Garante per la protezione dei dati personali (Italy) - 9860487
From GDPRhub
| Garante per la protezione dei dati personali - no. 9860487 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 9 GDPR |
| Type: | Other |
| Outcome: | n/a |
| Started: | |
| Decided: | 18.01.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | no. 9860487 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante per la protezione dei dati personali (in IT) |
| Initial Contributor: | mg |
The Italian DPA ordered a newspaper to stop the processing of medical data concerning a notorious mafia boss. Journalism shall respect the principle of essentiality of information.
English Summary
Facts
A mafia boss was caught after 30 years of hiding during a medical treatment in a private hospital. A newspaper published detailed information on his state of health and more specifically about the fact that he was terminally ill. The Italian DPA intervened to ascertain whether the processing of personal data was legitimate.
Holding
The Italian DPA stroke a balance between freedom of information and right to privacy. Health data are sensitive data covered by Article 9 GDPR. According to Article 137 of the Italian Data Protection Code, health data can be processed without the data subject´s consent provided that the controller complies with the principle of essentiality of information and the facts are of public interest. In addition, the controller shall respect the deontological rules governing journalism. In the present case, the Italian DPA found that the principle of essentiality was violated. Thus, it imposed the temporary limitation of processing concerning data already published and equivalent ones.
Comment
It is possible to draw some parallels between this decision and the ECtHR attempt to reconcile privacy rights and freedom of expression in journalism. In its extensive case law on the matter, the ECtHR developed a list of criteria orienting this balance. The criteria are as follows: (i) contribution to a debate of public interest; (ii) whether the person concerned is known to the public, and the subject of the news report; (iii) the prior conduct of the person concerned; (iv) the way in which the information was obtained and its veracity; (v) the content, form and consequences of the publication; and (vi) the severity of the measure imposed (see Axel Springer AG v. Germany, application no. 39954/08, points 89-95; Hurbain v. Belgium, application no. 57292/16, point 94; Biancardi v. Italy, application no. 77419/16, point 61) In the present case, the Italian DPA maintained that the mere fact that the data subject was a notorious public figure was not sufficient to legitimise privacy limitations. Given their nature and content, the information revealed did not contribute to a debate of public interest.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Provision of January 18, 2023
Register of measures
no. 17 of 18 January 2023
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei, general secretary;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");
HAVING REGARD also to the Personal Data Protection Code (Legislative Decree No. 196 of 30 June 2003);
HAVING REGARD to the "Ethical rules relating to the processing of personal data in the exercise of journalistic activity" (Official Gazette of January 4, 2019, n. 3), hereinafter "Ethical rules";
HAVING DETECTED the publication by the online newspaper Dayitalianews of an article entitled: "XX" available at the link https://... in which, citing Adnkronos as the source, news was given, in detail, of the pathology from which it results affected by XX (also indicated by the well-known alias used by him of XX) and disseminated, in support of the same, a complete copy of the report of an extremely detailed laboratory test;
CONSIDERING the art. 137 of the Code, which establishes in paragraph 1, that the data referred to in art. 9 of the Regulation ("particular categories of personal data" which include "data relating to health") can be processed even without the consent of the interested party provided that in compliance with the ethical rules referred to in art. 139 of the Code, as well as, in paragraph 3, that in the event of dissemination of data for journalistic purposes, the limit of the "essential nature of the information regarding facts of public interest" remains unchanged;
CONSIDERING in particular the art. 10 of the aforementioned Deontological Rules which prescribes that:
“1. The journalist, in referring to the state of health of a specific person, identified or identifiable, respects his dignity, the right to privacy and personal decorum, especially in cases of serious or terminal illness, and refrains from publishing analytical data of strictly clinical interest.
2. Publication is permitted in the context of pursuing the essentiality of information and always with respect for the dignity of the person if this holds a position of particular social or public importance."
CONSIDERING therefore that the Code envisages, in general terms, the aforementioned principle of the "essential nature of information" as a criterion for the determination in the publication of personal data in the journalistic field and that the Code of Conduct, in recalling and specifying this principle, intended to guarantee greater rigor with reference to the collection and dissemination of data suitable for revealing the state of health of identified or identifiable persons (articles 5, 6 and 10);
NOTING that the dissemination of data relating to the interested party's state of illness in the terms referred to above is in contrast with the aforementioned provisions;
RECOGNIZING, therefore, the need to have, pursuant to art. 58, par. 2, lit. f), of the Regulation, as a matter of urgency, against Suditaly Imprese Meridionali Società Cooperativa, as data controller, the extent of the temporary limitation of the treatment, to be considered referred to the further dissemination of the health data indicated in the article in question, including those contained in the aforementioned laboratory report accompanying it, as well as any other similar information reported in any other articles published on the same site;
CONSIDERED it necessary to order the aforementioned limitation with immediate effect from the date of receipt of this provision, reserving any other determination to the outcome of the definition of the preliminary investigation started on the case;
RECALLING that, in the event of non-compliance with the measure established by the Guarantor, the criminal sanction pursuant to art. 170 of the Code and the administrative sanctions provided for by art. 83, par. 5, letter e), of the Regulation;
HAVING REGARD to the documentation in the deeds;
CONSIDERING the observations of the general secretary;
SPEAKER Prof. Pasquale Stanzione;
ALL THE ABOVE CONSIDERING THE GUARANTOR:
a) pursuant to art. 58, par. 2, lit. f) of the Regulation provides, as a matter of urgency, with respect to Suditaly Imprese Meridionali Società Cooperativa, as data controller, the measure of the temporary limitation of the treatment, to be considered referred to the further dissemination of the health data indicated in the article in question, including those contained in the laboratory report accompanying it, as well as any other similar information reported in any other articles published on the same site;
b) the aforementioned limitation has immediate effect from the date of receipt of this provision, subject to any other determination following the outcome of the definition of the investigation started on the case.
