Garante per la protezione dei dati personali (Italy) - 9885151
From GDPRhub
| Garante per la protezione dei dati personali - 9885151 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 11 (1) (a) D.lgs 196/2003 Article 11 (2) D.lgs 196/2003 Article 19 D.lgs 196/2003 Article 20 D.lgs. 196/2003 Article 22 D.lgs 196/2003 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 23.03.2023 |
| Published: | |
| Fine: | 4000 EUR |
| Parties: | Ministero degli Interni Mr. XX |
| National Case Number/Name: | 9885151 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | GPDP (in IT) |
| Initial Contributor: | Kevin |
The Italian DPA fined the "Ministero degli Interni" because, in activating a procedure aimed at the revocation of a gun license, has divulgated with other public administrations personal and health data of Mr. XX.
English Summary
Facts
In 2018, a medical college discovered that Mr. XX, the complainant, was no longer suitable to have a gun license. In this context, the Commander of the Firemen Department of Latina, the employee of Mr. XX, sent the medical report to "Questura di Latina" due to the active Italian procedure, under articles 11 (3) and 39 of T.U.L.P.S., to revoke any authorization conceded to Mr. XX and preventing the possession of guns, ammunitions, and explosive material. Furthermore, the report was sent to the police department of Terracina and the "Stazione dei Carabinieri di Sonnino". The "Questura di Latina" argued that the report constituted the only legal basis for revoking the gun license and that, given their relationship with public safety, the right to privacy couldn’t be considered prevalent.
Holding
The Italian Dpa fined, under articles 19 and 20 d.lgs. 30 giugno 2003 n. 196 (before the implementation of GDPR), the "Ministero degli Interni" for having communicated personal data of Mr. XX related to his health, without having a legal basis.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[doc. web no. 9885151]
Provision of 23 March 2023
Register of measures
no. 82 of 23 March 2023
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer. Guido Scorza, components and the cons. Fabio Mattei, general secretary;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data and repealing Directive 95/46/ CE, “General Data Protection Regulation” (hereinafter, “Regulation”);
HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 containing the "Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data, as well as to the free circulation of such data and which repeals Directive 95/46/EC” (hereinafter the “Code”);
GIVEN the l. no. 689/1981 and subsequent amendments and additions, with particular reference to art. 1, paragraph 2;
HAVING REGARD to the report presented on the XX date, through his lawyer, by Mr. XX, with which the fact was complained that, with note prot. 3927 of 22 March 2018, the then Commander of the Latina Fire Brigade, where the interested party carries out his work, would have sent the Latina Police Headquarters a report of the medical-collegiate visit, drawn up by a Medical Commission verification in the context of a judgment of the employee's suitability for service, with a request to "carry out adequate checks regarding [...] [the license to carry firearms and/or possession of weapons] against the [the interested party] ”, on the assumption that the same "following the provisions of the Medical Commission, was deemed unfit for a period of 120 days". The report of the Medical Commission in question clearly reported the outcome of the medical-collegiate examination to which the interested party had been subjected, with an indication of the previous pathologies of the interested party, of the pharmacological therapy followed by the same and of the medical tests carried out by him as well as the diagnostic judgment (clear diagnosis). The Latina Police Headquarters, on the basis of the documentation received, would then have taken initiatives aimed at withdrawing the hunting license in the name of the interested party, as a result of which it was found that this license had long since expired;
HAVING ACKNOWLEDGED the note of the XX (prot. n. XX), with which the Ministry of the Interior (hereinafter, the "Ministry") responded to the request for information from the Guarantor of the XX (prot. n. XX), declaring , in particular, that:
with "note [dated] 22/3/2018 [was sent] to the Police Headquarters of Latina [...] medical documentation concerning the results of the assessment of suitability for the service to which [...] [the interested party] had been submitted to the competent Commission Hospital Doctor”;
"[...] it can be assumed that the pro tempore Commander of Latina, awaiting the judgment of unfitness for service for 120 days expressed by the aforementioned Commission and presumably having news of the possible ownership by [the] [interested] of license of firearms license, has deemed it necessary, in compliance with the principle of loyal institutional collaboration, to promptly inform the Quaestor, the provincial public safety authority, in a confidential/personal manner, so that he would have useful elements for the appropriate assessments and determinations in the scope of the competent preventive action to protect general safety and public and private safety";
"it would actually have resulted [...] that the Latina Police Commissioner revoked the firearms license of which [the interested party] was the holder".
