Garante per la protezione dei dati personali (Italy) - 9932951

Garante per la protezione dei dati personali - 9932951

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5 GDPR Article 5(1)(a) GDPR Article 22 GDPR Article 58(2)(i) GDPR Article 83 GDPR Article 136 Codice Privacy Article 137(3) Codice Privacy Article 139 Codice Privacy Article 6 Regole Deontologiche
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	31.08.2023
Published:	26.09.2023
Fine:	10,000 EUR
Parties:	RCS Mediagroup S.p.a
National Case Number/Name:	9932951
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	Garante per la Protezione dei Dati Personali (in IT)
Initial Contributor:	ar

The Italian DPA fined an international multimedia publishing group €10,000 for having published in an online newspaper article the personal data of a witness of a will, who was a private person. By publishing it, the online newspaper made the data available on the Internet to an indeterminate number of people - well beyond the circle of their acquaintances.

English Summary

Facts

On 17 February 2023 the complainant brought a case to the Italian DPA claiming a violation of her data protection right concerning the dissemination by an Italian newspaper on 23 January 2023 of an article containing a picture of a holographic will of an actress. According to the complainant, the will clearly showed the name, date, place of birth, address and title of witness assumed by the complainant.

The complainant further asserted to have requested RCS Mediagroup S.p.a (the data controller) to exercise her rights provided for from Article 15 GDPR to Article 22 GDPR but did not receive feedback. On 2 March 2023, the Italian DPA requested the data controller to respond to the complainant’s requests and to state whether they would comply with them.

On 21 March 2023, the data controller declared that the will is a public deed which can be accessed by anyone with an interest and that the information of the witnesses is an integral part of that public deed. Hence, the public nature of the will deprived it of any confidentiality, and the photograph of the page of the will and the publication of the complainant’s personal data took place lawfully.

To which the complainant responded that Article 6 of the Deontological Rules, which states that the disclosure of news of major public or social interest is not contrary to respect for the private sphere when the information is indispensable, does not apply and that the data controller should have refrained from disseminating the data of the complainant.

Following this, the DPA issued a statement of the commencement of proceedings.

Holding

The DPA assessed that the failure to reply to the request of the complainant by the data controller could be considered excusable since the complainant made an unclear request, as it referred to compensation for damages and to a streaming reproduction that the data controller never carried out.

However, it also found that the data controller breached Article 136 of the Italian Privacy Code, Article 137(3) of the Italian Privacy Code, Article 139 of the Italian Privacy Code and Article 6 of the Deontological Rules, and to the general principles of lawfulness and fairness in the processing of personal data set out in Article 5(1)(a) GDPR.

The DPA stated that a will is not a public document to which anyone with an interest may have access, even if such data was public and acquired lawfully. Moreover, the fact that the complainant's data were essential for the validity of the holographic will did not make them essential for the right to report, which could have been pursued without providing all the complainant’s personal data. In fact, the data disseminated were more than those necessary for proper information as it exposed the data subject well beyond the circle of her acquaintances, as by publishing it, the online newspaper made the data available on the Internet to an indeterminate number of people. Since the complainant was not a public figure, the reproduction had to be subject to the requirements of fairness, relevance, non-excessiveness and necessity in relation to the public interest concerned.

Thus, the DPA prohibited the data controller from further processing the complainant’s first and last name, date of birth and address of residence, and it fined the data controller €10,000 under Article 58(2)(i) GDPR and Article 83 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

SEE ALSO Newsletter of 26 September 2023

[doc. web no. 9932951]

Provision of 31 August 2023

Register of measures
n. 366 of 31 August 2023

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members, and Dr. Fabio Mattei, general secretary;

HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”);

HAVING REGARD to the Code regarding the protection of personal data, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”);

