Garante per la protezione dei dati personali (Italy) - 9873031

Garante per la protezione dei dati personali - 9873031

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	23.02.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	9873031
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (Italy) (in IT)
Initial Contributor:	mg

The Italian DPA found that the publication of mugshots by an online newspaper was unfair and unlawful under Article 5(1)(a) GDPR.

English Summary

Facts

The Italian DPA opened a procedure concerning a newspaper publishing photographs of data subjects involved in police investigations. More specifically, these pictures were originally taken within police offices and for police purposes. The controller immediately removed the contents from its website and stated that it was not aware of the true nature of the images. The controller also claimed to have processed those data for journalistic purposes.

Holding

The DPA stated that journalists can disseminate personal data to the public without data subjects’ consent, provided that the principle of essentiality of information is respected. These considerations apply also to criminal proceedings.

However, personal data processed by the controller in the present case were mugshots, namely pictures taken exclusively for police purposes. The DPA claimed that the spread of such images by police officers was unlawful in itself. As a consequence, processing of these personal data by a newspaper could not be considered in compliance with the GDPR. The DPA also held that the mere lack of identification numbers on the pictures did not reduce the potential risks for data subjects’ rights, as the pictures were published contextually to the data subjects’ arrest.

In light of the above, the DPA found a violation of Article 5(1)(a) GDPR and adopted a ban on further processing operations pursuant to Article 58(2)(f) GDPR. However, the DPA held that the adoption of a fine was not necessary and only issued a reprimand to the controller (Article 58(2)(b) GDPR).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web no. 9873031]

Provision of February 23, 2023

Register of measures
no. 54 of 23 February 2023

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components and the cons. Fabio Mattei, general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

HAVING REGARD TO the Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (legislative decree 30 June 2003, n. 196, as amended by legislative decree 10 August 2018, n. 101, hereinafter "Code");

NOTING that:

during a proceeding concerning another data controller, activated following a complaint lodged by an interested party, the presence on the XX site, published by RCS Mediagroup S.p.a., of an article of the XX emerged - which can be found via the URL https://.. . – in which were published, accompanying the narration of a news story, some photographs portraying the protagonists of the same which, due to the characteristics of the shot as well as the presence within them of the institutional logo of the State Police, appeared attributable to the category of mugshots or in any case to the ownership of the police forces whose dissemination, by these bodies, can only take place for justice and police purposes (see Article 14, paragraph 1, Presidential Decree January 15, 2018, n. 15 containing "Regulation pursuant to article 57 of legislative decree 30 June 2003, n. 196, containing the identification of the methods of implementation of the principles of the Code regarding the protection of personal data in relation to the processing of data carried out, for the police purposes, by police bodies, offices and commands”);

the Authority therefore decided to initiate an official proceeding to ascertain the lawfulness of the processing carried out by the aforementioned publication;

GIVEN the note dated August 6, 2020 with which the Office sent RCS Mediagroup S.p.a. a request for information in this regard pursuant to art. 157 of the Code;

GIVEN the note of 9 September 2020 with which RCS Mediagroup S.p.a. communicated that it had "deleted from the "XX" website not only the two photos affected by the reported processing, but also the article that contained them", specifying however that:

the removal that has taken place must not be interpreted as an admission, even if implicit, of responsibility taking into account the fact that the processing of personal data contained in the article was at the time carried out in a lawful manner for journalistic purposes and in compliance with the principle of essentiality of information regarding facts of public interest;

the images in dispute "did not appear prima facie to fall into the category of the so-called "mug shots"" as "the same (...) portrayed the subjects peacefully arrested only from the front and not also in profile, without any indication of the serial number and/or height of the subjects portrayed, as usually happens";

it seemed likely that they were instead "simple identification images, extracted from the identity documents of the arrested and made available to the media, by means of their digitization and the addition, top left, of the State Police logo, while at the bottom right, the logos of the social networks "Facebook" and "Twitter" appear with the indication "Questura di XX"", noting that those indications were partially superimposed on the images of the interested parties, suggesting that they were not mugshots "taken towards subjects clearly in vinculis and whose dissemination is therefore prohibited";

the story described in the article had been at the center of the news for several days "and, therefore, the fact that the alleged perpetrators had been arrested and placed at the disposal of the judicial authority certainly covered profiles of interest for public opinion which was entitled not only to be informed, but also to be able to ascertain it directly by viewing their effigy, a fact that can be disclosed, like their image”;

that the photographs in question "had been taken from the video that the State Police had made available to the media, following the arrest of the alleged members of the CD. "XX"";