HAVING ACKNOWLEDGED the note of the XX (prot. n. XX), with which the Latina Police Headquarters replied to the request for information from the Guarantor of the XX (prot. n. XX), declaring, in particular, that:
"on 29.03.2018, the local Provincial Command of the Fire Brigade, with a note signed by the then commander, informed [the] P.A.S.I. that one of its employees, subjected to a medical check by the Military Department of Forensic Medicine - Medical Hospital Commission of Rome, had been deemed NOT fit for service for a total of 120 days"; the same note informed the competent P.A.S.I. that [the interested party] was the owner of a valid firearms permit, as well as a firearms holder";
"for this reason, believing that it was necessary to inform the Authority of P.S. of the precarious health conditions of his employee, also attached to the aforesaid note the report issued by the forensic medicine body [, certifying] [...] the pathologies of a psychic nature";
“the current legislation, and in particular the art. 35, paragraph 7, of the T.U.L.P.S., provides that the license to carry firearms can be issued only upon presentation of a medical certificate, issued by a coroner (which is precisely the C.M.O.) or by a military doctor, which ascertains the full possession of all the psycho-physical requirements required of those who have to handle firearms. What these psycho-physical requirements should be was most recently established by the Decree of the Ministry of Health of 28 April 1998. Article 1, point 5) of the aforementioned Ministerial Decree expressly provides that the applicant must not be affected by mental, personality or behavioral disorders […]”;
"therefore, following the forwarding of the aforesaid medical report by the Provincial Command of the Fire Brigade, [the Latina Police Headquarters] was able to learn that, for [the] [interested party], the conditions which they had allowed both the issue of a firearms license and the possession of weapons”;
“article 11, paragraph 3, of the T.U.L.P.S. establishes that police authorizations must be revoked when the holder does not meet the conditions that had allowed their release (and psycho-physical fitness is certainly one of these), while article 39 of the same consolidated act provides that the Prefect can prohibit the possession of weapons, ammunition and explosive materials to people deemed capable of abusing them (and there is no doubt that a person suffering from mental disorders can be included among these)”;
“for these reasons the then manager of the P.A.S.I. deemed it appropriate to forward the aforementioned medical report both to the P.S. of Terracina (LT), or the office that had issued the license to carry firearms and which, therefore, should have provided for its revocation or suspension, which at the Carabinieri Station of Sonnino (LT), command at which [… ]l [interested] had reported his weapons and that, therefore, he should have provided for their precautionary withdrawal and to propose to the Prefect the issue of the decree referred to in article 39 of the T.U.L.P.S.";
"the medical report [...] constituted the only legal footing on which to base the administrative proceedings for the revocation of the license to carry firearms and for the decree prohibiting the possession of them, which is why the offices responsible for initiating the respective measures did not they could not have had the aforesaid document in their records”;
"[...] it is evident that in cases such as the one in question, the right to confidentiality and the protection of sensitive data must be placed at a lower level than the superior interest of the protection of public safety";
"in daily practice, the application aimed at issuing or renewing a license, with all the required documentation (including, in fact, the medical history certificate, which indicates all the pathologies from which the applicant suffers or has suffered and the drugs that he assumes), is delivered by the interested party to the Carabinieri station of the country in which he resides; from here it is then forwarded to the P.S. competent for the area, which must issue the qualification: however, where the aforementioned office finds that there are impediments to the issue, it forwards the entire procedure to the P.A.S.I. for the higher assessments and the initiation of a possible dispute. What happened in the case that involved [the interested party] followed exactly the same organizational scheme, even if developed "backwards".
“in the present case, in fact, it was the P.A.S.I. the first to acquire the health documentation, which it then sent to the two territorial offices for the duties of their specific competence";
GIVEN the note prot. no. XX of the XX of the Public Realities Department of this Authority, with which the preliminary procedure was defined, the reasons for which must be understood as fully referred to here, in which it is ascertained that the then Commander of the Latina Fire Brigade, in contravention of the prohibition to process the personal data of the interested party for further purposes, also relating to the state of health, transmitted such data to the Latina Police Headquarters, as well as that the Latina Police Headquarters sent the complete version of the aforementioned medical documentation to the Police Commissioner's Office. of Terracina (LT) and at the Carabinieri Station of Sonnino (LT), in both cases there was an illicit communication of personal data, also relating to health, in violation of articles 11, paragraph, 1 letter. a), and paragraph 2, 19, 20 and 22, of the Code, in the text prior to the amendments made by Legislative Decree 101/2018;
CONSIDERING that the Department has noted, in particular, that:
as clarified by the Guarantor since 2007 (see the "Guidelines on the processing of personal data of workers for the purpose of managing the employment relationship in the public sector", provision of 14 June 2007, doc. web no. 1417809, par. 8.4), public administrations can legitimately process data suitable for revealing the state of health of their employees, to ascertain, also ex officio, through the competent public health structures, the persistent suitability for the service, for the duties or for carrying out a profitable work (see, in particular, Presidential Decree 29 October 2001, n. 461). In arranging these investigations, the administrations must conform the treatment of the worker's health data in a manner aimed at preventing violations of the rights, fundamental freedoms and dignity of the data subject, also with reference to the right to the protection of personal data;
in the same Guidelines, it was pointed out that similar precautions must also be adopted by the health assessment bodies both when summoning the interested party to a medical-collegial visit, and when communicating the outcome of the checks carried out to the administration to which the worker, and possibly to the interested party himself. In particular, in the case of medical examinations aimed at ascertaining the employee's suitability for the service, duties or profitable work, in the light of the principle of indispensability, the medical boards must send the relevant examination report to the administration to which the person concerned belongs with the sole indication of the medico-legal judgment of suitability, unsuitability or other forms of incapacity (see art. 4, paragraphs 3 and 4, Presidential Decree n. 461/2001);
if reports indicating the diagnosis of the illness or injury that cause incapacity for work are transmitted by the health assessment bodies, "employers cannot, however, further use this information" ("Guidelines on processing of personal data of workers for the purpose of managing the employment relationship in the public sector", provision of 14 June 2007, web doc. no. 1417809, par. 8.4). This is because, as expressly provided for by art. 11, paragraph 2, of the Code, in the text prior to the amendments made by Legislative Decree 101/2018, "personal data processed in violation of the relevant regulations on the processing of personal data cannot be used":