GIVEN the complaint presented to the Guarantor on 17 February 2023, pursuant to art. 77 of the Regulations, with which Mrs. XX, represented and defended by the lawyer. XX, complained of a violation of the current legislation on the protection of personal data in relation to the dissemination, on 23 January 2023, on the Corriere della Sera website, of an article entitled: "XX", containing a photographic reproduction of the holographic will of the actress XX, who died on 16 January 2023, drawn up on 5 January 2017. In the holographic will the name, date, place of birth, residence address and the role of witness assumed are visible, for the purposes of the testamentary procedure, by the complainant, at the time working in the solvent department of the XX health facility, where Ms. XX was hospitalized. Following the publication of the article, the complainant also complained that she had been contacted by acquaintances and journalists who wanted information;

CONSIDERING that the complainant represented that she had previously exercised the right referred to in the articles. 15 and 22 of the Regulation against RCS Mediagroup S.p.a., data controller, without having received any feedback;

HAVING REGARD to the note dated 2 March 2023 with which this Authority asked RCS Mediagroup S.p.a., as publisher of Il Corriere della Sera, to provide feedback to the complainant's requests and to make known whether there was an intention to comply with them;

GIVEN the note dated 21 March 2023, with which RCS Mediagroup S.p.a. stated the following:

- the will is a public document, which can be accessed by anyone interested in it, and therefore Il Corriere della Sera published the article, also reproducing an image of the first page of the will, drawn up on 5 January 2017 in Rome, in the presence of two witnesses, known to the notary, one of whom was Mrs. XX;

- the personal details of the witnesses constitute an integral part of that public document, their presence being necessary for the entire duration of the compilation of the will;

- the public nature of the will deprives it of any profile of confidentiality, as it is in the interest of those who become aware of it to also know the identity of the witnesses, whose presence is essential for its validity;

- the photographic reproduction of the will page and the publication of the personal data therefore took place lawfully;

GIVEN the note from the complainant, received on 30 March 2023, with which, in response to the observations made by RCS Mediagroup S.p.a., she highlighted that:

- in this case, the hypotheses indicated by the art. do not exist. 6 of the "Ethical rules relating to the processing of personal data in the exercise of journalistic activity" (hereinafter "Ethical rules") referred to in art. 139 of the Code, according to which the disclosure of news of significant public or social interest does not conflict with respect for the private sphere "when the information, even detailed, is indispensable due to the originality of the fact or the relative description of the methods details in which it occurred, as well as the qualification of the protagonists";

- therefore the journalist, in order to be free from censorship and responsibility and not to damage the right to privacy of the complainant, should have refrained from disseminating names and data of subjects connected to the protagonists only due to mere factual circumstances, as in the case in question.

GIVEN the note from this Authority dated 1 June 2023, with which, pursuant to art. 166, paragraph 5, of the Code, the data controller has been notified of the start of the procedure for the possible adoption of the measures referred to in the art. 58, par. 2 of the Regulation and the same owner was also notified of the alleged violations of the art. 5 of the Regulation and the articles. 2-quater, paragraph 4, 137 and 139 of the Code and art. 6 of the Rules of Ethics and finally, in relation to the profile relating to the exercise of rights, an alleged violation of the articles. 15-22 of the Regulation;

GIVEN the note dated 22 June 2023, with which RCS Mediagroup S.p.a. stated that:

- as a preliminary matter, with regards to the dispute relating to the lack of response, the Company assessed the request, noting that it was in fact aimed at obtaining compensation for damage which was not, however, demonstrated and concluded that it was not acceptable, without it being necessary to inform the interested party; furthermore, the request made a difficult to understand request, where it was asked to make the interested party's data no longer visible in the broadcast available in streaming, while RCS had limited itself to publishing a news article and a photo on the Il Corriere della Sera website of the title page of Mrs. XX's will;

- as regards the aspects of substance, the will has been reproduced in its entirety, the presence and identity of the witnesses being essential for its validity, forming an integral part of it. In fact, to ensure impartiality the witness must not be interested in the deed and must not be a relative or similar to the notary or one of the parties, so the indication of his personal details is also essential to allow the parties or third parties to verify it compatibility with the office;

- therefore the processing of the interested party's personal data was essential in order to provide readers with all the essential data of the reproduced document;