HAVING REGARD TO the note of the Office of 17 December 2020 with which, pursuant to art. 166, paragraph 5, of the Code, RCS Mediagroup S.p.a. the initiation of the procedure for the possible adoption of the provisions pursuant to art. 58, par. 2, of the Regulation and notified of possible violations of the law in relation to:

to the general principles of treatment pursuant to art. 5, par. 1, of the Regulation and, in particular, to the principle of lawfulness and correctness referred to in lett. to);

to articles 137 of the Code and 6, 8 and 12 of the Deontological Rules;

HAVING REGARD to the note dated 14 January 2021 with which the data controller presented his defense deductions representing:

to have removed not only the disputed images, but the entire article, while reaffirming the lawfulness of the processing carried out;

that the aforementioned images were handed over to journalists by the investigators, probably following a press conference dedicated to the operation, as can also be inferred from the presence of the institutional logo within them;

that, if the editorial staff "had been in bad faith" regarding the attribution of the images to the category of mugshots, it would have been sufficient to eliminate the aforementioned logo "to deprive [them] of any relevant element" given that the persons concerned have no connotation detail such as to make them feel in vinculis;

that the published photographs have only been accessible to a limited number of readers given that the article has never been published on the front page of the newspaper and that, in order to access the images, they were required to pass twice to reach the gallery contained;

on the basis of this, it can be assumed that the publication of the faces of the subjects concerned, who however never complained about it and who in any case had been arrested for serious offenses, had a low impact in terms of potential damage to the rights of the same;

the processing of personal data took place in the legitimate exercise of the right to report and in compliance with the principle of essentiality of information, using photos from the investigators who, prima facie, did not appear, due to their characteristics, to be qualified as mugshots;

CONSIDERING that, unless the fact constitutes a more serious offence, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor";

DETECTED, on the basis of what emerged during the proceedings, that:

the treatment implemented by RCS Mediagroup S.p.a. through the publication of news relating to the development of investigations into crimes committed, over the course of a few years, to the detriment of credit institutions in the capital, including the identification data of the subjects allegedly responsible, does not in itself constitute a breach of the limits imposed by a correct exercise of the right to report taking into account the fact that the journalist can disclose personal data, even without the consent of the interested party, provided that it is within the limits set by the reference regulatory framework and in particular in compliance with the requirement "of the essentiality of the information with regard to facts of public interest" (cf. art. 137, paragraph 3, of the Code and art. 6 of the code of ethics);

the requirement of the "essential nature of the information" is also referred to with reference to reports relating to criminal proceedings (art. 12 of the cited deontological rules) and, in the light of this, this Authority has repeatedly specified that the publication of identification data of the persons against whom the proceeding is instituted is not precluded by the legislation in force and must be seen as part of the guarantees aimed at ensuring transparency and control by citizens with regard to the activity of justice (ex pluribus provision n. 38 of 7 February 2019, web doc. web doc. n. 9101651);

the dissemination of such information, in this case, may be deemed to respond to the public's interest in having information on the matter - and this with particular regard to the local community referring to the geographical area of distribution of the masthead - also taking into account the specific methods with which the aforesaid crimes were committed, as well as the seriality of the same;

a different evaluation must instead be made in relation to the diffusion of images that portray the protagonists of the story in a frontal position and with the institutional logo of the State Police superimposed and which, as such and even in the absence of the characteristic numerical sequence usually shown inside they appear similar to mugshots;