the Authority has also invited the public administrations, on various occasions (see par. 5 of the aforementioned Guidelines), to adopt appropriate measures to prevent the unjustified disclosure of personal data, especially if sensitive or judicial, by of third parties unrelated to the administration or in any case of subjects who, within the administration, cannot be considered authorized for processing. Indeed, as stated on many occasions by the Guarantor, the personal data of employees, processed for the purpose of managing the employment relationship, cannot, as a rule, be disclosed to subjects other than those who are part of the specific employment relationship , or of those who are not entitled to process them, due to the tasks assigned and the organizational choices of the data controller. This is because the provision of data to subjects who, although belonging to the organization of the data controller, cannot be considered authorized for processing (see Article 30 of the Code, in the text prior to the amendments made by Legislative Decree 101/2018), due to the role they play and the functions performed within this organization, may give rise to a communication of personal data in the absence of a legal basis (see points 2, 4, 5.1 and 5.3 of the Guidelines cited above);
against the sending by the Medical Commission of the integral version of the report of the medical-collegiate visit, the personal data of the interested party, mentioned in this documentation, would therefore not have been able to be processed, for further purposes, by the of the employer;
the then Commander of the Latina Fire Brigade sent the aforesaid documentation to the Latina Police Headquarters, so that the latter could adopt the measures within its competence for the purpose of revoking a firearms license which the Commander assumed he held the interested party, having to note, in this regard, that the Ministry has not indicated any rule of law which expressly establishes the obligation for the Commander to make such communication, by transmitting the medical documentation in question;
on the other hand, the art. 153 of the royal decree 18 June 1931, no. 773 provides that "for the purposes of the supervision of the public safety authority, the practitioners of a health profession are obliged to report to the local public safety authority, within two days, the persons assisted or examined by them who are suffering from mental illness or from serious mental illness, which demonstrate or give suspicion of being dangerous to themselves or to others". Therefore, if the Medical Commission which carried out the examination of the interested party had found a pathology deemed incompatible with the possession of weapons and the license to carry firearms, it would itself have made the due notification to the local public safety authority, a circumstance which did not occur in the present case;
moreover, it does not appear that the then Commander of the Latina Fire Brigade had at his disposal certain and objective elements, as an employer, regarding the effective possession of weapons and the ownership of a firearms license on the part of the interested party, so much so that, from the documentation in the documents, it appears that the license which he held had already expired some time ago;
the then Commander of the Latina Fire Brigade, for the declared purpose of protecting public safety, did not however limit himself to informing the competent authorities in a general way regarding the existence of health conditions of the interested party potentially incompatible with the possession of weapons and the ownership of the firearms license, urging them to initiate the necessary checks within their competence, but provided the Latina Police Headquarters with the integral version of the medical documentation in question, which contained information relating to health and other detailed information, however excessive, such as the indication of the previous pathologies of the interested party, of the pharmacological therapy followed by the same and of the medical tests carried out by him, as well as the diagnostic judgment;
in the present case, the then Commander of the Latina Fire Brigade, in contravention of the prohibition to process the personal data of the interested party for other purposes, also relating to the state of health, which had been transmitted to him by the competent Medical Commission, has forwarded such data to the Police Headquarters of Latina, giving rise to an illicit communication of personal data, also relating to health;
the same considerations also apply in relation to the subsequent processing of personal data carried out by the Latina Police Headquarters, the latter having communicated the integral version of the aforementioned medical documentation to the P.S. of Terracina (LT) and at the Carabinieri station of Sonnino (LT);
CONSIDERING that the communications of the personal data in question took place on 22 March 2018 (see note prot. no. 3927 of the Latina Fire Brigade Command) and on 23 March 2018 (see note from the Latina Police Headquarters prot. No. 26473/2018), therefore, on a date prior to that in which Regulation (EU) 2016/679 became applicable (May 25, 2018) and that, therefore, the provisions contained in the Code regarding the protection of personal data (legislative decree 30 June 1003, n. 196) in the version prior to the reformulation of the same made by means of legislative decree n. 101/2018;
CONSIDERING the act of the XX (prot. n. XX) with which the Public Realities Department of the Guarantor contested the Ministry of the Interior, in the person of the pro-tempore legal representative, with registered office in Palazzo Viminale - 00184 Rome (RM) , tax code 97149560589, the violation of the provisions of articles 19 and 20 of the Code, sanctioned by article 162, paragraph 2-bis of the same Code, for having communicated personal data of the interested party, also relating to health;
NOTING that from the administrative report prepared by the Office, pursuant to art. 17 of law 24 November 1981 no. 689, the reduced payment pursuant to art. 16 of law 689/81;
NOTING that the Ministry, with note of the XX (prot. n. XX) presented a defense brief, representing, in particular, that:
"the behavior of the Commander of the Latina fire brigade is essentially attributable to an act of good faith, aimed exclusively at the priority protection of public safety, in the superior general public interest";
"[...] the Captain, having become aware of a potentially impeding element, in order not to engage in omissive behavior due to failure to report to the competent body, in balancing the interests at stake and in particular of the undoubtedly pre-eminent one of the protection of people's safety, deemed it necessary to promptly inform the competent Authority of the possible existence of a supervening requirement, such as to quickly request the reconsideration of the existence of the essential requirements for the issue/renewal of the firearms licence”;
"[...] otherwise, if the competent authority had not been informed and from this a possible criminal act had arisen due to possession of the weapon, one wonders whether aspects of possible liability would not have arisen also against those who , which public authority, having become aware of a potential impediment to possession of a weapon, had not informed the competent body, in addition to reflections of an ethical nature";
"what is relevant is in close connection with the need to provide information, considered crucial, to the competent provincial public safety authority which had to be made known with all urgency and for purposes of a preventive nature, the dangerousness of possession of the weapon, to safeguard the life and physical integrity of the data subject and any third parties”.