- personal data may be processed if relating to "news of significant public interest", such as the actress's will, and detailed information and photographic reproduction of the first page of the will must also be considered indispensable;

- all personal details referring to the complainant and the other witness have been deleted from the reproduction of the will page. In fact, after the notification of the start of the procedure, the Company immediately took action to eliminate from the website www.corriere.it the images affected by the reported processing, which were removed. No further reference to the name and role of the complainant was published;

CONSIDERING that, unless the fact constitutes a more serious crime, anyone who, in proceedings before the Guarantor, falsely declares or certifies information or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code “False statements to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”;

PRELIMINARYLY NOTED that the failure to respond to the request can be considered excusable, as the request made was not actually clear, referring to compensation for damages and a streaming reproduction that RCS Mediagroup S.p.a. never performed;

CONSIDERING, therefore, that the conditions for accepting the relevant request do not exist;

Whereas:

- the article under dispute must be traced back to the processing carried out in the exercise of freedom of expression and therefore the articles apply in their entirety. 136 − 139 of the Code and the ethical rules referred to in art. 139 of the Code itself;

- the art. 137, paragraph 3, of the Code and art. 6 of the Rules of Ethics identify the principle of "essentiality of information regarding facts of public interest" as a limit to the dissemination of personal data for the purposes described, which the journalist is required to respect;

NOTING that compliance with the aforementioned Rules of Ethics constitutes an essential condition for the lawfulness and correctness of the processing of personal data (art. 2-quater of the Code);

NOTED that:

- the article in question is in conflict with these provisions, and in particular with the principle of essentiality of information, as it publishes all the identifying data of the complainant (name, surname, date of birth, address of residence), which they were all subsequently deleted by the data controller following the initiation of the proceeding; in this way, data in excess of that necessary for correct information was disseminated, which exposed the interested party to attention that goes well beyond the circle of her acquaintances, without the dissemination of her data being essential to the news;

- the argument that the will is a public document that can be accessed by anyone who has an interest in it cannot be shared, given that consultation of the register of wills at the Ministry of Justice is regulated by sector regulations; the reproduction of such data, although public and lawfully acquired, on online newspapers ends up making data relating to individuals available on the Internet to an indeterminate number of people. This reproduction, especially where it does not involve public figures, is therefore subject to the usual parameters of essentiality with respect to the fact of public interest narrated, of correctness, of relevance and of non-excessiveness (see provision n. 22 of 24 November 2023 and the document “Privacy and journalism. Some clarifications in response to questions from the Journalists' Association - 6 May 2004" [doc. web no. 1007634];

- essentially, the fact that the complainant's data are essential for the purposes of the validity of the holographic will, this does not mean that they are also essential for the purposes of the right to freedom of the press, which could be pursued equally, without necessarily providing all the personal data complainant;

Therefore, the illicit nature of the article which is the subject of the complaint has been noted, as it is in conflict with the provisions cited above − in particular, with the articles. 137, paragraph 3, and 139 of the Code and art. 6 of the Ethics Rules − and therefore with the general principles of lawfulness and correctness of the processing of personal data referred to in the art. 5, par. 1 letter a), of the Regulation;

HELD pursuant to art. 57 par. 1, letter. f), of the Regulation of having to evaluate the complaint with grounds and effect, pursuant to art. 58, par. 2, of the Regulation of having to:

- impose on RCS Mediagroup S.p.a., pursuant to art. 58, par. 2, letter. c) and g), of the Regulation, the prohibition of the processing of the complainant's personal details, date of birth and residence address, within the article in question;

- adopt an injunction order, pursuant to articles. 166, paragraph 7, of the Code and 18 of law no. 689/1981, for application against RCS Mediagroup S.p.a. of the pecuniary administrative sanction provided for by the combined provisions of the articles. 2-quater, 166, paragraph 2, of the Code, and 83, parr. 3 and 5 of the Regulation;

