Garante per la protezione dei dati personali (Italy) - 9955735
From GDPRhub
| Garante per la protezione dei dati personali - 9955735 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 5(1)(d) GDPR Article 12 GDPR Article 137 Codice Privacy Article 139 Codice Privacy Article 157 Codice Privacy Article 2 Codice Privacy |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 26.10.2023 |
| Published: | |
| Fine: | 20,000 EUR |
| Parties: | Edizioni Proposta Sud S.r.l. |
| National Case Number/Name: | 9955735 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | GARANTE PER LA PROTEZIONE DEI DATI PERSONALI (in IT) |
| Initial Contributor: | Luca Brocca |
A complaint was brought to the Italian DPA against Edizioni Proposta Sud S.r.l. for disseminating inaccurate personal data. The DPA imposed a €20,000 fine and a prohibition on further data dissemination on the controller for violating Article 5 GDPR and Article 12 GDPR.
English Summary
Facts
The case involves a complaint filed against Edizioni Proposta Sud S.r.l., an Italian media outlet (the controller). The complaint concerns an article published on 21 December 2021 in "Il Quotidiano del Sud" owned by the controller. The article falsely reported that the complainant, a civil servant in the Municipality, had tested positive for COVID-19 and was in isolation. The publication included a photograph of the complainant and a caption indicating her supposed isolation. Subsequent articles on 23 December 2021 exacerbated the situation by linking her absence from a council meeting to a quarantine related to the virus.
The complainant contested the accuracy of the information on the day of publication, requesting the removal of the article, but received no response from the controller. On 26 October 2022, the DPA requested the controller express its views on the complaint, to which the controller failed to respond. Only following a second request, for which the controller was charged with breaching Article 157 of the Codice Privacy in conjunction with Article 166(2) of the Codice Privacy, the controller defended its actions by claiming that the information was truthful and the information was of public interest and fell within the realm of freedom of the press.
Holding
The Italian DPA concluded that the complainant's claim against the controller was justified. The DPA clarified that Article 136 of the Privacy Code does not exempt those who work in the field of journalism from complying with the general principles of data processing laid down in Article 5(1) GDPR. It further noted that Article 4 of the Deontological Rules mandates journalists to correct inaccuracies without delay. In light of the present facts, the DPA considered that doing a COVID-19 test falls under Article 9 GDPR as health data and that in the field of journalism, the dissemination of health data is permitted under the freedom of information as long as the dignity of the person is respected, also if the latter is a public figure, as provided under Article 137(3) of the Codice Privacy and Article 11(2) of the Deontological Rules. Therefore, the DPA concluded that the controller breached the provisions relating to journalistic activity referred to in Articles 137(1) and (3), Article 139 of the Privacy Code and Article 4 of the Deontological Rules.
Additionally, the DPA noted that the controller violated the general principles of data processing under Article 5(1) GDPR. Specifically, the principles of lawfulness and fairness, data minimisation and accuracy, as referred to in Article 5(1)(a), (c) and (d) GDPR. Hence, pursuant to Article 58(2)(f) GDPR, the DPA prohibited the controller from further disseminating data concerning the complainant. The DPA further imposed a fine of €20,000 on the controller due to the latter violating Article 12 GDPR since the controller failed to respond to the complainant's contestation of the information's accuracy, and Article 157 of the Codice Privacy in conjunction with Article 166(2) of the Codice Privacy for failing to respond to the DPA's request of 26 October 2022.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[doc. web no. 9955735] Provision of 26 October 2023 Register of measures n. 506 of 26 October 2023 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, the lawyer. Guido Scorza, member, and the councilor. Fabio Mattei, general secretary; HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”); HAVING REGARD to the Code regarding the protection of personal data, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”); HAVING REGARD to the ethical rules relating to the processing of personal data in the exercise of journalistic activity" referred to in Annex 1 of the Code (hereinafter "ethical rules"); GIVEN the complaint presented to the Guarantor, pursuant to art. 77 of the Regulation, dated 21 January 2022, with which XX, assisted by its lawyer Avv., complained of a violation of the regulations regarding the protection of personal data in relation to an article in "Il Quotidiano del Sud" of 21 December 2021 − entitled “Covid enters Palazzo di Città”, with a subsequent headline: “THE VIRUS Councilor XX tested positive, two councilors in quarantine” − in which it was reported that she had been subjected to a swab test and was in isolation; untrue news, also reported in a subsequent article dated 23 December 2021 CONSIDERING, in particular, that the complaint states that: - the article reported the news of the spread of Covid infection in the Municipality's Accounting sector and the circumstance that several members of it had been subjected to a molecular swab (with «precise