HAVING REGARD TO the report (prot. n. 48804) of the hearing of the data controller, held on the XX date, in which the Ministry declared, in particular, that:
"the Provincial Commander, due to previous serious episodes of violence with the use of firearms, which had occurred in the area, and being aware of the anomalous behavior of the person concerned in the workplace, as reported on several occasions by the colleagues of the same, deemed it necessary to report the particular health condition of the person concerned, as ascertained by the medical commission, to the competent authority for issuing firearms licences, considering that there was a concrete situation of danger to public safety" ;
"if he had not made this report, the Provincial Commander would have been held personally responsible in the event of any accidents, for not having taken action with the competent authorities, despite being aware of the particular state of health [of the person concerned], relating to the psychiatric sphere , and of the same possession of firearms”;
"the Court of Cassation ruled in the sense of deeming an exchange of personal data between public entities lawful in a scenario similar to that covered by the report in question (XX of XX)";
"the events subject to reporting took place in an extremely delicate context, due to the improper conduct of the person concerned in the working context, which aroused alarm and concern within the barracks, due to the well-known fact that the same was in possession of firearms”;
"it is in this context that the Commander, also in his capacity as a public official, as well as a member of the Provincial Committee for Public Order and Security, felt he had to report the matter to the Quaestor (who had expressly asked to provide formal elements in support of what was intended to be reported), with direct delivery to the person of the Police Headquarters of the documentation required for the purpose of starting the investigation by the Police Headquarters. Whilst the Medical Commission had informed the Civil Vehicle Authority about the condition of the person concerned, as it was incompatible with the possession of a driving licence, the Commission had also not informed the competent authorities regarding the license to carry firearms, and, therefore, the communication of the personal data in question was made an act not only appropriate but also due”;
"we therefore acted in the full conviction of operating to protect public safety and in the interest of the interested party himself, who has not suffered any damage due to the work of the Administration. This also to protect the vital interests of some colleagues of the interested party, who had represented episodes in which they had felt in danger in dealing with the same ";
"as for the forwarding of the aforesaid documentation by the Police Headquarters to the Carabinieri, it should be noted that such forwarding is due when, as in the present case, the interested party is a resident of a Municipality which is not the provincial capital or of the Police Commissioner".
CONSIDERING that what was represented in the aforementioned defense brief and during the hearing did not allow the findings notified by the Office to be overcome since, as already highlighted, the then Commander of the Latina Fire Brigade could have just as effectively pursued the declared public interest , consisting in the protection of workers' safety and public safety, by making a report to the competent authorities, urging them to activate the controls for which they are responsible, without forwarding to them a complete copy of the medical documentation relating to the person concerned; it is also noted that the sentence of the Court of Cassation referred to by the data controller in his defense refers to a different and ineffective case in which a healthcare company had "transmitted a copy of the medical record at the request of the police authority for" urgent investigations by the magistrate, in a proceeding for the revocation of the license to carry firearms, which actually took place";
NOTING that, on the basis of the reasons referred to in the administrative dispute of the XX (prot. n. XX), which are understood to be referred to in full and confirmed here, the Ministry of the Interior, in the person of the pro-tempore legal representative, as owner of the treatment, appears to have committed the violation of the provisions of Articles 19 and 20 of the Code, sanctioned by art. 162, paragraph 2-bis, of the same Code, for having made communications of personal data to unauthorized subjects in the absence of a legal basis;
CONSIDERING the art. 162, paragraph 2-bis of the Code, which punishes the violations indicated in art. 167, including violations relating to articles 19 and 20 of the same Code, with the administrative sanction of payment of a sum from Euro 10,000.00 (ten thousand) to Euro 120,000.00 (one hundred and twenty thousand);
CONSIDERING that, for the present case, the reduction provided for by art. 164-bis, paragraph 1, of the Code, since it appears from the documentation in the records that the Ministry, the data controller, acted in good faith, in the belief that the disclosure of the personal data in question was required by law for the purposes of protection of occupational safety and public utility, a circumstance which, even if it has been duly taken into consideration, is not in any case sufficient to justify, in terms of data protection, the conduct adopted;
CONSIDERING, therefore, that the sanction provided for by the aforementioned art. 162, paragraph 2-bis, of the Code, restated pursuant to the aforementioned art. 164-bis, paragraph 1, of the same Code, varies from a minimum of Euro 4,000.00 to a maximum of Euro 48,000.00;
CONSIDERING that with the aforementioned administrative dispute of the XX (prot. n. XX), sent on XX (note prot. n. XX), the Guarantor informed the Ministry of the Interior of the possibility of making use of the option to make the payment, within the peremptory term of 60 days from the date of notification of the dispute, of the sum established at 4,000.00 (four thousand) euros;
CONSIDERING that the Ministry of the Interior has not made use of this faculty;
CONSIDERING that, for the purpose of determining the amount of the pecuniary sanction, it is necessary to take into account, pursuant to art. 11 of the law of 24 November 1981 n. 689, among other things, of the seriousness of the violation, and that therefore the amount of the pecuniary sanction must be quantified as 4,000.00 (four thousand) euros;
HAVING REGARD to the documentation in the deeds;
HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000, adopted with resolution of 28 June 2000;
SPEAKER Prof. Geneva Cerrina Feroni;
ORDER
to the Ministry of the Interior, in the person of its pro-tempore legal representative, with registered office in Palazzo Viminale - 00184 Rome (RM), Tax Code 97149560589, to pay the sum of 4,000.00 (four thousand) euros, as a pecuniary administrative sanction for the violation of the provisions of art. 19 and 20 of the same Code for having communicated personal data of the interested party, also relating to health, without a suitable legal prerequisite;
ENJOYS
to the same Ministry to pay the sum of 4,000.00 (four thousand) euros according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of adopting the consequent executive acts pursuant to art. 27 of the law 24 November 1981, no. 689.
