Garante per la protezione dei dati personali (Italy) - 10104750

Garante per la protezione dei dati personali - 10104750

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 4(1) GDPR Article 4(15) GDPR Article 5(1)(b) GDPR Article 5(1)(d) GDPR Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 5(2) GDPR Article 6 GDPR Article 9 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	19.12.2024
Published:
Fine:	10,000 EUR
Parties:	Comune di Brescia
National Case Number/Name:	10104750
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	GPDP (in IT)
Initial Contributor:	elu

The DPA fined a municipality €10,000 for unlawfully placing the parents' surnames and date of termination of pregnancy, without their authorization, on several fetuses' graves and in the online portal of the cemetery.

English Summary

Facts

The DPA started an ex officio investigation, after a large journalist investigation was published, against a municipality, the controller. The investigation concerned the practice of the municipal cemetery of burying “fetuses” and “stillborn children”.

Each of the tombstones contains the same first name (which is a name traditionally assigned to stillborn children in Italian Catholic tradition), and different surnames, which correspond to the surname of the data subjects, who are the women who interrupted their pregnancy and the men who these women conceived the fetus with. The DPA found that, in the vast majority of cases, these data subjects did not know about the burial site and of the use of their surnames.

Additionally, the preliminary investigation of the DPA revealed that, in the online portal of the cemetery, it was possible to find the precise location of each tombstone by typing in the name and surname thereon written. The data available through this online research was name, surname, date of birth and death, as well as the specification of their status of “fetuses” or “stillborn child”.

Holding

Applicability of the GDPR and Violation of Article 6 GDPR and Article 9 GDPR

The DPA starts by considering that, in respect to the burial of fetuses, Article 7 of the Mortuary Police Regulation differentiates three different cases:

“stillborn children”, who must be buried;
“products of interrupted pregnancies”, aged 20-28 weeks, who must be buried either at their parents’ request, or the health facility’s request;
“products of conception”, aged less than 20 weeks, who can be buried only at their parents’ request.

The DPA considered that the subject of the investigation concerned the personal data disclosures that related to the products of interrupted pregnancies and products of conception, for which the relatives did not request burial nor indicated to put their data on the gravestone.

The DPA found that the indication of the data subjects’ surnames, together with the data of birth and death of the products of interrupted pregnancies and products of conception allows the identification of the data subjects, as defined in Article 4(1) GDPR. The risk of identification in this case is high, considering that the data reported on burials and made available on the online consultation service, can be compared or cross-referenced with other sources, or with contextual information held by third parties in the community or family context.

Consequently, the data processed is personal data. The controller did not have a lawful legal basis for such processing. This unlawful processing is of particular gravity if considered that the processing concerned health data, as defined in Article 4(15) GDPR.

Thus the DPA found a violation of Article 6 GDPR and Article 9 GDPR.

Controllership

Once it has been determined that the GDPR is applicable and that unlawful processing happened, the DPA considered that, since the activities of cemetery services are among the tasks of public interest specifically attributed to the municipality by law, the latter plays the role of data controller in relation to the processing of personal data connected with the performance of those tasks.

Violation of Article 5(a), (b), (C), (d) and (2) GDPR

Consequently, the controller is subject to the principle of accountability, as per Article 5(2) GDPR, and of privacy by design and by default, as per Article 24 GDPR. Thus, the DPA considered that, when the municipality receives documentation with personal data from the health company, it is required to process the data in compliance with the aforementioned principles. Additionally, the controller is subject to the principles of lawfulness, correctness and transparency, purpose limitation, data minimisation and accuracy, as per Article 5(1)(a), (b), (c) and (d) GDPR.

In relation to each of the mentioned principles, the DPA found the following:

The principle of accountability, as per Article 5(2) GDPR and of privacy by design and by default, as per Article 24 GDPR were breached as the municipality is not exempted from the need to carry out its own assessment on the data it receives from health authorities and facilities.

The principle of lawfulness, correctness and transparency, as per Article 5(1)(a) GDPR was breached due to the lack of legal basis for the processing.

The principle of purpose limitation, as per Article 5(1)(b) GDPR was breached as there is no specific and legitimate purpose to the data processing.

The principle of data minimisation, as per Article 5(1)(c) GDPR was breached as less-intrusive measures, as marking the burials with a simple code, are available.

The principle of accuracy, as per Article 5(1)(d) GDPR was breached as the data subjects’ surnames are not data related to the deceased.

Thus the DPA found a violation of Article 5(a), (b), (C), (d) and (2) GDPR.

Conclusion and Fine

Thus the DPA found a violation of Article 5 GDPR, Article 6 GDPR and Article 9 GDPR. The DPA deemed it appropriate to fine the controller €10,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

SEE ALSO Newsletter of February 28, 2025

[web doc. n. 10104750 ]

Measure of December 19, 2024

Register of measures
n. 799 of December 19, 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice president, Dr. Agostino Ghiglia and the lawyer Guido Scorza, members and Dr. Claudio Filippi, deputy secretary general;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”);

HAVING SEEN Legislative Decree no. 196 of 30 June 2003, “Code on the protection of personal data, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter, “Code”);

HAVING SEEN Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers assigned to the Guarantor for the protection of personal data, approved with resolution no. 98 of 4 April 2019, published in the Official Journal no. 106 of 8 May 2019 and in www.gpdp.it, web doc. no. 9107633 (hereinafter “Regulation of the Guarantor no. 1/2019”);

Having seen the documentation in the files;

Having seen the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, web doc. no. 1098801;

Rapporteur: lawyer Guido Scorza;

WHEREAS

1. Introduction

Following press reports, the Authority has learned that at the Vantiniano cemetery in Brescia there is an area reserved for the burial of fetuses and on whose graves are reported "in most cases the same name, "XX" and all different surnames", corresponding to the surnames of women who have terminated their pregnancy. From what is reported in the press articles, "these are fetuses or "abortive products" or "products of conception", "spontaneous or voluntary abortions (IVG) before the 20th week of gestation. And buried, almost always, without the women knowing anything about it".

Furthermore, according to what is reported in some articles, "everything from the recovery of fetuses in public and private hospitals to the funeral and burial" would be taken care of by voluntary or Catholic associations (see "XX, https://...; "XX, https://...; "XX, https://...; "XX, https://...

In addition, based on a preliminary check carried out by the Office on XX, on the Cemetery Services Portal of the Municipality of Brescia online which allows you to view the location of the burials of the deceased in the city cemeteries, by performing a search with the name "XX" followed by a surname, the results relating to the burials of fetuses corresponding to the name and surname searched for were displayed, together with the "date of birth-date of death" (coincident), the name of the cemetery, the location/number of burial, and the specification that they were "fetuses and stillborns" (http://prenotazionecimiteri.comune.brescia.it/public/defunto/cerca).

2. The preliminary investigation

2.1. Preliminary activities

On the basis of this information, an official investigation was initiated against the Municipality of Brescia (hereinafter, the “Municipality”). In response to a request for information from the Authority (note prot. no. XX of XX), the Municipality, with note prot. no. XX of XX, responded to the aforementioned request for information, declaring the following.

Firstly, with regard to the reference regulatory framework, in addition to the Presidential Decree of 10 September 1990 no. 285, containing the National Regulation of Mortuary Police, the Municipality stated that in the territory of the Lombardy Region the following apply:

- art. 11 of the Lombardy Region Regulation no. 6/2004 regarding funeral and cemetery activities;

- art. 8 of the Guidelines for necropsy medicine and mortuary police of the ATS Brescia, according to which authorizations for transport and burial, “before the completion of the 28th week […are the responsibility of the ATS]”.