indications also on the time of carrying out the swab and even the time expected release of the results"); the report was accompanied by a close-up photograph of the complainant and the following caption: "The councilor for XX XX underwent a swab test and is now in isolation" - said publication, in addition to infringing the right to make known or not certain situations relating to the sphere of the health of the interested party, provided untrue information, given that the same «was not among the employees subjected to a mandatory swab in how much traced, much less was he in isolation"; - on the day of publication of the article - 21 December 2021 - the interested party sent several PECs to the data controller company and to the editorial staff of the newspaper requesting the cancellation of the article; communications regularly delivered but not acknowledged by the recipients; - on the following 23 December 2021 - the day of the meeting of the Municipal Council - a new article in "Il Quotidiano del Sud" reported the "not current" news of the measures approved in the previous council of 20 December and published on the Municipality's website on the following 21 December (dates which, however, were not specified in the article), which reported verbatim this clarification: "It should be underlined that both measures were approved in the absence of the branch councilor, i.e. XX, who is in quarantine due to the outbreak that developed within of the Accounting sector"; - the publication of this second article precisely on the occasion of the convocation of the city council which the complainant had attended, in addition to violating her privacy, «produced a significant damage to her moral and reputational sphere, conveying the image of a person with health problems linked to SARS-COV-2 and not complying with the rules for containing the infection"; - the articles mentioned have therefore materialized an illicit processing of personal data as it was carried out in violation of the articles: 2-septies, paragraph 8, of the Code and 9 of Regulation (EU) 2016/679, due to the dissemination of one's name, surname and photo combined with the - false - information of isolation (article of 21 December 2021) and of quarantine (article dated 23 December 2021), given that these are situations that refer to patients presumably affected by the virus; 167 of the Code, with reference to the illicit processing of "sensitive" personal data in journalistic activity, given that in this context, communication and dissemination even without the consent of the interested party is permitted, but only within the limits dictated by the right of reporting , or by the essentiality of the news and the public interest (Cass. No. 16311 of 2018), which in this case were largely exceeded, given that «for readers it would have been sufficient to know that there had been confirmed positive cases in the economic-financial offices of the Municipality and that the tracking protocol had been regularly applied". GIVEN the note dated 26 October 2022 (prot. no. 58673) with which the Authority asked Edizioni Proposta Sud S.r.l to provide observations on the complaint, also with reference to the profile of the alleged failure to respond to the request previously submitted by the complainant in date 21 December 2021; NOTICED failure to respond to the aforementioned note; GIVEN the note dated 30 December 2022 (prot. no. 87956) with which the aforementioned Company was therefore accused of violating the art. 157 in conjunction with art. 166, paragraph 2 of the Code and the request for observations regarding the complainant's complaints was reiterated; GIVEN the note dated 30 January 2023 with which the Company represented that: - it was true news and of obvious public interest − as «it was simply aimed at informing public opinion about the spread of the virus also within the Palazzo di Città, and in particular in the accounting sector, as a consequence of which it would have there could have been a postponement of the City Council already set for the date of 23 December 2021" − combined with "the equally evident expressive continence"; - as reported, "no certainty about the presumed positivity to Covid can be found in the published news" which must be evaluated as a whole of its content, and not on the basis of individual expressions, as specified by jurisprudence (Cass. Civ., section III, order no. 12012 of 16/02/2017); - with reference to the publication of the complainant's photograph, the journalistic discipline applies which "in certain circumstances, recurring as in the case in question, does not require the consent of the interested party"; - «There is no article relating to the case in question on the site. The article was published only in the paper edition of the Quotidiano del Sud, XX edition, and obviously in the digital archives of the Quotidiano di XX which, however, are not accessible to users of the browser as there are no subscriptions that can be subscribed to that edition which give access to the archives »; GIVEN the note dated 14 February 2023, with which the complainant - through its lawyer - in replying to the Company's arguments, reiterated its complaints and, specifically: the harmful intent of the newspaper, confirmed by the fact that the newspaper did not verify the truthfulness and correctness of the information published and did not find the complainant's requests for cancellation, which also falls within the context of a real denigratory campaign in comparisons of the same, which began from the first days of his installation as Councilor of the XX and continued