Pursuant to articles 152 of the Code and 10 of Legislative Decree no. 150/2011, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged with the ordinary court of the place where the data controller has his residence, within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.
Rome, 23 March 2023
PRESIDENT
Station
THE SPEAKER
Cerrina Feroni
THE SECRETARY GENERAL
Matthew
[doc. web no. 9885151]
Provision of 23 March 2023
Register of measures
no. 82 of 23 March 2023
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer. Guido Scorza, components and the cons. Fabio Mattei, general secretary;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data and repealing Directive 95/46/ CE, “General Data Protection Regulation” (hereinafter, “Regulation”);
HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 containing the "Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data, as well as to the free movement of such data and which repeals Directive 95/46/EC” (hereinafter the “Code”);
GIVEN the l. no. 689/1981 and subsequent amendments and additions, with particular reference to art. 1, paragraph 2;
HAVING REGARD to the report presented on the XX date, through his lawyer, by Mr. XX, with which the fact was complained that, with note prot. 3927 of 22 March 2018, the then Commander of the Latina Fire Brigade, where the interested party carries out his work, would have sent the Latina Police Headquarters a report of the medical-collegiate visit, drawn up by a Medical Commission verification in the context of a judgment of the employee's suitability for service, with a request to "carry out adequate checks regarding [...] [the license to carry firearms and/or possession of weapons] against the [the interested party] ”, on the assumption that the same "following the provisions of the Medical Commission, was deemed unfit for a period of 120 days". The report of the Medical Commission in question clearly reported the outcome of the medical-collegiate examination to which the interested party had been subjected, with an indication of the previous pathologies of the interested party, of the pharmacological therapy followed by the same and of the medical tests carried out by him as well as the diagnostic judgment (clear diagnosis). The Latina Police Headquarters, on the basis of the documentation received, would then have taken initiatives aimed at withdrawing the hunting license in the name of the interested party, as a result of which it was found that this license had long since expired;
HAVING ACKNOWLEDGED the note of the XX (prot. n. XX), with which the Ministry of the Interior (hereinafter, the "Ministry") responded to the request for information from the Guarantor of the XX (prot. n. XX), declaring , in particular, that:
with "note [dated] 22/3/2018 [was sent] to the Police Headquarters of Latina [...] medical documentation concerning the results of the assessment of suitability for the service to which [...] [the interested party] had been submitted to the competent Commission Hospital Doctor”;
"[...] it can be assumed that the pro tempore Commander of Latina, awaiting the judgment of unfitness for service for 120 days expressed by the aforementioned Commission and presumably having news of the possible ownership by [the] [interested] of license of firearms license, has deemed it necessary, in compliance with the principle of loyal institutional collaboration, to promptly inform the Quaestor, the provincial public safety authority, in a confidential/personal manner, so that he would have useful elements for the appropriate assessments and determinations in the scope of the competent preventive action to protect general safety and public and private safety";
"it would actually have resulted [...] that the Latina Police Commissioner revoked the firearms license of which [the interested party] was the holder".
HAVING ACKNOWLEDGED the note of the XX (prot. n. XX), with which the Latina Police Headquarters replied to the request for information from the Guarantor of the XX (prot. n. XX), declaring, in particular, that:
"on 29.03.2018, the local Provincial Command of the Fire Brigade, with a note signed by the then commander, informed [the] P.A.S.I. that one of its employees, subjected to a medical check by the Military Department of Forensic Medicine - Medical Hospital Commission of Rome, had been deemed NOT fit for service for a total of 120 days"; the same note informed the competent P.A.S.I. that [the interested party] was the owner of a valid firearms permit, as well as a firearms holder";
"for this reason, believing that it was necessary to inform the Authority of P.S. of the precarious health conditions of his employee, also attached to the aforesaid note the report issued by the forensic medicine body [, certifying] [...] the pathologies of a psychic nature";
“the current legislation, and in particular the art. 35, paragraph 7, of the T.U.L.P.S., provides that the license to carry firearms can be issued only upon presentation of a medical certificate, issued by a coroner (which is precisely the C.M.O.) or by a military doctor, which ascertains the full possession of all the psycho-physical requirements required of those who have to handle firearms. What these psycho-physical requirements should be was most recently established by the Decree of the Ministry of Health of 28 April 1998. Article 1, point 5) of the aforementioned Ministerial Decree expressly provides that the applicant must not be affected by mental, personality or behavioral disorders […]”;
"therefore, following the forwarding of the aforesaid medical report by the Provincial Command of the Fire Brigade, [the Latina Police Headquarters] was able to learn that, for [the] [interested party], the conditions which they had allowed both the issue of a firearms license and the possession of weapons”;
“article 11, paragraph 3, of the T.U.L.P.S. establishes that police authorizations must be revoked when the holder does not meet the conditions that had allowed their release (and psycho-physical fitness is certainly one of these), while article 39 of the same consolidated act provides that the Prefect can prohibit the possession of weapons, ammunition and explosive materials to people deemed capable of abusing them (and there is no doubt that a person suffering from mental disorders can be included among these)”;
“for these reasons the then manager of the P.A.S.I. deemed it appropriate to forward the aforementioned medical report both to the P.S. of Terracina (LT), or the office that had issued the license to carry firearms and which, therefore, should have provided for its revocation or suspension, which at the Carabinieri Station of Sonnino (LT), command at which [… ]l [interested] had reported his weapons and that, therefore, he should have provided for their precautionary withdrawal and to propose to the Prefect the issue of the decree referred to in article 39 of the T.U.L.P.S.";
"the medical report [...] constituted the only legal footing on which to base the administrative proceedings for the revocation of the license to carry firearms and for the decree prohibiting the possession of them, which is why the offices responsible for initiating the respective measures did not they could not have had the aforesaid document in their records”;
"[...] it is evident that in cases such as the one in question, the right to confidentiality and the protection of sensitive data must be placed at a lower level than the superior interest of the protection of public safety";
"in daily practice, the application aimed at issuing or renewing a license, with all the required documentation (including, in fact, the medical history certificate, which indicates all the pathologies from which the applicant suffers or has suffered and the drugs that he assumes), is delivered by the interested party to the Carabinieri station of the country in which he resides; from here it is then forwarded to the P.S. competent for the area, which must issue the qualification: however, where the aforementioned office finds that there are impediments to the issue, it forwards the entire procedure to the P.A.S.I. for the higher assessments and the initiation of a possible dispute. What happened in the case that involved [the interested party] followed exactly the same organizational scheme, even if developed "backwards".