With reference to the procedure used for the burial of fetuses coming from city hospitals, the Municipality declared:

- “[T]he first case concerns the cases in which the parents have not expressed the will to resort to burial of the fetus. In this case, the hospitals must deliver the fetuses and aborted products to the destination cemeteries with a procedure similar to that established for recognizable anatomical parts. […] the transport of recognizable anatomical parts takes place after completing the waste form. […] The second case concerns the cases in which the parents have expressed the will to resort to burial, also through the request for the celebration of individual funerals (so-called funeralini). In this case, the gynecology and/or forensic medicine departments of each hospital identify the remains of the predeceased with a gestation period between 1 and 28 weeks, […] and send the documents to the ATS to obtain authorization for transportation to the Vantiniano Cemetery […]. The authorization for transportation of the fetus for burial from the hospital to the Cemetery contains the name and surname attributed to the abortive product. […]”;

- “The documents sent by the Health Directorates to the ATS to draw up the burial authorization “consist of the “Notification of Stillbirth” and/or the “Request for burial of abortive products/stillbirths”;

- “To the “Notification of Stillbirth” form, hospitals do not attach the waste form, as [for] other recognizable anatomical parts. That is to say that […] hospitals channel fetuses towards a procedure that is quite distinct from that reserved for recognizable anatomical parts (and therefore fetuses for which no wish for burial has been expressed)”.

The Municipality also specified that “The documentation delivered […] to the Municipality therefore attributes a name and surname to the fetus, which the Municipality adheres to for the execution of cemetery operations”, and that the Municipal Offices “act downstream of a procedure initiated and governed upstream by the health facilities […and] the hospitals do not give indications to the Municipality on the decision possibly expressed by the parents regarding the fate of the abortive product”. Consequently, “the abortive products received by the Cemetery Service and to which the hospital documents attribute a name and surname are treated as if they were intended for burial”. In this context, “if the hospitals have not used the procedure for the burial of recognizable anatomical parts, the Municipality assumes in good faith that the entitled subjects have expressed the will to bury the fetus to which a name and surname are attributed”.

With reference to the processing of women’s personal data, the Municipality highlighted that “the name of women who have terminated their pregnancy is contained in the “stillbirth notification” forms drawn up by the hospital and delivered in copy to the Municipality for cemetery practice” and that “The legal basis for the processing of such data derives from the burial duties assigned to the Municipalities by art. 50 of Presidential Decree no. 285/1990”.

With regard to the processing of the data indicated on the burials and on the cemetery services portal, it was highlighted that “the personal data of the woman do not appear on the grave of the fetuses. […]. It should be noted […] that the surname […] does not necessarily coincide with that of the woman. It may coincide with that of the father and sometimes not even with that. It is not the Municipality that assigns the fetus either the name or the surname” and that “The affixing of the surname of the fetus indicated in the hospital documents on the tombs serves to identify who is buried there, as happens for any deceased person in the cemetery”.

Finally, with reference to the role possibly played by associations, which according to press reports, would deal with various activities, from “recovery of fetuses in public and private hospitals to funerals and burials” for cases in which the request for burial has not been presented by the parents or relatives, the Municipality declared that “No external subject (and therefore no association) carries out any operation in this context, nor does it receive any personal data of the interested parties”.

With the same note, the Municipality communicated that it had adopted, as a precaution, some initiatives, including the covering of existing plates and the indication of a reference code used for the management of single burials, the provision that the single burial of abortive products and fetuses will be subject to the presence of a form containing the parents' consent to the burial, as well as the elimination from the IT application (portal) accessible via the Internet of the possibility of accessing data relating to stillbirths and abortive products.

2.2. Assessments of the Department on the processing carried out and notification of the violation pursuant to art. 166, paragraph 5 of the Code of the initiation of the procedure and defense briefs

In relation to the above, with note prot. no. XX of XX, the Office, on the basis of the elements acquired and the facts that emerged following the investigative activity, notified the Municipality, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the provisions referred to in art. 58, paragraph 2, of the Regulation, since the processing of personal data, carried out on the burials of fetuses and on the portal of the cemetery services of Brescia, accessible via the internet for the search of the location of the burials and marked with the wording "fetus or abortive product" - occurred in the absence of an appropriate legal basis and in a manner not compliant with the principles of "lawfulness, fairness and transparency", "purpose limitation", "data minimization" and "accuracy" and, therefore, in violation of art. 5, part. 1, letters a), b) c) and d), 6 and 9 of the Regulation, as well as art. 2-ter, 2-sexies and 2-septies of the Code (as in force at the time of the facts, in the text prior to the amendments made by Legislative Decree no. 139 of 8 October 2021, converted, with amendments, by Law no. 205 of 3 December 2021).

In relation to these disputes, the Municipality of Brescia, the data controller, was invited to produce written defences or documents to the Guarantor, requesting, if necessary, to be heard by the Authority (art. 166, paragraphs 6 and 7, of the Code, as well as art. 18, paragraph 1, of Law 24 November 1981, no. 689).

With note of XX, prot. XX, the Municipality sent the Guarantor its written defences in relation to the notified violations in which, after having preliminarily recalled the regulatory framework already set out in the aforementioned note of XX, it declared the following:

- “[P]ursuant to art. 7 of Presidential Decree 285/1990 […] the legislation distinguishes four species that fall within the overall genus of Conceptae devoid of vitality […]. [S]tillborns are defined only as fetuses that have exceeded 28 weeks of gestation at the time of birth and that have been declared as such to the Civil Status Officer [for which] there is an obligation to register with the registry office, as provided for by art. 37 of Presidential Decree 3/11/2000 n. 396 […]. Stillborns and products of conception older than 20 weeks are formally buried, while products of conception younger than 20 weeks are buried at the request of the parents. […] If the gestation is less than 20 weeks and there is no request for burial by the parents, reference is made […] to the regulation governing the management of medical waste, pursuant to Presidential Decree n. 254 of 2003. […] In the Lombardy Region […], Regional Regulation 9 November 2004, n. 6 […] applies, which in art. 11 provides that [in all the cases mentioned above] “the health management informs the parents of the possibility of requesting burial […]”. [Furthermore] the regional regulation of Lombardy n. 1 of 2007 provides, in the absence of a request for burial, that aborted products of presumed gestational age less than 20 weeks are treated in analogy to what is provided for recognizable anatomical parts […]”

- “for […] stillborns […] the attribution of the name is carried out within the process of drawing up the birth certificate by the Civil Status Officer, pursuant to the aforementioned art. 29 of Presidential Decree n. 396/200”; .

- in cases “that do not fall into the category of stillborns, it should be specified that […] they have not been systematically attributed the first name “XX” […]. In such cases, it is almost certain that the attribution of a first name other than “XX” was made directly by the parents at the same time as the choice to proceed with the burial. […]”

- “analyzing the data […] relating to the period from 27.6.2007 to today [the] conceived children buried with the name XX” in the cemeteries of Brescia are n. 1,629 […], the “conceived children buried with another name” are n. 1,261 and only 1 case “the parents requested burial with a nameless gravestone”. “These data clearly indicate that approximately 45% of the Conceived Children buried do not have a first name “XX”, therefore with a name that in all probability was attributed by the parents who requested burial. […] […and] it is not at all automatic that the name “XX” allows us to identify with certainty a Conceived Child nor his mother. […]”;