until the day before the publication of the articles; the exceeding of the limits of the right to freedom of the press, documented precisely by the overall reading of the articles: in particular, the fact that the news containing the "super-sensitive" data was not reported in the text of the article but in the caption makes it more evident to the attention of the reader and indeed "the denigrating and violating effect of privacy is accentuated precisely with the overall and non-atomistic reading of the article invoked by the defence"; the falsity of the information published, given that «the councilor was not in isolation because, contrary to what can be seen from the article, she carried out a swab test due to her periodic habit, not because she had been traced and therefore obliged to do the swab. Indeed, the article, by communicating the (true) information of the date and time of the swab test and also of the reporting, produces, in combination with the (false) news of the councilor's quarantine published in the article two days later, the false certainty that the councilor had tested positive for covid (when instead the swab had given a negative result, as per the documentation attached to the complaint)", with the consequence that "the participation of councilor XX in the city council was perceived by those who had read the newspaper or the press review (most of those present at the municipal meeting), as if in violation of the quarantine"; the concrete harmful effects on the private sphere and reputation, proven by the signals of distrust, disappointment and concern received by the same, also documentable if necessary; effects whose severity must also be commensurate with the context in which the articles were published, i.e. «the period in which the new crime of violation of quarantine had been introduced a few months ago (art. 13 paragraph 2bis of Legislative Decree 52/21 converted by l. 87/21), the period in which most of the tabloid articles focus on cases of violation of quarantine held up to public ridicule and reported to the police (as can be easily verified with a Google search); the period in which public figures were required to be an example of caution and respect for public health, and therefore a violation of the rules for preventing contagion was seen as extremely serious and worthy of media pillory ((the "give it to the infector" of Manzonian memory)"; GIVEN the note from the Office of 5 May 2023 (prot. n. 73117) with which, pursuant to art. 166, paragraph 5, of the Code, Edizioni Proposta Sud S.r.l, owner of the processing specifically subject to the complaint, has been notified of the initiation of the procedure for the possible adoption of the measures referred to in the art. 58, par. 2, of the Regulation, in relation to the art. 12, paragraph 3 of the Regulation, with reference to the exercise of rights, as well as in relation to the general principles of lawfulness and correctness" of the "minimization" and "accuracy" processing of the data referred to in the art. 5 par.1, letter. a), c) and d), of the Regulation and, again, in relation to the provisions regarding processing in the exercise of journalistic activity pursuant to art. 137 paragraph 1 and paragraph 3 of the Code and art. 4 of the Rules of Ethics; NOTICED of the failure to send defensive writings following the notification of the aforementioned document; HAVING REGARD to the note of 6 September 2023 (prot. no. 124948) with which the Office, following up on the request formulated by the Company with the aforementioned note of 30 January 2023, arranged for the hearing of the same for 11 September 2023; HAVING SEEN the subsequent note from the Office dated 12 September (protocol no. 127174) with which - at the request of the same Company - it deferred the hearing to the following 19 September 2023; GIVEN the communication of 18 September with which Edizioni Proposta Sud S.r.l. again asked the Authority to postpone the hearing "due to unavoidable commitments of the parties"; GIVEN the note of 19 September with which the Authority set a new date (26 September 2023), a note to which the Company responded on 25 September, communicating that it would refer to its previous defenses and «not to join this meeting as the conduct of the company Edizioni Proposta Sud srl did not involve any violation of privacy and, in any case, did not cause any damage to Doctor XX"; CONSIDERING that, unless the fact constitutes a more serious crime, anyone who, in proceedings before the Guarantor, falsely declares or certifies information or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code “False statements to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”; GIVEN the article of 21 December 2021 indicated by the complainant, entitled "Covid enters Palazzo di Città", which: - contains, in the "buttonhole", the information that there are "two councilors in quarantine"; - is accompanied by a photograph of the complainant; - reports verbatim, in a separate caption (so-called "article link"), the fact that the complainant - councilor of XX at the Municipality of XX - had been subjected to a swab test and was in isolation; NOTING that, as shown in the documentation attached to the complaint, on the same day as the publication of the article, the complainant communicated to the newspaper, using various contact details, including certified email, that what was published did not correspond to the truth, while at the same time requesting the cancellation of the item; NOTING that no response appears to have been provided to this request by the owner; CONSIDERING