The Guarantor, pursuant to art. 58, par. 1, of Regulation (EU) 2016/679, invites the data controller who is the recipient of the provision, also, within 3 days from the date of receipt of this provision, to communicate what initiatives have been undertaken in order to implement what is prescribed in this provision and in any case to provide adequately documented feedback. Please note that failure to respond to the request pursuant to art. 58 is punished with the administrative sanction pursuant to art. 83, par. 5, letter. e), of Regulation (EU) 2016/679.
Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lg. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged with the ordinary court of the place where the data controller has his residence, within the term of thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad.
Rome, 18 January 2023
PRESIDENT
Station
THE SPEAKER
Station
THE SECRETARY GENERAL
Matthew
Provision of January 18, 2023
Register of measures
no. 17 of 18 January 2023
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei, general secretary;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");
HAVING REGARD also to the Personal Data Protection Code (Legislative Decree No. 196 of 30 June 2003);
HAVING REGARD to the "Ethical rules relating to the processing of personal data in the exercise of journalistic activity" (Official Gazette of January 4, 2019, n. 3), hereinafter "Ethical rules";
HAVING DETECTED the publication by the online newspaper Dayitalianews of an article entitled: "XX" available at the link https://... in which, citing Adnkronos as the source, news was given, in detail, of the pathology from which it results affected by XX (also indicated by the well-known alias used by him of XX) and disseminated, in support of the same, a complete copy of the report of an extremely detailed laboratory test;
CONSIDERING the art. 137 of the Code, which establishes in paragraph 1, that the data referred to in art. 9 of the Regulation ("particular categories of personal data" which include "data relating to health") can be processed even without the consent of the interested party provided that in compliance with the ethical rules referred to in art. 139 of the Code, as well as, in paragraph 3, that in the event of dissemination of data for journalistic purposes, the limit of the "essential nature of the information regarding facts of public interest" remains unchanged;
CONSIDERING in particular the art. 10 of the aforementioned Deontological Rules which prescribes that:
“1. The journalist, in referring to the state of health of a specific person, identified or identifiable, respects his dignity, the right to privacy and personal decorum, especially in cases of serious or terminal illness, and refrains from publishing analytical data of strictly clinical interest.
2. Publication is permitted in the context of pursuing the essentiality of information and always with respect for the dignity of the person if this holds a position of particular social or public importance."
CONSIDERING therefore that the Code envisages, in general terms, the aforementioned principle of the "essential nature of information" as a criterion for the determination in the publication of personal data in the journalistic field and that the Code of Conduct, in recalling and specifying this principle, intended to guarantee greater rigor with reference to the collection and dissemination of data suitable for revealing the state of health of identified or identifiable persons (articles 5, 6 and 10);
NOTING that the dissemination of data relating to the interested party's state of illness in the terms referred to above is in contrast with the aforementioned provisions;
RECOGNIZING, therefore, the need to have, pursuant to art. 58, par. 2, lit. f), of the Regulation, as a matter of urgency, against Suditaly Imprese Meridionali Società Cooperativa, as data controller, the extent of the temporary limitation of the treatment, to be considered referred to the further dissemination of the health data indicated in the article in question, including those contained in the aforementioned laboratory report accompanying it, as well as any other similar information reported in any other articles published on the same site;
CONSIDERED it necessary to order the aforementioned limitation with immediate effect from the date of receipt of this provision, reserving any other determination to the outcome of the definition of the preliminary investigation started on the case;
RECALLING that, in the event of non-compliance with the measure established by the Guarantor, the criminal sanction pursuant to art. 170 of the Code and the administrative sanctions provided for by art. 83, par. 5, letter e), of the Regulation;
HAVING REGARD to the documentation in the deeds;
CONSIDERING the observations of the general secretary;
SPEAKER Prof. Pasquale Stanzione;
ALL THE ABOVE CONSIDERING THE GUARANTOR:
a) pursuant to art. 58, par. 2, lit. f) of the Regulation provides, as a matter of urgency, with respect to Suditaly Imprese Meridionali Società Cooperativa, as data controller, the measure of the temporary limitation of the treatment, to be considered referred to the further dissemination of the health data indicated in the article in question, including those contained in the laboratory report accompanying it, as well as any other similar information reported in any other articles published on the same site;
b) the aforementioned limitation has immediate effect from the date of receipt of this provision, subject to any other determination following the outcome of the definition of the investigation started on the case.
The Guarantor, pursuant to art. 58, par. 1, of Regulation (EU) 2016/679, invites the data controller who is the recipient of the provision, also, within 3 days from the date of receipt of this provision, to communicate what initiatives have been undertaken in order to implement what is prescribed in this provision and in any case to provide adequately documented feedback. Please note that failure to respond to the request pursuant to art. 58 is punished with the administrative sanction pursuant to art. 83, par. 5, letter. e), of Regulation (EU) 2016/679.
Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lg. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged with the ordinary court of the place where the data controller has his residence, within the term of thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad.
Rome, 18 January 2023
PRESIDENT
Station
THE SPEAKER
Station
THE SECRETARY GENERAL
Matthew