- as regards, instead, the indication of the surname, "taking as a reference [...] the year 2019, as representative of existing practices [...] one hundred and sixty-six Conceived were buried; for each of them there is the prior authorization for burial issued by the ATS pursuant to art. 7, paragraph 4, of Presidential Decree no. 285/1990 [...]; the Conceived to whom the hospital structure attributed the father's surname are one hundred and twenty-seven, that is, over 75% [while those] to whom the hospital structure attributed the mother's surname are only thirteen, that is, less than 8% [...]; two authorizations [...] report a surname different from both that of the father and that of the mother; twenty-four […] do not have attached documentation from which it is possible to trace the father's or mother's surname”;[The] Municipality receives for burial purposes the Conceived Ones who have already been given a name and surname at the hospital facility of origin. As provided for by the Guidelines for necropsy medicine and mortuary police […of the ATS Brescia] “before the completion of the 28th week the competence for such authorizations is of the ATS […] Parents can request that […] they be buried with individual funerals”. Therefore, the name and surname that identifies the buried Conceived One is exclusively the personal one attributed to him, moreover not by the Municipality, but by the health facility. […] Moreover, even if we want to consider that the surname attributed to the Conceived One is, as is natural, that of the parent who requests the burial of the Conceived One, it must be considered that the possibility that this leads to an identification of the woman […] is not at all favored by the alleged “medium size” of the context that in this case would be relevant. It is indeed worth emphasizing that in the cemeteries belonging to the undersigned Municipality, Conceived Children are buried who [come] from a much larger territorial basin coinciding with the entire province, which has approximately 1,268,455 inhabitants […].;

- “Having clarified that the identification of the Conceived Children is not carried out by the Municipality but by the ATS […the] Conceived Children are periodically collected from the hospitals by municipal employees […] only on condition that the relevant authorization is delivered to them […].”;

- “[R]egarding the violation according to which, in the opinion of this Guarantor, […] the Municipality would have carried out a dissemination […] of data relating to women on the burials of fetuses, it is noted that […] the Municipality has strictly processed only the data of the Conceived Child and that in any case such processing has occurred for purposes that are connected to the choice of the parents to proceed with the burial of the Conceived Child […];

- “As for the identifiability of the pregnant woman through the data of the Conceived, the elements produced demonstrate that such identifiability is only hypothetical […]. The breadth of the territory to which the burial activity of the Conceived refers and the fact that the reference to the first name “XX” is not at all an element that certainly identifies the “abortive products” […] makes the identifiability process described by this Guarantor as merely hypothetical”;

- “the undersigned Municipality deduces that it cannot be stated that the identifiability is a hypothetical process even in relation to the actual connection between the data and an identified person, even in the presence of uncommon surnames. […] The mere coincidence of the same surname attributed to the Conceived compared to that of an identified woman is not in itself a sufficient element to identify a specific woman as the parent of the conceived and as a subject who has experienced the interruption of the pregnancy, whether voluntary or not;

- “the connection between the surnames of Concepito and the pregnant woman and the attribution to the latter of data that would concern the state of health of the latter appears completely hypothetical […] taking into account the fact that the causes of the lack of vitality of the Concepito may be multiple […]”;

- “As for the absence of a suitable regulatory basis, […] what is provided for in Article 70 of the Presidential Decree 1990 applies. […T]he presence of the name and surname attributed to the Concepito on the cemetery marker (and therefore on the Cimitero Web portal), derives from the application [of the cited regulation] and the Municipality considered that there were no elements that led to considering that this provision refers only to the deceased and stillborns. […] This regulation, providing for the burial of the Concepiti in the aforementioned articles 7 and 50, does not dictate any rule that provides for special treatment […] and different from the burial of the deceased […];

- “It should also be reiterated that the burials of the Conceived take place, as prescribed by law, at the request of the subjects who are entitled to formulate such a request […] and it must therefore be understood that the Surname of the Conceived is indicated following an express request from the pregnant woman or in any case from the subjects entitled to decide whether to proceed with the burial. The fact that the Municipality has autonomously arranged to proceed with the covering of the existing plates, indicating a simple code, “in cases in which there is no express declaration from the mother or parents in the records of the Cemetery Management that they want not only the burial, but also the plate with the identification data of the fetus” which in the opinion of this Guarantor would have significant value, in reality constitutes, in the current phase, a mere organizational choice prudentially adopted by the Municipality within the scope of its autonomy and certainly does not prove failure to comply with the law in relation to the conduct previously held in this regard”;

- “As for the violation of the prohibition on dissemination pursuant to art. 2-septies of the Code [it is] believed that the data processed in the management of the burial of the Conceived does not involve the processing of data belonging to particular categories of the pregnant woman, not even presumptively. The data present on the cemetery stones and available through the Cimitero Web portal concern exclusively the Conceived and the matching with the data of the pregnant woman would occur on a hypothetical basis and […] there would be no elements that could match this subject with hypotheses of voluntary interruption of pregnancy.”.

With the same note, the Municipality also reiterated, recalling what was already communicated with the note of the XX, that it had adopted specific precautions, including, in particular:

- the elimination “within the computer application accessible via the Internet (portal), [of] the possibility of accessing data relating to stillbirths and abortive products;

- the provision that “the burial in single form […] will be subject to the delivery to the Cemetery Service […] also […] of a form containing the consent to the burial expressed by the parents”;

- “in the case of single burial […], the name and surname attributed to the fetus are not indicated at the burial site, but a reference code is indicated which […], is confidentially linked to the personal data received from the hospitals. Any wishes expressed by the parents are reserved […]”;

- the provision “of meetings with both the hospitals and the ATS to verify the correctness of the procedures applied and the data processing […]”;

- “the covering of existing plates with the indication of a simple code, which will allow only the offices to identify the fetus/abortive product, for which there is no express declaration in the records of the Cemetery Management of the desire not only for burial, but also for the plate with the identification data of the fetus”.

Finally, it should be noted that the Municipality attached to the aforementioned report the documentation relating to three cases of fetal burial, consisting of the “transport and burial authorization” from the ASL, the “request for burial authorization” from the hospital facility and the “notification of stillbirth”.

2.3. Further investigations

Taking into account the elements acquired during the investigation and the measures that the Municipality declared to have adopted in order to overcome the critical issues contested by the Guarantor, the Office by accessing the online cemetery services portal accessible at the URL https://prenotazionecimiteri.comune.brescia.it/public/defunto/cerca, has ascertained that the Municipality also intervened on the aforementioned application. In this regard, the Municipality has excluded the accessibility to the generality of data attributable to stillbirths, abortive products or conception (in which the date of birth and death coincide). In fact, by typing the name “XX” combined with the initially verified surnames, as well as 6 additional different surnames, all the results previously displayed no longer appear. Of the few names currently available for consultation, none of them are marked with the wording “fetuses and stillbirths” previously used to indicate all these cases.

3. The regulatory framework

3.1. The legislation on the protection of personal data.

Pursuant to the Regulation, “personal data” means “any information relating to an identified or identifiable natural person (“data subject”)”. Furthermore, “an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (Article 4, paragraph 1, no. 1, of the Regulation). As regards special categories of personal data, the aforementioned categories include “data concerning health”, that is, “personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her state of health” (Articles 4, paragraph 1, no. 15, and 9 of the Regulation)

Pseudonymisation, on the other hand, means “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person” (Cons. 26 and Article 4, paragraph 1, no. 5, of the Regulation).

It is also recalled that the legislation on the protection of personal data does not apply in reference to “anonymous information, that is, information that does not refer to an identified or identifiable natural person or to personal data rendered anonymous in such a way as to prevent or no longer permit the identification of the data subject” (see Cons. 26 of the Regulation and WP29 Opinion 05/2014 on Anonymisation techniques, adopted on 10 April 2014).

On this point, it is highlighted that the data can be considered anonymous only if it does not in any way allow the direct or indirect identification of a person, taking into account all the means (economic, information, technological resources, skills, time) available to whoever (owner or other subject) tries to use such tools to identify a data subject.