that, pursuant to art. 12 of the Regulation «the data controller provides the interested party with information relating to the action taken regarding a request pursuant to articles. from 15 to 22 without unjustified delay and, in any case, at the latest within one month of receiving the request", without prejudice to the need for an extension of the deadline to be communicated to the interested party in any case within the aforementioned deadline (paragraph 3); CONSIDERING that the failure to respond to the complainant's requests constitutes a violation of this provision; NOTICED furthermore that the information provided by the newspaper on the complainant's state of isolation or "quarantine" - reproposed in the article of 23 December - did not correspond to the real situation at the time of the publication of the articles, as declared and proven by the complainant; CONSIDERING that the special regime reserved for journalistic activity (articles 136 et seq. of the Code) does not exempt those who operate in this area from respecting the general principles of processing provided for in the art. 5 par.1 of the Regulation and in particular, the principles of lawfulness and correctness” (letter a), “minimisation” (letter c) and “accuracy” of data (letter d); CONSIDERING also that the art. 4 of the Rules of Ethics expressly provides that «the journalist corrects errors and inaccuracies without delay, also in compliance with the duty to rectify in the cases and in the ways established by law»; CONSIDERING that the duty to verify the reliability and correctness of information and the duty to correct inaccurate information constitute the foundation of journalistic activity as sanctioned, even before the entry into force of the regulations on the protection of personal data, by the documents ethical standards that govern the sector (now collected in the "Consolidated law on journalist duties"); CONSIDERING, moreover, that having performed a swab constitutes information that the Guarantor has repeatedly deemed attributable to health data, regardless of its outcome, as it is linked to the performance of a healthcare service (opinion of 3 November 2020, doc. web 9563445; see provision dated 20 October 2022, web doc. no. 9832507 and provision dated 23 January 2022, web doc no. 9744496); CONSIDERING that, in the journalistic field, the dissemination of health data is permitted «within the pursuit of the essentiality of information and always respecting the dignity of the person if he or she holds a position of particular social or public importance» (art.137 , paragraph 3, of the Code and art. 11, paragraph 2, of the Ethics Rules); CONSIDERING on the other hand that the evaluation of the essentiality of the information presupposes a preliminary verification of the accuracy of the information itself and that said verification, in the present case, does not appear to have been carried out, despite the particularly delicate nature of the topic being discussed it intended to deal, as it pertains to the spread of Covid, in an era - that of the publication of the articles in question - in which the alarm about the state of the pandemic was still strongly perceived and there was particular attention to compliance with the measures aimed at containing the infection; NOTED, incidentally, that the jurisprudential ruling referred to by the Company (Civil Cassation, section III, order no. 12012 of 16 February 2017 - the contents of which lend themselves to different readings and was in any case followed by new rulings (Cass . Pen. section V, n. 6110 of 7 February 2019,) - does not appear suitable to support its defenses, given that the elements of the article of 21 December 2021 identified above (buttonhole, title and outline) provide information (the state of post-swab isolation of the complainant) which is not clarified and completed by the rest of the article (nor in the following one of 23 December); CONSIDERING therefore that, in terms of the contents of the articles, the conduct of the owner constitutes a violation of the general principles of lawfulness and correctness of the processing, minimization and accuracy of personal data, referred to in the art. 5, par. 1, letter. a), c) and d), of the Regulation, as well as a violation of the provisions relating to journalistic activity referred to in articles. 137, paragraphs 1 and 3, and 139 of the Code and 4 of the Ethics Rules; CONSIDERING that compliance with the aforementioned Rules of Ethics constitutes an essential condition for the lawfulness and correctness of the processing of personal data (art.2 quater of the Code); HELD, therefore, pursuant to art. 57 par. 1, letter. f), of the Regulation, of having to evaluate the complaint as justified and for the effect, based on the violations found, pursuant to art. 58, par. 2, letter. f), to have to dispose of against Edizioni Proposta Sud S.r.l. the prohibition on further dissemination of the data relating to the complainant in the terms described above, including online including the historical archive, except for mere conservation for the purposes of their possible use in court; CONSIDERING furthermore that failure to comply with the articles. 5 and 12 of the Regulation is sanctioned by art. 83, par. 5, letter. a) and b) of the Regulation and that, similarly, failure to comply with the ethical rules is sanctioned pursuant to the combined provisions of articles. 2-quater, 166, paragraph 2, of the Code, and 83, par. 5, of the Regulation; CONSIDERING also that the violation of art. 157 of the Code is sanctioned pursuant to the combined provisions of articles. 