the fact that the images were shared by the police - the latter circumstance highlighted by the publisher - unquestionably emerged in the course of another proceeding, parallelly hinged by the Authority in order to verify the conditions of said treatment (cf. provision of the Guarantor of 24 February 2022, n.61, web doc. n. 9766445), as a result of which the non-existence of the police needs required to deem the dissemination of the images in dispute lawful by the police forces, which appear to have the characteristics of images acquired during arrest operations preceded by a few frames in which the persons concerned are filmed while being forcibly led by police officers inside service cars;

the Authority has, in particular, considered that there was "no effective need to disclose the images in question - in addition to the various information provided in support of the same, including the personal details of the interested party - resulting in the treatment itself not only not necessary, but also exceeding with respect to the purposes of the police", in violation of articles 3, paragraph 1, lett. a) and c), 5 of Legislative Decree no. 51/2018 and 14 of the Presidential Decree no. 15/2018;

this assessment, carried out with regard to the original treatment carried out by the forces of order, fundamentally excludes the possibility for the publisher to legitimately invoke, as a prerequisite for dissemination, the existence of justice and police purposes (see art. 8, paragraph 2, of the Rules of Conduct), nor, on the other hand, have significant reasons of public interest emerged such as to motivate the disclosure from origin of the aforementioned images and the continuation of their treatment even several years after the publication of the article in which they were included;

the harmful potential for the rights of the persons concerned inherent in the dissemination of them has also already been assessed by the Authority in the context of a proceeding activated in 2019 following a complaint by one of the subjects involved in the news story in question, who complained about the prejudice connected to the generalized and decontextualized diffusion of one's photograph, with the logo of the State Police superimposed, through generalist search engines and with respect to which the Guarantor has imposed the limitation of the relative treatment pending further investigations relating to the presupposed treatments (see provision of the Guarantor of 27 November 2019, web doc. n. 923667);

regardless of whether or not the images present identification codes/numbers or the logo of the State Police, the jurisprudence of the Court of Cassation, with reference both to mugshots and to "simple passport-sized photos of the arrested", stated that "the publication in a newspaper of a photo of a person in chronological coincidence with his arrest must respect, for the purposes of its legitimacy, not only the limits of essentiality to illustrate the content of the news and the legitimate exercise of the right to report, but also the particular precautions imposed to protect the dignity of the person portrayed by art. 8, first paragraph, of the deontological rules, which constitutes a source of supplementary legislation; the investigation on compliance with the aforementioned limits in the publication of the photo must be conducted with greater rigor than that relating to the simple publication of the news, taking into account the particular potential harmful to the dignity of the person connected to the typical emphasis of the visual instrument, and the greater suitability of it to a diffusion decontextualized and insusceptible to control by the person portrayed» (Civ. Cassation, section III, June 6, 2014 n. 12834; Civil Cassation, section III, May 13, 2020 n. 8878);

CONSIDERED therefore that the treatment described constitutes a violation of the aforementioned articles 137, paragraph 3, of the Code and 6, 8 and 12 of the Deontological Rules, as well as the general principles of lawfulness and correctness of the processing of personal data pursuant to art. 5, par. 1 lit. a), of the Regulation, a principle already established by art. 6, paragraph 1 lett. a), of directive 95/46/EC and by art. 11, paragraph 1, lett. a), of the Personal Data Protection Code in the text in force at the time of the original publication of the article;

HAVING ACKNOWLEDGED the measure adopted by the data controller during the procedure and consisting in the removal of the disputed photographs published in the article indicated in the introduction, as well as in the article itself;

CONSIDERING that it has to dispose towards RCS Mediagroup S.p.a., pursuant to art. 58, par. 2, lit. f) of the Regulation, the measure of the prohibition of further processing of the images subject of the present proceeding with reference to the further diffusion of the same, also online including the historical archive, as they are considered harmful to the rights of the interested parties, except for the mere storage of them for the purpose of their possible use in court;