In this regard, Opinion 05/2014 - WP 216 on anonymization techniques, adopted on 10 April 2014, specifies that the same cannot be considered to be achieved through the mere removal of the personal details of the interested party or replacement of the same with a pseudonymous code. An anonymization process cannot be effectively defined as such, in fact, if it is not suitable to prevent anyone using such data, in combination with the "reasonably available" means, from:

1. isolating a person in a group (so-called single-out);

2. connecting an anonymized data to data referable to a person present in a separate data set (linkability);

3. deducing new information referable to a person from an anonymized data (inference).

That said, the processing of personal data carried out by public bodies, including those concerning special categories of data, is lawful only if necessary "to comply with a legal obligation to which the data controller is subject" or "for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller", or when it is "necessary for reasons of substantial public interest on the basis of Union or Member State law, which must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject" (Article 6, paragraphs 1, letter c) and e), 2 and 3, as well as Articles 9, paragraph 2, letter g) of the Regulation and 2-ter and 2-sexies of the Code, in the text in force at the time of the facts, prior to the amendments made by Legislative Decree no. 8 of 8 October 2021. 139, converted, with amendments, by Law no. 205 of 3 December 2021).

The national legislator has defined the public interest as “relevant” for the processing “carried out by entities performing tasks of public interest or connected to the exercise of public powers” in the matters indicated, albeit not exhaustively, by art. 2-sexies of the Code, establishing that the related processing “is permitted if it is provided for […] by provisions of law or, in the cases provided for by law, by regulations that specify the types of data that can be processed, the operations that can be performed and the reason of significant public interest, as well as the appropriate and specific measures to protect the fundamental rights and interests of the data subject” (in the text in force at the time of the facts).

In this context, the processing of health data, given the particular sensitivity of this category of data, in order to be lawfully implemented, must also take place in compliance with "further conditions, including limitations" (art. 9, par. 4, of the Regulation), implemented in the national legal system with art. 2-septies of the Code, which has provided for an express "prohibition of dissemination", i.e. the possibility of giving "knowledge [...] to unspecified subjects, in any form, including by making them available or consulting" "health data" (art. 2-septies, paragraph 8; art. 2-ter, paragraph 4, letter b) of the Code in the text in force at the time of the facts).

The data controller is required, in any case, to comply with the principles of personal data protection, including the principle of “lawfulness, fairness and transparency”, “purpose limitation”, “data minimisation” and “accuracy” (Article 5, paragraph 1, letters a), b), c) and d) of the Regulation).

3.2. The specific relevant sector legislation.

With reference to the processing of women’s data in the context covered by this investigation, it should be noted, first of all, that information relating to the termination of pregnancy falls fully within the scope of data relating to health (Articles 4, paragraph 1, no. 15, and 9, as well as recital 35 of the Regulation).

This is true not only in cases where, within the procedure for the termination of pregnancy, the sector legislation provides for the collection of information on the woman's state of health (see Law 22 May 1978, no. 194, "Rules for the social protection of maternity and on the voluntary termination of pregnancy", which provides for the voluntary termination of pregnancy when "the continuation of the pregnancy, childbirth or maternity would entail a serious danger to her physical or mental health, in relation to her state of health" (art. 4), "the pregnancy or childbirth entail a serious danger to the woman's life" or "pathological processes are ascertained, including those relating to significant anomalies or malformations of the unborn child, which determine a serious danger to the physical or mental health of the woman" (art. 6), but also in all other cases (voluntary termination or spontaneous abortion), since it is in any case an event connected to a "provision of health care services" (art. 4, par. 1, n. 15, of the Regulation). In confirmation of this framework, art. 19 of Legislative Decree 26 March 2001, n. 151, provides that “The interruption of pregnancy, spontaneous or voluntary, in the cases provided for by articles 4, 5 and 6 of Law 22 May 1978, n. 194, is considered to all intents and purposes as an illness” (see also provision of the Guarantor no. 334 of 4 June 2015, available at www.gpdp.it, web doc. no. 4130998; provisions no. 163 of 27 April 2023, web doc. 9900808, no. 164 of 27 April 2023, web doc. no. 9900826, no. 165 of 27 April 2023, web doc. 9900503).

The law of 22 May 1978, no. 194 cited above has provided for a rigorous confidentiality regime to protect the woman’s right to anonymity. In addition to the criminal sanction, provided for those who "having become aware of it for professional or official reasons, reveal the identity - or in any case divulge information suitable to reveal it - of someone who has resorted to the procedures or interventions provided for by this law" (art. 21), the woman's identity is also protected in relation to the fulfillment of information obligations within the same healthcare context ("The hospital, nursing home or outpatient clinic [...] are required to send to the provincial doctor with jurisdiction over the territory a declaration [...] of the intervention itself and of the documentation on the basis of which it was carried out, without mentioning the woman's identity", art. 11) and to "respect for the dignity and privacy of the woman" (see art. 5 of the aforementioned law no. 194).

The regulatory provisions, which provide for enhanced protection for the processing of data relating to women who have had an abortion, fall within the specific sector provisions safeguarded by art. 75 of the Code. The aforementioned confidentiality regime has been reiterated several times by the Guarantor in various interventions, qualifying such data among those subject to "greater protection of anonymity" (opinion on a draft decree on the certificate of assistance at childbirth, of 1 March 2000, web doc. no. 1085431; opinion on a draft decree on the electronic health record, of 22 May 2014, web doc. no. 3230826; Guidelines on the Health Record, of 4 June 2015, web doc. no. 4084632).

With regard to the burial of fetuses and abortive products, art. 7 of the Presidential Decree September 10, 1990, no. 285, approving the Mortuary Police Regulation, provides that "for the burial of aborted products of presumed gestational age from 20 to 28 complete weeks and of fetuses that have presumably completed 28 weeks of intrauterine age [...], transport and burial permits are issued by the local health unit. At the request of the parents, products of conception presumed to be younger than 20 weeks may also be collected in the cemetery using the same procedure". In the aforementioned cases, "relatives or their representatives are required to submit, within 24 hours of the expulsion or extraction of the fetus, a request for burial to the local health unit accompanied by a medical certificate indicating the presumed gestational age and weight of the fetus". Art. 50 also provides that "The following must be received in cemeteries when no other destination is requested: [...] d) stillborn babies and the products of conception referred to in art. 7”.

Article 52, paragraph 2, of the aforementioned Regulation then provides that the following be entered in a register daily: “a) the burials that are performed, specifying the name, surname, age, place and date of birth of the deceased, as shown in the authorization act referred to in Article 6, the year, day and time of the burial, the Arabic number on the gravestone and the serial number of the burial bill; b) the personal details, as above, of the people whose bodies are buried, with an indication of the site where they were placed”. According to Article 53, paragraph 2, “A copy of the registers must be delivered, at the end of each year, to the municipal archives, with another copy remaining with the custodian service”. Finally, with regard to the methods of identifying the burial, Article 70 provides that “Each grave in the burial fields must be marked, by the municipality, with a marker […] bearing a progressive number. On the marker, by the municipality, a plate of unalterable material will be applied with the name and surname and the date of birth and death of the deceased”.

The regulatory framework of reference also includes the Lombardy Regional Law of 30 December 2009, n. 33, “Consolidated text of regional laws on health”, art. 75 of which provides that “the Municipality gives burial: […] c) to stillborns and products of conception, exclusively upon explicit request of the woman or of the person entitled to make the decision, in cases where the birth or abortion took place in a health facility located in the municipal territory”.