“in the present case, in fact, it was the P.A.S.I. the first to acquire the health documentation, which it then sent to the two territorial offices for the duties of their specific competence";
GIVEN the note prot. no. XX of the XX of the Public Realities Department of this Authority, with which the preliminary procedure was defined, the reasons for which must be understood as fully referred to here, in which it is ascertained that the then Commander of the Latina Fire Brigade, in contravention of the prohibition to process the personal data of the interested party for further purposes, also relating to the state of health, transmitted such data to the Latina Police Headquarters, as well as that the Latina Police Headquarters sent the complete version of the aforementioned medical documentation to the Police Commissioner's Office. of Terracina (LT) and at the Carabinieri Station of Sonnino (LT), in both cases there was an illicit communication of personal data, also relating to health, in violation of articles 11, paragraph, 1 letter. a), and paragraph 2, 19, 20 and 22, of the Code, in the text prior to the amendments made by Legislative Decree 101/2018;
CONSIDERING that the Department has noted, in particular, that:
as clarified by the Guarantor since 2007 (see the "Guidelines on the processing of personal data of workers for the purpose of managing the employment relationship in the public sector", provision of 14 June 2007, web doc. n. 1417809, par. 8.4), the public administrations can legitimately process data suitable for revealing the state of health of their employees, to ascertain, also ex officio, through the competent public health structures, the persistent suitability for the service, the duties or the performance of a fruitful work (see, in particular, Presidential Decree 29 October 2001, n. 461). In arranging these investigations, the administrations must conform the treatment of the worker's health data in a manner aimed at preventing violations of the rights, fundamental freedoms and dignity of the data subject, also with reference to the right to the protection of personal data;
in the same Guidelines, it was pointed out that similar precautions must also be adopted by the health assessment bodies both when summoning the interested party to a medical-collegial visit, and when communicating the outcome of the checks carried out to the administration to which the worker, and possibly to the interested party himself. In particular, in the case of medical examinations aimed at ascertaining the employee's suitability for the service, duties or profitable work, in the light of the principle of indispensability, the medical boards must send the relevant examination report to the administration to which the person concerned belongs with the sole indication of the medico-legal judgment of suitability, unsuitability or other forms of incapacity (see art. 4, paragraphs 3 and 4, Presidential Decree n. 461/2001);
if reports are sent by the health assessment bodies indicating the diagnosis of the illness or injury that lead to incapacity for work, "employers cannot, in any case, further use this information" ("Guidelines on processing of personal data of workers for the purpose of managing the employment relationship in the public sector", provision of 14 June 2007, web doc. no. 1417809, par. 8.4). This is because, as expressly provided for by art. 11, paragraph 2, of the Code, in the text prior to the amendments made by Legislative Decree 101/2018, "personal data processed in violation of the relevant regulations on the processing of personal data cannot be used":
the Authority has also invited the public administrations, on various occasions (see par. 5 of the aforementioned Guidelines), to adopt appropriate measures to prevent the unjustified disclosure of personal data, especially if sensitive or judicial, by of third parties unrelated to the administration or in any case of subjects who, within the administration, cannot be considered authorized for processing. Indeed, as stated on many occasions by the Guarantor, the personal data of employees, processed for the purpose of managing the employment relationship, cannot, as a rule, be disclosed to subjects other than those who are part of the specific employment relationship , or of those who are not entitled to process them, due to the tasks assigned and the organizational choices of the data controller. This is because the provision of data to subjects who, although belonging to the organization of the data controller, cannot be considered authorized for processing (see Article 30 of the Code, in the text prior to the amendments made by Legislative Decree 101/2018), due to the role they play and the functions performed within this organization, may give rise to a communication of personal data in the absence of a legal basis (see points 2, 4, 5.1 and 5.3 of the Guidelines cited above);
against the sending by the Medical Commission of the integral version of the report of the medical-collegiate visit, the personal data of the interested party, mentioned in this documentation, would therefore not have been able to be processed, for further purposes, by the of the employer;
the then Commander of the Latina Fire Brigade sent the aforesaid documentation to the Latina Police Headquarters, so that the latter could adopt the measures within its competence for the purpose of revoking a firearms license which the Commander assumed he held the interested party, having to note, in this regard, that the Ministry has not indicated any rule of law which expressly establishes the obligation for the Commander to make such communication, by transmitting the medical documentation in question;
