Garante per la protezione dei dati personali (Italy) - 9440000
From GDPRhub
| Garante per la protezione dei dati personali - 9440000 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(c) GDPR Article 6(1)(c) GDPR Article 6(1)(e) GDPR Article 6(2) GDPR Article 6(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 02.07.2020 |
| Published: | 27.07.2020 |
| Fine: | 2000 € |
| Parties: | Comune di Manduria |
| National Case Number/Name: | 9440000 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | n/a |
The Italian DPA imposed a fine of €2000 against the Municipality of Manduria for unlawfully communicating the personal data of an employee to four newspapers. The DPA held that the Municipality could not rely on Articles 6(1)(c), (e), 6(2), and 6(3)(b) for the processing of the employee's data.
English Summary
Facts
An employee of the Municipality of Manduria has complained to the Italian DPA that the Municipality has communicated her personal data to two local and two regional newspapers by sending a "press note", in which the complainant was mentioned "with reference to the activation of an out-of-court procedure [...] for the recognition of higher tasks". In particular, the press note stated that the complainant requested, through her lawyers, from the Municipality "the payment [...] of the sum of approximately [...] euro [...] for carrying out 'managerial functions' on the basis of the decrees signed by the former Mayor […] ".
In its defense, the Municipality stated that the press release at the basis of the complaint was only published as a response to a newspaper article, signed by a former municipal councilor, contesting the management of personnel by the Municipality, which would have led some employees, including the complainant, to ask for transfer to other entities. The Municipality argued that through the "press note" at the basis of the complaint it wanted to to protect its image as well as implement the principles of transparency, and exercise a legitimate right of criticism in order to protect its image and "better outline what was happening in the Municipality". The Municipality furthermore claimed that the processing of the surname was in line with Article 5(1)(c) as it was associated with economic data
Dispute
Was the processing of the complainant's personal data by the Municipality, in the form of the communication to the newspapers, lawful in accordance with Articles 6(1)(c), (e), 6(2), and 6(3)(b)?
Holding
The DPA rejected the Municipality's claim that that the communication of the complainant's personal data to the newspapers was necessary for any of the grounds of Articles 6(1)(c) or 6(1)(e). Therefore, the DPA issued a sanction of €2000 against the Municipality for violating Articles 6(1)(c), (e), 6(2), and 6(3)(b).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Measure of 2 July 2020
Register of measures
No 116 of 2 July 2020
THE DATA PROTECTION SUPERVISOR
At today's meeting, which was attended by Dr. Antonello Soro, president, Dr. Giovanna Bianchi Clerici and Prof. Licia Califano, members, and Dr. Giuseppe Busia, general secretary;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter, "Regulation");
HAVING REGARD TO Legislative Decree No 196 of 30 June 2003 on the 'Personal Data Protection Code', laying down provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter 'the Code');
HAVING REGARD TO Regulation No 1/2019 on internal procedures having external relevance for the performance of tasks and the exercise of powers conferred on the EDPS for the protection of personal data, approved by resolution No 98 of 4/4/2019, published in OJ No 106 of 8/5/2019 and in www.gpdp.it, web doc. No 9107633 (hereinafter 'EDPS Regulation No 1/2019');
Having regard to the documentation in deeds;
Having regard to the observations made by the Secretary-General pursuant to Article 15 of the Garante Regulation No 1/2000 on the organisation and functioning of the office of the Guarantor for the protection of personal data, web document No 1098801;
Rapporteur: Dr Antonello Soro;
PREMISE
1. The complaint.
By complaint of XX, lodged pursuant to Article 77 of the Rules, Ms XX, an employee of the Municipality of Manduria, complained about the communication of her personal data, through the sending of 'a press note', by the Extraordinary Commission of the Municipality, to 'two local newspapers and two regional newspapers', in which the complainant was mentioned 'with reference to the activation of an out-of-court procedure [...] for the recognition of higher tasks'. In particular, this note states that the complainant 'through its lawyers, requested [from] Amministrazione Straordinaria the payment [...] of the sum of approximately [...] euro [...] for carrying out 'managerial functions', on the basis of the decrees signed by the former Mayor [...]'.