In addition, art. 11 of the Regional Regulation of 9 November 2004, n. 6, “Regulations on funeral and cemetery activities” – now repealed by art. 34 of the Regional Regulation of 14 June 2022, no. 4 – provides that “1. Authorization for the burial or entombment of cadavers and stillborns is issued in accordance with current national legislation. 1-bis. For aborted products of presumed gestational age between twenty and twenty-eight complete weeks and for fetuses that have presumably completed twenty-eight weeks of intrauterine age, as well as for products of conception of presumed age less than twenty weeks, the health management informs parents of the possibility of requesting burial. 1-ter. The ASL, informed by the health management by sending the request for burial accompanied by the presumed age of the fetus or aborted product, issues the transport and burial permit directly to the municipality where the event occurred. 1-quater. In the absence of a request for burial, the provisions for recognizable anatomical parts shall be applied analogously. 2. […] the recognizable anatomical parts shall be sent for burial according to the methods indicated by the municipality where the health facility where the operation was carried out is located […], with the costs borne by the latter”. Article 17 of the aforementioned Regional Regulation, regarding the identification of burials, provides that “1. Each burial pit, burial niche, tomb, niche is marked by a gravestone, tombstone or other support, […] on which are reported […] the indication of the name, surname, date of birth and death, unless expressly requested otherwise by the deceased, as well as a progressive alphanumeric identifier provided by the cemetery reception service. 2. The gravestone, tombstone or other support, placed by family members or other interested parties, must comply with the rules and conditions established by the municipal regulation”.

Finally, Article 8 of the Guidelines for necropsy medicine and mortuary police of the ATS Brescia, provides that authorizations for transport and burial, "before the completion of the 28th week [are the responsibility of the ATS] with the cost being borne by the Structure where the event occurred. In this case, the remains are identified individually, enclosed in a single box of biodegradable material for burial and incineration and in a double container for entombment. Parents can request that products under the aforementioned 28th week of gestation be buried with individual funerals". Art. 7 provides that "The recognizable anatomical parts [which also include fetuses for which single burial has not been requested] must be delivered to the cemetery of the Municipality where the event occurred, in single biodegradable boxes with accompanying documentation of recognition issued by the territorially competent ASST upon request of the Institute [hospital] where they were produced. The final treatment is decided by the Municipality. However, the legitimate owner is allowed to make an explicit request to the body that produced it and to the ASST for any individual burial, entombment or incineration”.

4. Outcome of the investigation.

Having taken note of what was represented by the Municipality in the documentation in the files and in the defense briefs, of the regulatory framework mentioned above and of what emerged in the investigation, the preliminary assessments of the Office are confirmed, within the limits of the following reasons.

On this point, it is preliminarily noted that art. 7 of Presidential Decree 285/1990, with respect to the burial of fetuses, regulates three distinct cases:

“stillborns”, for which burial is always foreseen, with reference to the provisions relating to the deceased with regard to registration in the civil status registers and authorization for burial (art. 7, paragraph 1);

"abortive products", which are between 20 and 28 weeks, or beyond 28 weeks of gestation - provided they are not declared "stillborn" - for which burial is in any case foreseen, upon request of the "relatives or their representative" - to be presented to the ASL within 24 hours - or upon request of the health facility - after the aforementioned deadline (art. 7, paragraphs 2 and 4);

"products of conception", younger than 20 weeks, which can be buried only upon request of the "parents", in the absence of which, they are considered special hospital waste and destined for thermal destruction (art. 7, paragraph 3).

That said, the cases of stillborn children, for which the authorization for burial is issued by the civil status officer, after registration in the relevant registers, as well as cases relating to abortive or conception products for which the parents or relatives have requested burial, pursuant to art. 7, paragraphs 2, 3 and 4, of Presidential Decree 285/1990, possibly with single funerals, and have indicated to the cemetery services the data to be reported on the burial; in this case, the choice to indicate a name is left to the relatives (see art. 17 of the aforementioned Regional Regulation, "The gravestone, tombstone or other support, placed by family members or other interested parties, must comply with the rules and conditions established by the municipal regulation").

The subject of this investigation concerns, instead, the activity of disseminating the data reported on the burials and found on the cemetery services portal, relating to abortive or conception products for which the relatives have not requested burial nor have indicated the data to be reported on the gravestone, tombstone or other support.

In this regard, the indication of the surname of the woman or of the husband or partner, next to the first name "XX" together with the date of the abortion (reported as the coinciding date of birth and death), can allow, through comparison, cross-referencing with other sources, or contextual information in the possession of third parties, the identification of the woman who performed the abortion.

During the investigation, the Municipality did not prove that in all cases in which the burials are marked with elements that refer to the identity of the woman (first name "XX" together with the surname of the woman or of the husband or partner together with the date of the abortion), the choice of the Municipality to indicate such data on the burials - as reported in the authorization documentation sent by the ASL - is attributable to a specific will of those entitled to proceed with the burial and to indicate that data. Their dissemination, as mentioned, was carried out both on the burials and through the online service for consulting the location of the deceased buried in the cemeteries of the Municipality.

As previously mentioned, personal data means "any information relating to an identified or identifiable natural person". The regulatory framework referred to above, therefore, applies not only in the case in which the data subject is "identified" but also when the same is "identifiable", pursuant to art. 4, paragraph 1, no. 1, of the Regulation. To establish the identifiability of a person, it is appropriate to consider "all the means" that not only the data controller, but also third parties, can reasonably use to identify said natural person; to ascertain the reasonable probability of use of such means, it is necessary to consider all objective factors, including the costs and time necessary for identification (recital 26, of the Regulation). For the purposes of assessing the “risk of identification”, it is therefore necessary to take into account “all means”, the new technologies used, the nature, object, context and purposes of each type of processing (see also cons., 84, 89, 93 and 95 of the Regulation).

That said, the choice to indicate “XX” plus the surname of the woman, or of the husband or partner, may allow the identification, albeit indirectly, of the woman who performed the abortion. This eventuality is even more likely in the case of particular, foreign or uncommon surnames in the territorial context of reference. For these reasons, the objection according to which "the identifiability of the pregnant woman through the data of the Conceived [is] hypothetical" cannot be accepted, based on the observation that "The size of the territory to which the burial activity of the Conceived refers and the fact that the reference to the first name "XX" is not at all an element that certainly identifies the "abortive products" [...] makes the identifiability process described by this Guarantor as merely hypothetical".

With regard to the identifiability of the woman, the Municipality also represented that:

- the first name "XX" is used to indicate this type of burial in 55% of cases, while in the remaining 45% of cases, a different first name is indicated;

- with regard to the attribution of the surname, considering the year 2019, “166 conceived children were buried”, the cases in which “the hospital structure attributed the father’s surname are 127, that is, over 75%”, those to which “it attributed the mother’s surname […] are only 13, that is, less than 8%”, while in 24 cases out of 166 (in 14.5%), the documentation sent by the ASL to the Municipality does not allow “tracing the father’s or mother’s surname”.

In this regard, as already highlighted, even the indication of the husband’s or partner’s surname, next to the first name “XX”, can allow the identification of the woman who performed this abortion. Contrary to what the Municipality represents, the risk of identification must be considered high, considering that the data reported on the burials and also made available on the online consultation service, can be compared or cross-referenced with other sources, or in any case with contextual information in the possession of third parties within the community or the more or less large family context of belonging. This, also considering the narrow and circumscribed territorial catchment area of reference, limited to the Province and not to a wider regional or national scope.

For this reason, the circumstance cited by the Municipality that the indication of the women's surname would concern only a small part of the cases, would be relevant, at most, in order to the greater or lesser risk of identification (generally higher in the case in which the woman's surname appears), and not in order to assess the existence of the violation, which could in practice also concern a very small number of women (in addition to those brought to the attention of the press by the interested parties through their lawyer).