on the other hand, the art. 153 of the royal decree 18 June 1931, no. 773 provides that "for the purposes of the supervision of the public safety authority, the practitioners of a health profession are obliged to report to the local public safety authority, within two days, the persons assisted or examined by them who are suffering from mental illness or from serious mental illness, which demonstrate or give suspicion of being dangerous to themselves or to others". Therefore, if the Medical Commission which carried out the examination of the interested party had found a pathology deemed incompatible with the possession of weapons and the license to carry firearms, it would itself have made the due notification to the local public safety authority, a circumstance which did not occur in the present case;
moreover, it does not appear that the then Commander of the Latina Fire Brigade had at his disposal certain and objective elements, as an employer, regarding the effective possession of weapons and the ownership of a firearms license on the part of the interested party, so much so that, from the documentation in the documents, it appears that the license which he held had already expired some time ago;
the then Commander of the Latina Fire Brigade, for the declared purpose of protecting public safety, did not however limit himself to informing the competent authorities in a general way regarding the existence of health conditions of the interested party potentially incompatible with the possession of weapons and the ownership of the firearms license, urging them to initiate the necessary checks within their competence, but provided the Latina Police Headquarters with the integral version of the medical documentation in question, which contained information relating to health and other detailed information, however excessive, such as the indication of the previous pathologies of the interested party, of the pharmacological therapy followed by the same and of the medical tests carried out by him, as well as the diagnostic judgment;
in the present case, the then Commander of the Latina Fire Brigade, in contravention of the prohibition to process the personal data of the interested party for other purposes, also relating to the state of health, which had been transmitted to him by the competent Medical Commission, has forwarded such data to the Police Headquarters of Latina, giving rise to an illicit communication of personal data, also relating to health;
the same considerations also apply in relation to the subsequent processing of personal data carried out by the Latina Police Headquarters, the latter having communicated the integral version of the aforementioned medical documentation to the P.S. of Terracina (LT) and at the Carabinieri station of Sonnino (LT);
CONSIDERING that the communications of the personal data in question took place on 22 March 2018 (see note prot. no. 3927 of the Latina Fire Brigade Command) and on 23 March 2018 (see note from the Latina Police Headquarters prot. No. 26473/2018), therefore, on a date prior to that in which Regulation (EU) 2016/679 became applicable (May 25, 2018) and that, therefore, the provisions contained in the Code regarding the protection of personal data (legislative decree 30 June 1003, n. 196) in the version prior to the reformulation of the same made by means of legislative decree n. 101/2018;
CONSIDERING the act of the XX (prot. n. XX) with which the Public Realities Department of the Guarantor contested the Ministry of the Interior, in the person of the pro-tempore legal representative, with registered office in Palazzo Viminale - 00184 Rome (RM) , tax code 97149560589, the violation of the provisions of articles 19 and 20 of the Code, sanctioned by article 162, paragraph 2-bis of the same Code, for having communicated personal data of the interested party, also relating to health;
NOTING that from the administrative report prepared by the Office, pursuant to art. 17 of law 24 November 1981 no. 689, the reduced payment pursuant to art. 16 of law 689/81;
NOTING that the Ministry, with note of the XX (prot. n. XX) presented a defense brief, representing, in particular, that:
"the behavior of the Commander of the Latina fire brigade is essentially attributable to an act of good faith, aimed exclusively at the priority protection of public safety, in the superior general public interest";
"[...] the Captain, having become aware of a potentially impeding element, in order not to engage in omissive behavior due to failure to report to the competent body, in balancing the interests at stake and in particular of the undoubtedly pre-eminent one of the protection of people's safety, deemed it necessary to promptly inform the competent Authority of the possible existence of a supervening requirement, such as to quickly request the reconsideration of the existence of the essential requirements for the issue/renewal of the firearms licence”;
"[...] otherwise, if the competent authority had not been informed and from this a possible criminal act had arisen due to possession of the weapon, one wonders whether aspects of possible liability would not have arisen also against those who , which public authority, having become aware of a potential impediment to possession of a weapon, had not informed the competent body, in addition to reflections of an ethical nature";
"what is relevant is in close connection with the need to provide information, considered crucial, to the competent provincial public safety authority which had to be made known with all urgency and for purposes of a preventive nature, the dangerousness of possession of the weapon, to safeguard the life and physical integrity of the data subject and any third parties”.