2. The investigatory activity.
By note of XX (prot. n. XX), the Municipality, in response to the Garante's request for information (prot. n. XX of XX), stated that:
- on XX the newspaper "La voce di Manduria" had published an article, signed by a former municipal councillor, contesting the management of personnel by the extraordinary administration, which would have led some employees, including the complainant, to ask for transfer to other entities;
- the Extraordinary Commission of the Municipality, in order to protect its image "and at the same time to implement the principles of transparency", had decided to respond to these claims, sending, in the month of XX, a note "to the Director of "La Voce di Manduria", to the Correspondent of "Quotidiano di Taranto" and "Gazzetta del Mezzogiorno", and to the Director of RTM and Ciacksocial"";
- the note 'was sent [...] exercising a legitimate right of criticism, in order to protect the image of the Municipality of Manduria and the activity carried out by the Extraordinary Commission [...] and 'better outline what was happening in the Municipality';
- the processing of personal data relating to the complainant, reported in the note, "was considered consistent with the limits of relevance and minimization of the data subject to processing (art. 5, paragraph 1, letter c) of the Regulation)", since "the personal data, contained in the surname, is associated with an economic data that represents the emolument requested by the official for considered managerial activity carried out before the appointment of the [...] Commission";
- "such data would in any case be included among the information that, according to the provisions of art. 14 paragraph 1-ter of Legislative Decree 33/2013, should be made subject to publication".
On the basis of the elements acquired, also through the documentation sent and in the light of the facts that emerged during the preliminary investigation, the Office notified the Municipality (note prot. n. XX of XX), as data controller, pursuant to art. 166, paragraph 5, of the Code, the initiation of the procedure for the adoption of the measures referred to in art. 58, paragraph 5, of the Code. 2, of the Regulations, concerning the alleged violations of the 2-ter, paragraphs 1, 2 and 3, of the Code and of Art. 6, para 1, lett. c) and e), para 2 and para 3, lett. b), of the Regulations, inviting the Municipality to produce defensive writings or documents to the Guarantor or to ask to be heard by the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Art. 18, para 1, of the Law no. 689 of 24 November 1981).
The Municipality has sent its defensive pleadings with note prot. n. XX of XX, representing, in particular, that:
- on XX, the newspaper "La Voce di Manduria" had published an article, "in which a former administrator of the Ente made explicit reference to the fact that the complainant (therein indicated with name and surname) had formulated a request for transfer to another Ente, due to unspecified and documented internal administrative problems";
- following the publication of that article, "the press release was issued, from which the complaint originates [...] with the declared and exclusive intention of protecting the image of the Municipality through the representation of the facts as actually documented in the acts of the Authority";
- "in this context, the reference to the personal data" of the complainant, "already present in the article signed by the former administrator, was made by the [...] Commission, in accordance with Article 6(1)(c) and (e) of the Regulation, "for the performance of a task related to the exercise of public authority", that is [...] to protect the image of the Authority, [...] questioned by the press articles published several times in the paper and online "La Voce di Manduria"";
- "the need to avoid the transmission of distorted information in the press to the detriment of the Body has led [the] Commission, in the necessary and difficult balancing operation between the need to protect the privacy of the employee and the need for transparency, to believe that the latter could legitimately take precedence, and this in the consideration that the publication concerned data relating to the sphere of public importance closely related to the activity carried out by the complainant, which are in any case among those subject to the obligation of publication under Article 15 of Legislative Decree no. 33/2013";
- "This interpretation [the] Commission was also determined on the basis of the concrete application of the hermeneutical data provided by the Guarantor Authority [...] with Resolution no. 243 of 15 May 2014, containing "Guidelines on the processing of personal data, also contained in administrative acts and documents carried out for the purposes of publicity and transparency on the web by public entities and other obliged entities", in particular by the combined reading of point 9. c, [...] and Part Two", on the assumption that, in the opinion of the Commission, "the economic data, XX, falls within the range of data that can be known to third parties due to the obligation to publish in transparency the compensation received by the holders of public managerial positions as set out in Article 15 of Legislative Decree no. 33/2013";
- "the conduct of the Extraordinary Commission was [therefore] based on absolute good faith";
- "by note [...] prot. n. XX of XX", the Commission "requested the newspapers concerned ("La Voce di Manduria" on-line and "RTMweb") to remove from the web the press article subject of the complaint, in order to avoid potential negative effects on the legal sphere of the person concerned, whether or not they can be qualified in terms of violation of the rules on the protection of personal data";
- such removal took place 'on the same day as the 20th';
- "the contested violation does not concern "particular" data, i.e. sensitive and/or judicial data, but personal data pertaining to the sphere of public importance connected to the activity carried out by the complainant in the Municipality of Manduria and the economic implications, resulting from the legal qualification of the functions attributed to the complainant in a given period of time".