Consequently, the related data processing is carried out in contrast with the regulations on the protection of personal data, as it was carried out in the absence of a regulatory basis, and in violation of the ban on the dissemination of health data (articles 5, 6 and 9 of the Regulation and 2-ter, 2-sexies and 2-septies, paragraph 8, of the Code, in the text in force at the time of the facts).

It should be recalled that the information relating to the termination of pregnancy, based on the definition of art. art. 4, par. 1, no. 15, of the Regulation, constitutes in all cases data on health, since it is in any case an event connected to a "provision of health care services". Therefore, the Municipality's observation that the connection between the event of the termination of pregnancy and the woman's state of health would be merely hypothetical, and would not necessarily be a health data, cannot be accepted, since "the causes of the lack of vitality of the Conceived Child can be multiple" as well as "the combination of the failure to complete the pregnancy with the hypothesis of a voluntary termination ordered by the will of the woman" (see the memory of XX, p. 22). The information on the termination of pregnancy, as already highlighted, falls within the health data, finding, in all cases, the connection with a "provision of health care services", regardless of the connection of this event with the "physical and mental health of the woman" or with the relevance or otherwise of the will of the woman.

From a different perspective, the objection that "the Municipality [...has] rigorously processed only the data of the Conceived" and that "The data present on the cemetery stones and available through the Cimitero Web portal concern exclusively the Conceived and the matching with the data of the pregnant woman would occur on a hypothetical basis" cannot be accepted (see the XX document, pp. 18 and 28). The attribution of a name and surname is provided for only in the case of "stillborns" for which the formation of a birth certificate is required (articles 29 and following of Presidential Decree no. 396/2000). The name and surname concern the conceived ("stillborn") only in such cases. According to the legal system, every person has the right to the name attributed to them by law, and the name includes the name and surname (article 6, civil code); registration in the civil status records (formation of the birth and death certificate) is required, as mentioned, only for stillborns, for whom the burial authorization is issued by the civil status officer, with reference to the provisions relating, in general, to the "deceased" (art. 7, paragraph 1, and art. 6 of Presidential Decree 285/2000). For abortive and conception products, however, registration in the civil status records is not required, the burial authorization is issued by the competent health authority -- and the rules governing such authorization do not require the indication of a name and surname (art. 7, paragraphs 2, 3 and 4 of the aforementioned Presidential Decree 285/2000).

On the other hand, it should be considered that the regional legislation, specifically art. 11, paragraph 1-quater, of the regional regulation of 9 November 2004, n. 6, in force at the time of the facts, provided that "In the absence of a request for burial [in all cases], the provisions for recognizable anatomical parts are followed in analogy", which "are sent for burial according to the methods indicated by the municipality", thus extending the provision for burial in the absence of a request from the parents - provided for at a national level only for abortive products between 20 and 28 weeks and beyond (art. 7, paragraph 2, of Presidential Decree 285/1990) - also to the products of conception, under 20 weeks, with an automatic mechanism whose compatibility with the national regulatory framework is not subject to evaluation by the Guarantor. For such cases, art. 7 of the aforementioned regional regulation also provides that "they must be delivered to the cemetery of the Municipality where the event occurred, in single biodegradable boxes with accompanying identification documentation issued by the territorially competent ASST upon request of the [hospital] Institute where they were produced". The same provision specifies that “The final treatment is decided by the Municipality”, and that the possibility for relatives – provided for by national legislation – “to make an explicit request to the [hospital] Institution and to the ASST for possible individual burial, entombment or incineration” remains in place (art. 7 of the same regional regulation).
In this context, the Municipality of Brescia declared that the cemetery services “act downstream of a procedure initiated and governed upstream by the health facilities [and] the hospitals do not give indications to the Municipality on the decision possibly expressed by the parents regarding the fate of the abortive product”. Consequently, “the abortive products received by the Cemetery Service and to which the hospital documents attribute a name and surname are treated as if intended for burial” (see note from the Municipality of XX, p. 5) and the Municipality “is required to provide, on the basis of the data it receives from the ATS” (see memorandum from the Municipality of XX, p. 17).

In this regard, although the choice of the name "XX" and the surname to identify the fetuses is not made by the Municipality but, upstream, by the ATS, the use of names to identify them - when this does not occur on the basis of an explicit request from the parents - constitutes an exclusive choice of the Municipality. Since the activities of cemetery services are among the tasks of public interest specifically attributed to the Municipality by law, the latter plays the role of controller in relation to the processing of personal data connected to the performance of these tasks.

In application of the principle of accountability (articles 5, par. 2, and 24 of the Regulation), when the Municipality receives from the Health Authority the documentation with the characteristics described above, it is required to process the data in compliance with the principles applicable to the processing of personal data provided for by the Regulation, and in particular those of "lawfulness, fairness and transparency", "purpose limitation", "data minimization" and "accuracy" (article 5, par. 1, letters a), b), c) and d), of the Regulation). The Municipality, therefore, cannot consider itself exempt from the need to carry out its own assessment regarding the methods of processing the data it receives from health companies and health facilities.

Therefore, the statement that the Municipality should limit itself to using the data as transmitted by the health companies, without carrying out any evaluation, cannot be shared. This, above all, taking into account the practice in use at the ATS and the hospitals of Brescia to indicate, always and in any case, in the authorization documentation a name and surname for the fetus - a practice that the broader investigation carried out by the Office did not find in other verified structures - even in the absence of a specific request by the woman or the family members.

The need to indicate a name and surname to identify the products of abortion and conception cannot, however, be deduced from the provisions of Presidential Decree 285 of 2000 cited in the defense briefs by the Municipality: nor from art. 52, which provides that the cemetery registers must report daily the burials performed "specifying the name, surname, age, place and date of birth of the deceased, as shown in the authorization act referred to in art. 6”, nor by art. 70, which provides that on the memorial stone, in addition to “a progressive number”, a plate must be applied with the “indication of the name and surname and the date of birth and death of the deceased”. In fact, these provisions, by requiring the indication of the “name, surname, age and date of birth of the deceased” and, also, the “date of death”, recall art. 6, of the aforementioned Presidential Decree 285 of 2000, concerning the authorization under the jurisdiction of the civil status officer, and not also the authorization referred to in art. 7, paragraph 4, under the jurisdiction of the health authority. All the aforementioned provisions take into consideration only the “deceased” and the “stillborn”, for which the burial authorization issued by the registrar reports the data as they appear in the civil registry (articles 7, paragraph 1, and 6 of Presidential Decree no. 285 of 2000, which refers to articles 74 and 141 of Royal Decree no. 1238 of 9 July 1939 (repealed); now articles 34 and 74 of Presidential Decree no. 396 of 3 November 2000).

In conclusion, the regulatory framework cited above does not provide that, when the request for burial comes from the health facility, the abortive products and the products of conception – assimilated to the anatomical parts recognizable by regional legislation – must be identified by name and surname. Contrary to what the Municipality states, which believes it must "provide, on the basis of the data it receives from the ATS" also to mark the burials, the absence of a specific regulatory provision in this sense, and therefore of an adequate legal basis, far from legitimizing the processing of the data in question - with analogous application of what is provided for the deceased - precludes the very possibility of using such data.

To justify this practice, the Municipality also highlighted that "the ATS issues the authorization for the burial of the Conceived only in the face of an express manifestation of will by the parents" and that "it cannot be presumed [...] that the burials of the Conceived can take place without the explicit request of the woman or of whoever is entitled to the decision".

This statement, in addition to being denied by specific cases brought to the attention of the press by the interested parties, is not proven in the documents by adequate documentation. Furthermore, it is statistically unlikely that all the burials of fetuses carried out in the cemeteries of Brescia took place exclusively at the request of the parents or relatives; this is especially true in a Region that, in derogation of what is foreseen at the national level, provides for burial in the absence of a request from the parents, not only for abortive products between 20 and 28 weeks, but also for products of conception under 20 weeks.