NOTING that to determine the amount of the pecuniary sanction, it is necessary to take into account the elements indicated in the art. 83, par. 2 of the Regulation and that in this case it is necessary to take into consideration, on the one hand, as aggravating circumstances:

a) the nature of the violation (art. 83, par. 2, letter a), of the Regulation), consisting in the dissemination on an Internet site of national interest of the complainant's personal details, date of birth and residence address;

b) the intervention of the owner aimed at removing the complainant's data only following the initiation of the procedure for contesting the violations found (art. 83, par. 2, letter c, of the Regulation);

c) the existence of previous violations relating to the provisions relating to journalistic activity, committed by the data controller from the date of entry into force of the Regulation (art. 83, par. 2 letter c);

d) the relevant organizational, economic and professional conditions of the offender (art. 83, par. 2, letter k, of the Regulation) taking into account what emerged in the financial statements for the year 2021;

and, as mitigating circumstances:

e) the purposes pursued by the owner, attributable - in general terms - to the freedom of information governed by the art. 85 of the Regulation and the articles. 136 et seq. of the Code;

f) the involvement of the complainant alone in the disputed matter (art. 83, par. 2, letter a, of the Regulation);

CONSIDERING the above parameters and the principles of effectiveness, proportionality and dissuasiveness indicated in the art. 83, par. 1, of the Regulation;

HELD that, based on all the elements indicated above, the pecuniary administrative sanction of 10,000.00 euros (ten thousand euros/00) should be applied;

CONSIDERING that the conditions are met to proceed with the annotation in the internal register of the Authority referred to in the art. 57, par. 1, letter. u), of the Regulation, relating to the measures adopted in the specific case in compliance with the art. 58, par. 2, of the Regulation itself;

HAVING SEEN the documentation in the documents;

GIVEN the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation no. 1/2000;

SPEAKER Prof. Pasquale Stanzione;

ALL THE WHEREAS, THE GUARANTOR

a) declares the complaint unfounded with reference to the lack of response following the exercise of the rights;

b) pursuant to articles. 57 par. 1, letter. f) of the Regulation, declares the complaint well founded for the reasons set out in the introduction and, in particular, pursuant to art. 58, par. 2, letter. f), orders RCS Mediagroup S.p.a. the prohibition of further processing of the complainant's name and surname, date of birth and residence address, in the terms described above, as it is in conflict with the articles. 2 quater, paragraph 4, 137, paragraph 3, and 139 of the Code and art. 6 of the Ethics Rules, and with the general principles referred to in art. 5, par. 1 letter a) and c) of the Regulation, except for mere conservation for the purposes of their possible use in judicial proceedings;

ORDER

pursuant to the articles 58, paragraph 2 letter. i) and 83 of the Regulation to RCS Mediagroup S.p.a., with registered office in Milan, via Angelo Rizzoli, 8 – postal code. 20132, tax code 12086540155, in the person of the legal representative pro tempore, to pay the sum of 10,000.00 euros (ten thousand euros) as a pecuniary administrative sanction for the violations indicated in the motivation, representing that the offender, pursuant to the art. 166, paragraph 8, of the Code has the right to settle the dispute by paying, within thirty days, an amount equal to half of the sanction imposed;

ORDERS

to RCS Mediagroup S.p.a., in the event of failure to settle the dispute pursuant to the aforementioned art. 166, paragraph 8, of the Code, to pay the sum of 10,000.00 euros (ten thousand euros) according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. . 27 of law no. 689/1981.

HAS

pursuant to art. 17 of the Guarantor's regulation no. 1/2019, the annotation in the internal register of the Authority referred to in the art. 57, par. 1, letter. u), of the Regulation, of the measures adopted against RCS Mediagroup S.p.a., in compliance with art. 58, par. 2 of the Regulation itself.

Pursuant to art. 78 of the Regulation, as well as articles. 152 of the Code and 10 of the Legislative Decree. lg. 1 September 2011, n. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged, alternatively, with the court of the place where the data controller resides or has its registered office or with that of the place of residence of the interested party within the deadline of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.

Rome, 31 August 2023

PRESIDENT
Stantion

THE SPEAKER
Stantion

THE GENERAL SECRETARY
Mattei