HAVING REGARD TO the report (prot. n. 48804) of the hearing of the data controller, held on the XX date, in which the Ministry declared, in particular, that:
"the Provincial Commander, due to previous serious episodes of violence with the use of firearms, which had occurred in the area, and being aware of the anomalous behavior of the person concerned in the workplace, as reported on several occasions by the colleagues of the same, deemed it necessary to report the particular health condition of the person concerned, as ascertained by the medical commission, to the competent authority for issuing firearms licences, considering that there was a concrete situation of danger to public safety" ;
"if he had not made this report, the Provincial Commander would have been held personally responsible in the event of any accidents, for not having taken action with the competent authorities, despite being aware of the particular state of health [of the person concerned], relating to the psychiatric sphere , and of the same possession of firearms”;
"the Court of Cassation ruled in the sense of deeming an exchange of personal data between public entities lawful in a scenario similar to that covered by the report in question (XX of XX)";
"the events subject to reporting took place in an extremely delicate context, due to the improper conduct of the person concerned in the working context, which aroused alarm and concern within the barracks, due to the well-known fact that the same was in possession of firearms”;
"it is in this context that the Commander, also in his capacity as a public official, as well as a member of the Provincial Committee for Public Order and Security, felt he had to report the matter to the Quaestor (who had expressly asked to provide formal elements in support of what was intended to be reported), with direct delivery to the person of the Police Headquarters of the documentation required for the purpose of starting the investigation by the Police Headquarters. Whilst the Medical Commission had informed the Civil Vehicle Authority about the condition of the person concerned, as it was incompatible with the possession of a driving licence, the Commission had also not informed the competent authorities regarding the license to carry firearms, and, therefore, the communication of the personal data in question was made an act not only appropriate but also due”;
"we therefore acted in the full conviction of operating to protect public safety and in the interest of the interested party himself, who has not suffered any damage due to the work of the Administration. This also to protect the vital interests of some colleagues of the interested party, who had represented episodes in which they had felt in danger in dealing with the same ";
"as for the forwarding of the aforesaid documentation by the Police Headquarters to the Carabinieri, it should be noted that such forwarding is due when, as in the present case, the interested party is a resident of a Municipality which is not the provincial capital or of the Police Commissioner".
CONSIDERING that what was represented in the aforementioned defense brief and during the hearing did not allow the findings notified by the Office to be overcome since, as already highlighted, the then Commander of the Latina Fire Brigade could have just as effectively pursued the declared public interest , consisting in the protection of workers' safety and public safety, by making a report to the competent authorities, urging them to activate the controls for which they are responsible, without forwarding to them a complete copy of the medical documentation relating to the person concerned; it is also noted that the sentence of the Court of Cassation referred to by the data controller in his defense refers to a different and ineffective case in which a healthcare company had "transmitted a copy of the medical record at the request of the police authority for" urgent investigations by the magistrate, in a proceeding for the revocation of the license to carry firearms, which actually took place";
NOTING that, on the basis of the reasons referred to in the administrative dispute of the XX (prot. n. XX), which are understood to be referred to in full and confirmed here, the Ministry of the Interior, in the person of the pro-tempore legal representative, as owner of the treatment, appears to have committed the violation of the provisions of Articles 19 and 20 of the Code, sanctioned by art. 162, paragraph 2-bis, of the same Code, for having made communications of personal data to unauthorized subjects in the absence of a legal basis;
CONSIDERING the art. 162, paragraph 2-bis of the Code, which punishes the violations indicated in art. 167, including violations relating to articles 19 and 20 of the same Code, with the administrative sanction of payment of a sum from Euro 10,000.00 (ten thousand) to Euro 120,000.00 (one hundred and twenty thousand);
CONSIDERING that, for the present case, the reduction provided for by art. 164-bis, paragraph 1, of the Code, since it appears from the documentation in the records that the Ministry, the data controller, acted in good faith, in the belief that the disclosure of the personal data in question was required by law for the purposes of protection of occupational safety and public utility, a circumstance which, even if it has been duly taken into consideration, is not in any case sufficient to justify, in terms of data protection, the conduct adopted;
CONSIDERING, therefore, that the sanction provided for by the aforementioned art. 162, paragraph 2-bis, of the Code, restated pursuant to the aforementioned art. 164-bis, paragraph 1, of the same Code, varies from a minimum of Euro 4,000.00 to a maximum of Euro 48,000.00;
CONSIDERING that with the aforementioned administrative dispute of the XX (prot. n. XX), sent on XX (note prot. n. XX), the Guarantor informed the Ministry of the Interior of the possibility of making use of the option to make the payment, within the peremptory term of 60 days from the date of notification of the dispute, of the sum established at 4,000.00 (four thousand) euros;
CONSIDERING that the Ministry of the Interior has not made use of this option;
CONSIDERING that, for the purpose of determining the amount of the pecuniary sanction, it is necessary to take into account, pursuant to art. 11 of the law of 24 November 1981 n. 689, among other things, of the seriousness of the violation, and that therefore the amount of the pecuniary sanction must be quantified as 4,000.00 (four thousand) euros;
HAVING REGARD to the documentation in the deeds;
HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000, adopted with resolution of 28 June 2000;
SPEAKER Prof. Geneva Cerrina Feroni;
ORDER
to the Ministry of the Interior, in the person of its pro-tempore legal representative, with registered office in Palazzo Viminale - 00184 Rome (RM), Tax Code 97149560589, to pay the sum of 4,000.00 (four thousand) euros, as a pecuniary administrative sanction for the violation of the provisions of art. 19 and 20 of the same Code for having communicated personal data of the interested party, also relating to health, without a suitable legal prerequisite;
ENJOYS
to the same Ministry to pay the sum of 4,000.00 (four thousand) euros according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of adopting the consequent executive acts pursuant to art. 27 of the law 24 November 1981, no. 689.
Pursuant to articles 152 of the Code and 10 of Legislative Decree no. 150/2011, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged with the ordinary court of the place where the data controller has his residence, within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.
Rome, 23 March 2023
PRESIDENT
station
THE SPEAKER
Cerrina Feroni
THE SECRETARY GENERAL
Matthew