In addition, the broader investigation carried out by the Office on other cases of dissemination of women's data on the burials of fetuses, has highlighted that the different procedures envisaged in the case of a request for burial made by the parents or a request made by the hospital structure, are reflected in the document management of the cemetery services. In the first case, there is the request presented to the Health Authority by the parents, who, having obtained the authorization, interface with the cemetery services for the further procedures necessary for organizing the funeral and the single burial. If the parents choose a name to be indicated on the burial, this may be indicated to mark the burial, provided that "The memorial stone, tombstone or other support, placed by family members or other interested parties, must comply with the rules and conditions established by the municipal regulations". In the absence of a request from the parents, however, practice has shown that the burial authorization is issued by the Health Authority even several months after the request from the hospital, and is transmitted or delivered to the municipal cemetery services that periodically take care of the collection and transport of the boxes containing the fetuses together with the aforementioned authorization documentation.

In this regard, the Municipality of Brescia has produced documentation in its files relating to three cases of burial authorization.

Since the possibility that the burial may not be carried out is not contemplated by regional legislation, the documentation provides for certification of compliance with the information obligation referred to in art. 11 of the aforementioned Regional Regulation and the possibility of acquiring (any) parental preferences regarding the chosen cemetery and the management methods (e.g. burial, cremation) or to indicate "no preference".

The first two hypotheses concern authorizations for the burial of products of conception under 20 weeks at the request of the health facility and not of the parents; in the first, in fact, the latter have not expressed "no preference" regarding the methods (burial/cremation) and the place of burial, which were chosen by the hospital facility; in the second, "the parent has renounced to perform the funeral rite and therefore the health facility will follow the following procedures: a. burial as recognizable anatomical parts (given name “XX [omissis]”. In a third case, the ATS authorization and the “notification of stillbirth” were produced, but not the request for burial from the health facility.

Furthermore, from the dates on the aforementioned documents, it can be seen that the ATS authorizations were issued some time after the request from the health facility (in two cases after more than three months, in the other after 10 days). Also for this reason, the representation made by the Municipality regarding the fact that the burial took place at the parents’ request cannot be accepted, given that the same, in light of art. 7 of Presidential Decree 285/1990, must be made “within 24 hours of the expulsion or extraction of the fetus”.

Furthermore, from the aforementioned documentation, it is not clear that the name was chosen by the parents nor is any request to indicate the name and surname on the cippo. It cannot therefore be considered proven that, as stated by the Municipality, the burial would take place "only in the presence of the parents' authorization" and that "in this case the Municipality is required to provide, on the basis of the data it receives from the ATS".

As proof of the fact that the documentation sent to the Municipality by the ATS did not clearly report the parents' wishes, it should be noted that the Municipality, already prior to the start of this investigation, with the note of XX, communicated to the health directorates of the hospitals and clinics of the city of Brescia that "With reference [...] to the repeated articles that have appeared [...] in the national and local press, the cemetery directorate of the Municipality of Brescia - pursuant to and for the purposes of art. 11 of Regional Regulation no. 6/2004 on funeral and cemetery activities, - informs that from next November the burial of aborted products in a grave will only take place with the express consent of the parents, whose will these hospitals will have to collect and communicate specifically in the attachment to the notification form of pre-deaths" (see attachment 4 to note of XX).

From another perspective, it is noted that the choice to indicate the woman's surname (or that of her husband or partner) to mark the burial of a fetus constitutes a treatment that does not comply with the principle of "accuracy" (art. 5, par. 1, letter d of the Regulation), as such data is in no way comparable to the "data of the deceased"; art. 70 of Presidential Decree 285/1990 refers exclusively to the data of the "deceased", and the regulatory framework cited several times does not provide for the attribution of a name and surname to the fetus.

Finally, given that the purpose allegedly pursued by indicating the data is to trace and allow the identification of the burial place of the fetuses, this purpose can be achieved with other methods, as demonstrated, among other things, by the measures subsequently implemented by the Municipality, consisting in covering the existing plates with the indication of a code, aimed at allowing "only the offices to identify the fetus/abortive product, for which there is no express declaration in the records of the Cemetery Management of the desire not only for burial, but also for the plate with the identification data of the fetus".

Given the possibility of marking the burials in question with a simple code, the choice to indicate the name and surname also conflicts with the principle of "minimization", which provides that the data must be "adequate, relevant and limited to what is necessary with respect to the purposes for which they are processed" (art. 5, par. 1, letter c) of the Regulation). Furthermore, such processing, being devoid of a specific and legitimate purpose – fully achievable without the indication of data – also conflicts with the principle of “limitation of purposes” (art. 5, par. 1, letter b) of the Regulation).

For the reasons set out above, the processing of the data subject to this proceeding is carried out in the absence of an adequate legal basis (articles 6 and 9 of the Regulation; articles 2-ter and 2-sexies of the Code, as in force at the time of the facts), and in a manner not compliant with the principles of "lawfulness, fairness and transparency", "purpose limitation", "data minimization" and "accuracy", in violation of art. 5, part. 1, letters a), b) c) and d) of the Regulation, as well as in violation of a specific prohibition (art. 2-septies, paragraph 8 of the Code).

5. Conclusions.

In light of the assessments referred to above, it is noted that the declarations made by the data controller during the investigation ˗ for the truthfulness of which one can be held accountable pursuant to art. 168 of the Code ˗, although worthy of consideration, do not allow to completely overcome the findings notified by the Office with the act of initiation of the proceeding and are insufficient to allow the archiving of the present proceeding pursuant to art. 14, paragraph 1, of the Regulation of the Guarantor n. 1/2019 since none of the cases provided for by art. 11 referred to therein apply.

Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by the Municipality is noted, for having carried out the processing of personal data in violation of art. 5, par. 1, letters a), b), c) and d), 6 and 9, of the Regulation as well as art. 2-ter, 2-sexies and 2-septies, paragraph 8 of the Code, as in force at the time of the facts.

Violation of the aforementioned provisions makes the administrative sanction provided for by art. 83, par. 5, of the Regulation, pursuant to Articles 58, paragraph 2, letter i), and 83, paragraph 3, of the Regulation itself, as also referred to in Article 166, paragraph 2, of the Code.

Having taken note of what emerged during the investigation phase and taking into account the measures adopted by the Municipality to remedy the contested violations and ensure compliance of the processing with the legislation on the protection of personal data - covering of existing plates and limiting access to such data from the online consultation service and elimination of the wording "fetuses and stillbirths", use of a code for the identification of burials, provision of adequate documentation clearly stating the request for burial by relatives - the conditions for the adoption of further corrective measures pursuant to Article 58, paragraph 2, of the Regulation

6. Adoption of the injunction order for the application of the administrative pecuniary sanction and accessory sanctions (articles 58, par. 2, letters i and 83 of the Regulation; art. 166, paragraph 7, of the Code).

The Guarantor, pursuant to arts. 58, par. 2, letters i) and 83 of the Regulation as well as art. 166 of the Code, has the power to “impose an administrative pecuniary sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each individual case” and, in this context, “the [Guarantor] Board adopts the injunction order, with which it also provides for the application of the accessory administrative sanction of its publication, in full or in extract, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code” (Article 16, paragraph 1, of the Guarantor Regulation no. 1/2019).