RECALLING that, in case of non-compliance with the measure of the prohibition of treatment established by the Guarantor, the criminal sanction referred to in art. 170 of the Code, in addition to the administrative sanction pursuant to art. 83, par. 5, letter. e), of the Regulation;

HAVING CONSIDERED, with respect to the possible application of an administrative-pecuniary sanction, that:

the data controller has objected to the non-existence of willful misconduct based on the conduct, declaring that he acted in the legitimate exercise of the right to report with regard to a judicial investigation deemed of significant interest with particular regard to the local community of reference;

the conviction matured by the data controller regarding the lawfulness of the processing carried out is originally derived also from the fact that the published images had been made available by the police through a press release, as well as through their dissemination on the site institution of the State Police;

RCS Mediagroup S.p.a. proceeded to remove the images immediately after receiving the request for information from the Authority;

the overall assessment of the elements described above leads to deem the application of the warning measure proportionate in the case in question;

CONSIDERING therefore that the owner, pursuant to art. 58, par. 2, lit. b) of the Regulation, must be warned for non-compliance with the provisions on the processing of data in the journalistic field, with particular regard to those referred to above;

HAVING DEEMED that the conditions exist for proceeding with the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, in relation to the measures adopted in the specific case against RCS Mediagroup S.p.a., in accordance with art. 58, par. 2, of the same Regulation;

HAVING REGARD to the documentation in the deeds;

GIVEN the observations made pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER Dr. Agostino Ghiglia;

ALL THIS CONSIDERING THE GUARANTOR

a) takes note of the measures adopted by the data controller during the procedure;

b) pursuant to art. 58, par. 2, lit. f) of the Regulation, establishes the prohibition of further processing of the images subject of this proceeding with reference to their further diffusion, also online including the historical archive, as they are considered harmful to the rights of the interested parties, except for mere conservation of them for the purpose of their possible use in court;

c) pursuant to art. 58, par. 2, lit. b), of the Regulation, establishes the extent of the warning against RCS Mediagroup S.p.a. for non-compliance with the provisions on the processing of data in journalism referred to in the justification;

d) pursuant to art. 17 of the Guarantor's regulation n. 1/2019, provides for the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, of the measures adopted against RCS Mediagroup S.p.A., in accordance with art. 58, par. 2, of the same Regulation.

The Guarantor invites, pursuant to articles 157 of the Code and 58, par. 1, lit. a), of the Regulation, RCS Mediagroup S.p.a., within 30 days from the date of receipt of this provision, to communicate what initiatives have been undertaken, in order to fully implement what is prescribed therein. Please note that failure to respond to the above request is punished with the administrative sanction pursuant to articles 166 of the Code and art. 83, par. 5, letter. e), of Regulation (EU) 2016/679.

Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lgs. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the interested party within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.

Rome, 23 February 2023

PRESIDENT
station

THE SPEAKER
guille

THE SECRETARY GENERAL
Matthew

[doc. web no. 9873031]

Provision of February 23, 2023

Register of measures
no. 54 of 23 February 2023

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components and the cons. Fabio Mattei, general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

HAVING REGARD TO the Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (legislative decree 30 June 2003, n. 196, as amended by legislative decree 10 August 2018, n. 101, hereinafter "Code");

NOTING that:

during a proceeding concerning another data controller, activated following a complaint lodged by an interested party, the presence on the XX site, published by RCS Mediagroup S.p.a., of an article of the XX emerged - which can be found via the URL https://.. . – in which were published, accompanying the narration of a news story, some photographs portraying the protagonists of the same which, due to the characteristics of the shot as well as the presence within them of the institutional logo of the State Police, appeared attributable to the category of mugshots or in any case to the ownership of the police forces whose dissemination, by these bodies, can only take place for justice and police purposes (see Article 14, paragraph 1, Presidential Decree January 15, 2018, n. 15 containing “Regulation pursuant to article 57 of legislative decree 30 June 2003, n. 196, containing the identification of the methods of implementation of the principles of the Code regarding the protection of personal data in relation to the processing of data carried out, for police purposes, by police bodies, offices and commands");