3. Outcome of the preliminary investigation activity.
The rules on the protection of personal data provide that public entities, even if they operate in the performance of their duties as employers, may process personal data (art. 4, n. 1, of the Regulation) of employees, if the processing is necessary "to fulfil a legal obligation to which the data controller is subject" (think of specific obligations or tasks provided for by law for purposes of management of the employment relationship; cf. Art. 88 of the Regulation) or "for the performance of a task in the public interest or connected with the exercise of public authority vested in the data controller" (art. 6, par. 1, lett. c) and e) of the Regulation).
More generally, the European legislation provides that "Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing, in accordance with paragraph 1(c) and (e), determining more precisely specific requirements for processing and other measures to ensure lawful and correct processing [...]". (art. 6, par. 2 of the Rules). In this regard, it should be noted that the communication of personal data, by public entities, is allowed only when required by law or, in the cases provided for by law, by regulation (Article 2-ter, paragraphs 1 and 3, of the Code).
The data controller is also required to comply with the principles of data protection, including the principles of "lawfulness, correctness and transparency" and "minimization", according to which personal data must be "processed lawfully, correctly and transparently towards the data subject" and must be "adequate, relevant and limited to what is necessary with respect to the purposes for which they are processed" (art. 5, par. 1, letter a) and c) of the Regulation).
In this context, what the Entity has claimed with reference to the fact that the communication of the complainant's personal data to newspapers would have been necessary "for the performance of a task connected with the exercise of public authority" cannot be accepted, nor is such communication required by "Union law" or "Member State law" (art. 6, par. 3, of the Regulation).
Moreover, it is irrelevant that the claimant's personal data were "in any case among those subject to the obligation of publication under Article 15 of Legislative Decree no. 33/2013", as well as the consequent reference to the "Guidelines on the processing of personal data, also contained in administrative acts and documents, carried out for purposes of publicity and transparency on the web by public entities and other obliged entities" (provision no. 243 of 15 May 2014, web document no. 3134436). This, in the first place, because the Municipality has implemented a communication of personal data to third parties, i.e. the newspapers, and not already a dissemination of data through the publication of a determined on the online register, as required by the regulations on the transparency of the administrative activity of public bodies. Neither the communication of personal data in question was carried out for purposes of transparency of administrative action, but, as stated by the Body, to "protect the image of the Municipality". In any case, it should be noted that Article 15 of Legislative Decree no. 33 of March 14, 2013, no. 33 regulates the publication obligations concerning the holders of collaboration or consultancy assignments, not being applied with reference to employees. Likewise, Article 14 of the same decree, also invoked by the Municipality, could not have been applied, since, at the time when the facts complained of occurred, the complainant was not formally classified in the management role.
For these reasons, it is considered that the communication of the employee's personal data made by the municipal administration to the press was made in the absence of a suitable presumption of lawfulness (art. 6, par. 1, lett. c) and e), par. 2 and par. 3, lett. b) of the Regulation).
As pointed out by the Authority, already with regard to the previous normative framework, in the "Guidelines on the subject of processing of personal data of workers for purposes of management of the employment relationship in the public ambit" of June 14, 2007 (web document no. 1417809), "specific legislative or regulatory provisions identify the cases in which the public administration is legitimated to communicate information regarding the workers to third parties, public or private subjects", while "when such a specific provision is lacking, the personal data of the employee [...] cannot be communicated [...] to third parties [...]". (par. 5).
4. Conclusions.
In the light of the above assessments, taking into account the statements made by the data controller during the course of the preliminary investigation ˗ whose truthfulness may be called to answer pursuant to Article 168 of the Code ˗ it is represented that the elements provided by the data controller in the statements of defence, although worthy of consideration, do not allow to overcome the findings notified by the Office with the deed of initiation of proceedings and are insufficient to allow the closure of the present proceedings, since none of the cases provided for by Article 11 of the Regulation of the Guarantor No. 1/2019.
It is also represented that the violation of the personal data subject of the investigation, by the Municipality, occurred in full force of the provisions of the Regulation and the Code, in the text prior to the amendments made by Legislative Decree no. 101/2018, and that, therefore, for the purpose of determining the regulatory framework applicable in terms of time (Article 1, paragraph 2, of Law no. 689 of 24 November 1981), these constitute the provisions in force at the time of the violation, which in this case occurred in July 2018, when the Regulation was fully effective.
Therefore, the preliminary assessments of the Office are confirmed and the unlawfulness of the processing of personal data carried out by the City of Manduria, for having communicated to third parties personal data relating to the complainant, in the absence of appropriate legal requirements, in violation of Article 6, paragraph 1, letter c) and e), paragraph 2 and paragraph 3, letter b), of the Regulation and Article 19, paragraph 3, of the Code (now transfused into Article 2-ter of the Code, with Legislative Decree no. 101/2018).