Taking into account that the violation of the above provisions by the Municipality occurred as a result of conduct that can be considered unitary (same treatment or treatments linked to each other), Article 83, paragraph 1 applies. 3, of the Regulation, according to which the total amount of the administrative pecuniary sanction does not exceed the amount specified for the most serious violation. Considering that, in the case in question, all violations are subject to the sanction provided for by art. 83, par. 5, of the Regulation, as also referred to in art. 166, paragraph 2, of the Code, the total amount of the sanction is to be quantified up to EUR 20,000,000 (twenty million/00).

The aforementioned administrative pecuniary sanction imposed, depending on the circumstances of each individual case, must be determined in amount taking into due account the elements provided for by art. 83, par. 2, of the Regulation.

With specific regard to the particular nature, seriousness and duration of the violation, it is necessary to consider the specific nature of the processing concerning the dissemination of personal data, in the terms set out in the motivation, both by means of an indication on the burials and on the institutional web portal of the Municipality, by consulting the online service (art. 83, par. 2, letter a), of the Regulation), taking into account, in a favorable sense, the circumstance that the dissemination did not concern the complete personal details of the woman. It is believed that, however, the sensitivity of the data processed must be taken into consideration, being related to health in relation to which a rigorous confidentiality regime is also provided (art. 83, par. 2, letter g), of the Regulation).

In favor of the Municipality, however, the negligent nature of the violation must be considered, given the initial erroneous belief by the Municipality regarding the existence by the "entitled subjects [... of the manifestation of] the will to bury the fetus to which a name and surname are attributed" (art. 83, par. 2, letter b) of the Regulation).

In light of these circumstances, it is believed that, in the case in question, the level of severity of the violation committed by the data controller can be considered high (see European Data Protection Board, "Guidelines 04/2022 on the calculation of administrative fines under the GDPR" of 23 May 2023, point 60).

That said, it is believed that, for the purposes of quantifying the sanction, the circumstance that there are no previous relevant violations committed by the data controller must be taken into account, in a manner favorable to the Municipality (Article 83, paragraph 2, letter e), of the Regulation) as well as the degree of cooperation shown by the data controller with the supervisory authority in order to remedy the violation and mitigate its possible negative effects, taking into account that the data controller has adopted measures such as covering existing plates and indicating a code for identifying burials, providing adequate documentation unequivocally stating the request for single burial by relatives, as well as a limitation of the data accessible via the computer application and the elimination of the wording "fetus or stillborn" (Article 83, paragraph 2, letter f, of the Regulation).

In light of the above elements, assessed as a whole, it is deemed appropriate to determine the amount of the pecuniary sanction in the amount of Euro 10,000.00 (ten thousand/00) for the violation of Articles 5, paragraph 1, letters a), b), c) and d), 6 and 9, of the Regulation as well as Articles 2-ter, 2-sexies and 2-septies, paragraph 8 of the Code, as in force at the time of the facts, as an administrative pecuniary sanction deemed, pursuant to Article 83, paragraph 1, of the Regulation, effective, proportionate and dissuasive.

In this context, it is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Regulation of the Guarantor no. 1/2019, it is necessary to proceed with the publication of this chapter containing the injunction order on the Internet site of the Guarantor.

This is in consideration of the sensitivity of the data subject to the violation, taking into account that the investigation concerned, in the terms illustrated in the reasons, an unlawful processing of data relating to health.

Finally, it is noted that the conditions set out in art. 17 of Regulation no. 1/2019 exist.

CONSIDERING ALL THE ABOVE, THE GUARANTOR

declares, pursuant to art. 57, par. 1, letter f), of the Regulation, the unlawfulness of the processing carried out by the Municipality of Brescia for the violation of art. 5, par. 1, letters a), b), c) and d), 6 and 9, of the Regulation as well as art. 2-ter, 2-sexies and 2-septies, paragraph 8 of the Code, as in force at the time of the facts, in the terms set out in the reasons;

ORDERS

pursuant to art. 58, par. 2, letter f), i) and 83 of the Regulation, as well as art. 166 of the Code, to the Municipality of Brescia, with registered office in Piazza Loggia n. 1, 25121 Brescia (BS) C.F. 00761890177, to pay the total sum of €10,000.00 (ten thousand/00) as a pecuniary administrative sanction for the violations indicated in the motivation. It is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the sanction imposed;

pursuant to art. 58, par. 1, letter. a), of the Regulation and 157 of the Code, to confirm to this Authority, within thirty days of notification of this provision, that following the intervention on the application of the Portal of online cemetery services, at present, only the locations of stillbirths, as well as abortive products or conception for which the relatives expressly request single burial and name in the Municipality's records are available for consultation;

ORDERS

the Municipality of Brescia:

to pay the total sum of Euro 10,000.00 (ten thousand/00) in the event of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, according to the methods indicated in the attachment, within thirty days of notification of this provision, under penalty of adopting the consequent executive actions pursuant to art. 27 of Law no. 689/1981;

ORDERS

pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Regulation of the Guarantor no. 1/2019, the publication of the injunction order on the website of the Guarantor;

pursuant to art. 154-bis, paragraph 3 of the Code and art. 37 of the Regulation of the Guarantor no. 1/2019, the publication of this provision on the Authority's website;

pursuant to art. 17 of the Regulation of the Guarantor no. 1/2019, the annotation of this provision and of the measures adopted pursuant to art. 58, paragraph 2, of the Regulation, in the internal register of the Authority, provided for by art. 57, paragraph 1, letter u), of the Regulation.

Pursuant to Articles 78 of the Regulation, 152 of the Code and 10 of Legislative Decree no. 150/2011, an appeal against this provision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 19 December 2024

THE PRESIDENT
Stanzione

THE REPORTER
Scorza

THE DEPUTY SECRETARY GENERAL
Filippi

SEE ALSO Newsletter of 28 February 2025

[web doc. no. 10104750 ]

Provision of 19 December 2024

Register of provisions
no. 799 of 19 December 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Dr. Claudio Filippi, Deputy Secretary General;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”);

HAVING SEEN Legislative Decree no. 30 June 2003 196 containing the “Personal Data Protection Code, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and which repeals Directive 95/46/EC (hereinafter “Code”);

SEEN Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Data Protection Authority, approved with resolution no. 98 of 4 April 2019, published in the Official Journal no. 106 of 8 May 2019 and in www.gpdp.it, web doc. no. 9107633 (hereinafter “Data Protection Authority Regulation no. 1/2019”);

Having seen the documentation in the files;

Having seen the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor n. 1/2000 on the organization and functioning of the office of the Guarantor for the protection of personal data, web doc. n. 1098801;

Rapporteur: lawyer Guido Scorza;

WHEREAS

1. Introduction

Following press reports, the Authority has learned that at the Vantiniano cemetery in Brescia there is an area reserved for the burial of fetuses and on whose graves are reported "in the majority of cases the same name, "XX" and all different surnames", corresponding to the surnames of women who have terminated their pregnancy. From what is reported in the press articles, "these are fetuses or "abortive products" or "products of conception", "spontaneous or voluntary abortions (IVG) before the 20th week of gestation. And buried, almost always, without the women knowing anything about it”.

Furthermore, according to what is reported in some articles, “everything, from the recovery of the fetuses in public and private hospitals to the funeral and burial” would be voluntary or Catholic associations (see “XX, https://...; “XX, https://...; “XX, https://...; “XX, https://...

In addition, based on a preliminary check carried out by the Office on XX, on the online Cemetery Services Portal of the Municipality of Brescia that allows you to view the location of the burials of the deceased in the city cemeteries, by performing a search with the name “XX” followed by a surname, the results relating to the burials of fetuses corresponding to the name and surname searched for were displayed, together with the “date of birth-date of death” (coincident), the name of the cemetery, the location/number of the burial, and the specification that they were “fetuses and stillborns”. (http://prenotazionecimiteri.comune.brescia.it/public/defunto/cerca).