EU Regulation 679/16 cannot be identified»; CONSIDERING that, unless the fact constitutes a more serious crime, anyone who, in a proceeding before the Guarantor, falsely declares or certifies information or circumstances or produces false deeds or documents is liable pursuant to Article 168 of the Code “False statements to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”; NOTED that: on the basis of the checks and elements acquired during the investigation, it was found that, on 15 May 2024, the necessary information on the data processing required by Articles 13 and 14 of the Regulation was not provided to the interested parties on the Site, thus hindering their possible exercise of their rights; the arguments provided by the Company cannot be considered totally suitable to exclude, on its part, the liability for the failure to publish the aforementioned information on the processing on the Site; NOTED, therefore, that the violation by T.A. Format S.r.l. of Articles 5, paragraph 1, letter a), 12, paragraphs 1 and 2, 13 and 14 of the Regulation has been ascertained; CONSIDERING, with respect to the violation found, that: upon becoming aware of it, the Company immediately took action to resolve the problems found on the Site; T.A. Format S.r.l. has published on the Site the information required by Articles 13 and 14 of the Regulation; there are no previous violations against T.A. Format S.r.l.; the overall assessment of the elements described leads to the belief that the application of the warning measure is proportionate in the case in question; THEREfore CONSIDERING that a warning must be addressed to the data controller pursuant to Article 58, paragraph 2, letter b) of the Regulation, for failure to comply with the principles of fairness and transparency in relations with users, contained in Articles 12, paragraphs 1 and 2, 13 and 14 of the Regulation, which require the data controller to provide the interested parties with the necessary information on the processing, first of all the identification details of the data controller and the contact details to contact him, as well as to facilitate the exercise of the rights pursuant to Articles 15-22 of the Regulation; CONSIDERING, pursuant to Article 17 of the Regulation of the Guarantor no. 1/2019, that the conditions exist to proceed with the annotation in the internal register of the Authority pursuant to Article 57, paragraph 1, letter u), of the Regulation, relating to the measures adopted in this case against T.A. Format S.r.l. in accordance with Article 58, paragraph 2, of the Regulation; SEEN the documentation in the files; SEEN the observations formulated by the Secretary General pursuant to Article 15 of the Regulation of the Guarantor no. 1/2000; REPORTER Prof. Pasquale Stanzione; GIVEN ALL THE ABOVE, THE GUARANTOR pursuant to art. 57, par. 1, letter a), of the Regulation: a) warns T.A. Format S.r.l. for failure to comply with the principles of fairness and transparency in relations with the interested parties, contained in art. 12, par. 1 and 2, 13 and 14 of the Regulation, which require the owner to provide them with the necessary information on the processing and to facilitate the exercise of their rights pursuant to art. 15-22 of the Regulation; b) pursuant to art. 17 of the regulation of the Guarantor no. 1/2019, orders the annotation in the internal register of the Authority referred to in art. 57, par. 1, letter u), of the Regulation, of the measures adopted against T.A. Format S.r.l., in compliance with art. 58, par. 2, of the Regulation. Pursuant to art. 78 of the Regulation, as well as art. 152 of the Code and 10 of Legislative Decree no. 150 of 1 September 2011, an appeal against this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with that of the place of residence of the interested party within thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad. Rome, 26 September 2024 THE PRESIDENT Stanzione THE REPORTER Stanzione THE GENERAL SECRETARY Mattei