The violation of these provisions makes the administrative sanction provided for in Article 83, paragraph 5, of the Regulation applicable, pursuant to Article 58, paragraph 2, letter i), of the Regulation, as also referred to in Article 166, paragraph 2, of the Code. In this context, considering that the conduct has ceased to produce its effects, the prerequisites for the adoption of further corrective measures pursuant to art. 58, par. 2 of the Regulation are not met.
5. Adoption of the injunction order for the application of the pecuniary administrative sanction and accessory sanctions (art. 58, par. 2, lett. i and 83 of the Regulation; art. 166, par. 7 of the Code).
The Guarantor, in accordance with Articles 58(2)(i) and 83 of the Regulations and Article 166(7) of the Code). 166 of the Code, has the power to "impose a pecuniary administrative sanction pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in place of such measures, depending on the circumstances of each individual case" and, in this framework, "the Board [of the Guarantor] adopts the injunction, with which it also orders the application of the accessory administrative sanction of its publication, in whole or in excerpts, on the website of the Guarantor pursuant to Article 166, paragraph 7, of the Code" (art. 16, paragraph 1, of the Regulation of the Guarantor No 1/2019).
In this regard, taking into account Article 83, paragraph 3, of the Regulation, in the present case - also considering the reference contained in Article 166, paragraph 2, of the Code - the violation of the above provisions is subject to the application of the same pecuniary administrative penalty provided for in Article 83, paragraph 5, of the Regulation.
The aforesaid pecuniary administrative sanction imposed, depending on the circumstances of each individual case, must be determined in the amount taking due account of the elements provided for in Article 83, paragraph 2, of the Regulation. To this end, it has been considered that the personal data subject of the communication does not fall within the special categories of personal data and in any case relates only to one interested party, that the data controller has taken steps to ask the newspapers, to which the note containing the complainant's personal data had been sent, to remove the press articles containing such data and that the Municipality has produced a declaration, signed by the complainant on 6 June 2019, in which the complainant acknowledges the initiatives taken by the administration to mitigate the damage suffered. Furthermore, there are no previous relevant violations committed by the data controller or previous measures as per art. 58 of the Regulation.
On the basis of the above elements, assessed as a whole, it is deemed to determine the amount of the monetary sanction, also taking into account the phase of first application of the penalty provisions in the amount of € 2,000.00 (two thousand) for the violation of Article 6, paragraph 1, letter c) and e), paragraph 2 and paragraph 3, letter b), of the Regulation.
Taking into account the circumstance that the personal data of the person concerned were further disclosed by newspapers, it is also considered that the accessory sanction of the publication on the website of the Guarantor of this measure, provided for by Article 166, paragraph 7 of the Code and Article 16 of the Regulation of the Guarantor no. 1/2019, should apply.
Finally, it should be noted that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met.
ALL THIS BEING SAID, THE GUARANTOR
pursuant to Article 57(1)(f) of the Regulation, finds the unlawfulness of the processing carried out by the Municipality of Manduria, for breach of Article 6(1)(c) and (e), (2) and (3)(b) of the Regulation, in the terms set out in the grounds;
ORDER
the Municipality of Manduria, in the person of the pro-tempore legal representative, with registered office in Piazza Garibaldi, 21, 74024 Manduria (TA), Fiscal Code 80009070733, pursuant to articles 58, par. 2, letter i), and 83, par. 5, of the Regulation and 166, par. 2, of the Code, to pay the sum of euro 2. 000.00 (two thousand) as an administrative fine for the violations indicated in the statement of reasons; it is represented that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute by payment, within 30 days, of an amount equal to half of the sanction imposed;
INGIUNGE
the same Municipality to pay the sum of Euro 2,000.00 (two thousand), in case of failure to settle the dispute pursuant to art. 166, paragraph 8, of the Code, according to the procedures indicated in the annex, within 30 days from the notification of this measure, under penalty of the adoption of the consequent executive acts pursuant to art. 27 of Law no. 689/1981;
AVAILABLE
pursuant to Article 166, paragraph 7, of the Code, the publication of this measure on the website of the Guarantor, considering that the conditions set out in Article 17 of the Regulation of the Guarantor No 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met.
Pursuant to Article 78 of the Regulation, Article 152 of the Code and Article 10 of Legislative Decree no. 150 of 1 September 2011, it is possible to appeal against this measure before the ordinary judicial authorities, on pain of inadmissibility, within thirty days of the date of communication of the measure itself or within sixty days if the applicant resides abroad.
Rome, 2 July 2020
THE PRESIDENT
Soro
THE REPORTER
Soro
THE SECRETARY GENERAL
Busia