166, paragraph 2 of the Code, and 83, par. 5, of the Regulation; CONSIDERING, therefore, that it is necessary to adopt an injunction order, pursuant to articles. 166, paragraph 7, of the Code and 18 of law no. 689/1981, for application against Edizioni Proposta Sud S.r.l. of the pecuniary administrative sanction provided for by the combined provisions of the articles. 2-quater, 166, paragraph 2, of the Code, and 83, parr. 3 and 5 of the Regulation; NOTING that to determine the amount of the pecuniary sanction, it is necessary to take into account the elements indicated in the art. 83, par. 2 of the Regulation and which in this case must be taken into consideration as aggravating circumstances: a) the seriousness of the violation, taking into account the particular nature of the data relating to the complainant relating to health, disseminated without adequate verification of their accuracy and in a temporal context still characterized by strong social alarm connected to the pandemic; b) the failure to adopt measures aimed at mitigating the prejudicial conduct deriving from the dissemination of inaccurate information, having failed to publish corrections and in any case to respond to the complainant's requests; c) the conduct adopted during the proceedings, aggravated by the late or absent response to the Office's requests and by the unmotivated repeated postponement of the hearing requested by the holder himself, which he ultimately intended to renounce; and, as mitigating factors: d) the declaration of the data controller to have acted in the legitimate exercise of the right to freedom of the press with respect to a topic (the spread of Covid and the related repercussions on the progress of local administrative activity) of particular public interest; e) the absence of previous measures adopted on the matter against the Company; NOTING that, based on the Company's financial statement data, in this case the maximum applicable law is equal to 20,000,000 euros (20 million); HELD that, based on all the elements indicated above and the principles of effectiveness, proportionality and dissuasiveness indicated in the art. 83, par. 1 of the Regulation, the pecuniary administrative sanction of 20,000.00 (twenty thousand) euros must be applied, equal to 0.1 of the statutory maximum; REMEMBERED that, in case of non-compliance with the provisions of the Guarantor contained in this provision, the criminal sanction referred to in the art. 170 of the Code, in addition to the administrative sanction referred to in art. 83, par. 5, letter. e), of the Regulation; CONSIDERING that the conditions are met to proceed with the annotation in the internal register of the Authority referred to in the art. 57, par. 1, letter. u), of the Regulation, relating to the measures adopted in the specific case in compliance with the art. 58, par. 2, of the Regulation itself; HAVING SEEN the documentation in the documents; GIVEN the observations formulated pursuant to art. 15 of the Guarantor's regulation no. 1/2000; SPEAKER the lawyer. Guido Scorza ; ALL THIS CONSIDERING THE GUARANTOR pursuant to the articles 57 par. 1, letter. f) of the Regulation, declares the complaint well founded for the reasons set out in the introduction and, in particular: a) pursuant to art. 58, par. 2, letter. f), orders against Edizioni Proposta Sud S.r.l. the prohibition of further dissemination of data relating to the complainant in the terms described above, including online including the historical archive, as it is in conflict with the articles. 5, par. 1 letter a), c) and d), of the Regulation, articles. 2 quater, paragraph 4, 137, paragraph 1 and 3, and 139 of the Code and art. 4 of the Rules of Ethics, except for mere conservation for the purposes of their possible use in court; b) ascertains the violation of the art. 12 of the Regulation and art. 157 in conjunction with art. 166, paragraph 2, of the Code; ORDER pursuant to the articles 58, paragraph 2 letter. i) and 83 of the Regulations at Edizioni Proposta Sud S.r.l., with headquarters in Via Aldo Pini, 10, 83100, Avellino, C.F. and no. sign up to the Company Register no. 02207990645, in the person of the legal representative pro tempore, to pay the sum of 20,000.00 (twenty thousand) euros as a pecuniary administrative sanction for the violations indicated in the justification, representing that the offender, pursuant to art. 166, paragraph 8, of the Code has the right to settle the dispute by paying, within thirty days, an amount equal to half of the sanction imposed; ORDERS A Edizioni Proposta Sud S.r.l., in the event of failure to settle the dispute pursuant to the aforementioned art. 166, paragraph 8, of the Code, to pay the sum of 20,000.00 (twenty thousand) euros, according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to art. . 27 of law no. 689/1981. HAS the annotation in the internal register of the Authority referred to in the art. 57, par. 1, letter. u), of the Regulation, of the measures adopted against Edizioni Proposta Sud S.r.l. in compliance with the art. 58, par. 2 of the Regulation itself. Pursuant to art. 78 of the Regulation, as well as articles. 152 of the Code and 10 of the Legislative Decree. lg. 1 September 2011, n. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged, alternatively, with the court of the place where the data controller resides or has its registered office or with that of the place of residence of the interested party within the deadline of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad. Rome, 26 October 2023 PRESIDENT Stantion THE SPEAKER Zest THE GENERAL SECRETARY Mattei
