Garante per la protezione dei dati personali (Italy) - 9968111
From GDPRhub
| Garante per la protezione dei dati personali - 9968111 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 12 GDPR Article 17 GDPR Par. 52-55 Guidelines 01/2022 on data subject rights - Right of access, Adopted on 28 March 2023 Par. 57 Guidelines 01/2022 on data subject rights - Right of access, Adopted on 28 March 2023 Articles 136-139 Codice Privacy |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 16.11.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | Reti Televisive Italiane S.p.a. Mediaset S.p.a. |
| National Case Number/Name: | 9968111 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | GARANTE PER LA PROTEZIONE DEI DATI PERSONALI (in IT) |
| Initial Contributor: | Luca Brocca |
A data subject filed a complaint against R.T.I. S.p.a. based on Article 17 GDPR for not removing from a video explicit content featuring her and then-Prime Minister Silvio Berlusconi during a 2013 public event.
English Summary
Facts
A data subject filed a complaint with the Italian DPA, under Article 77 GDPR, asserting the violation of her right to be forgotten. The complaint revolved around an episode of an Italian satirical TV show called "Striscia la notizia" that repeatedly aired a video featuring explicit jokes between the data subject and then-Prime Minister Silvio Berlusconi during a 2013 public event.
The data subject initiated a request for the deletion of her personal data to R.T.I. Reti Televisive Italiane S.p.a. (R.T.I. S.p.a.) and Mediaset S.p.a. on 17 May 2021. The request, based on the right to erasure of Article 17 GDPR, aimed to address the persistence of the video online. The video, however, continued to be accessible online, prompting the complainant's further interventions.
On 29 July 2022, R.T.I. S.p.a. (the controller) sent a note pointing out that other media outlets had disseminated the content in line with journalistic processing provisions under Articles 136-139 of the Italian Codice Privacy and that the complainant's failure to receive a response was due to her sending the request to the wrong office. Moreover, it confirmed it eventually blocked the video and to have deleted from its databases the image of the data subject.
Holding
The DPA considered the journalistic context and deemed the publication in question compatible with the provisions on data processing in the context of journalistic activity. However, taking into account the explicit content of the video and the temporal distance from the events, it examined the case under Article 17 GDPR.
Referring by analogy par. 52-55 and par. 57 of the Guidelines on the right of access by the EDPB, the DPA addressed the fact raised by the controller; that the complainant sent her request to the wrong office. The DPA noted that the Guidelines state that no particular requirement is needed in choosing the communication channel for data subject requests. On the basis of the facts of the proceedings, the DPA stated that even though the complainant did not submit her request via the communication channel mentioned in the privacy notice, she had still submitted her request via a lawful and active channel, namely the official email address of the controller. Therefore, the complainant's request met the requirements of an application made pursuant to Article 17 GDPR, and the controller should have given a response, in line with Article 12 GDPR.
The DPA acknowledged the controller's removal measures in response to the complainant's requests. However, the DPA issued a warning to the controller regarding the necessity to ensure the exercise of data subject rights under Articles 15-22 GDPR, emphasising the importance of responding within the specified timeframe, as outlined in Article 12 GDPR, also to communication channels different from those mentioned in the privacy notice, as provided by Article 13 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[doc. web no. 9968111] Provision of 16 November 2023 Register of measures n. 535 of 16 November 2023 THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members and Dr. Claudio Filippi, deputy general secretary; HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”); HAVING REGARD to the Code regarding the protection of personal data, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”); GIVEN the complaint presented to the Guarantor, pursuant to art. 77 of the Regulation, dated 30 March 2022 with which Ms XX, represented and defended by the lawyer XX, complained about the violation of the provisions regarding the right to be forgotten in relation to a "Striscia la notizia" service who, in the column called "The New Monsters", repeatedly proposed a "cloying 'curtain'" that occurred between her and the then Prime Minister Silvio Berlusconi, on the occasion of a convention organized in 2013 by the company where the complainant worked, in which the Hon. Berlusconi asked her "disrespectful questions and two-way jokes"; CONSIDERING that the complaint specifically states that with a note sent via PEC dated 17 May 2021, the interested party addressed R.T.I. Reti Televisive Italiane S.p.a. (hereinafter R.T.I. Sp.a.), a request for cancellation of personal data pursuant to art. 17 of the Regulation to which the "Striscia la Notizia" broadcast did not respond, persevering in broadcasting the video and making it also available online; HAVING REGARD to the note dated 6 July 2022 in which the complainant, in reiterating her request, highlighted how the "Striscia la notizia" service continued to be available, even online, in association with her identification data; GIVEN the note of 12 July 2022 (protocol no. 38131) with which the Authority asked R.T.I. S.p.a. to provide their observations regarding what is represented in the document initiating the proceedings and to communicate their possible intention to comply with the complainant's requests; GIVEN the note of 29 July 2022 with which R.T.I. S.p.a. responded to the Authority's request by representing that: - the material was also disseminated by other media outlets, in compliance with the provisions relating to processing for journalistic purposes; - the failure to respond to her request of 17 May was caused by an error by the complainant herself who had forwarded her request to an office not competent to handle it; - the Company nevertheless took steps to "block the video" and remove the image of the complainant from its databases; GIVEN the note dated 4 August 2022 with which the complainant responded to the observations of R.T.I. S.p.a., specifying that: - your application has been correctly sent to the institutional PEC addresses of said companies: both to R.T.I. S.p.a. (direzione.affarisocietari@rti.postecert.it), and to the parent company Mediaset S.p.a. (mediasetitalia@pec.mediaset.it), «i.e. the digital domicile equivalent to the address of the registered office, which could be found at the time, and can still be found, in the Companies Register» (where the judicial documents are notified and therefore a communication channel presumably monitored regularly), also noting that «no law requires the interested party to refer to the e-mail addresses (ordinary, without proof of delivery) published in the privacy information»; - took note of the removal measures adopted, however, also in order to bring the processing back into the context of the provisions relating to the exercise of the right of "satire" and freedom of expression, «a more correct balancing of the interests of all subjects involved in the "news", would have brought R.T.I. S.p.a. at most to broadcast the video in question again, in 2020 and then again in 2021, carrying out the unencrypted diffusion of Silvio Berlusconi's personal data with the simultaneous obscuring and/or camouflage of XX's personal data"; - in the response to the Guarantor in any case «the data controller does not specify what measures it has adopted in the meantime to limit the damage deriving to the interested party from the illegitimate dissemination of the data and what reasonable measures it has adopted in the meantime to inform the other data controllers , who are processing the data in question"; GIVEN the note dated 8 August 2022 with which the complainant's lawyer corrected a passage of his previous observations, taking note of the change that has occurred in the meantime to the PEC address of R.T.I. S.p.a., currently found in the Company Register, specifying on the other hand that this circumstance does not in any case modify its arguments regarding the regularity of the preventive request formulated by the complainant to the owner; HAVING SEEN the note of 5 September with which R.T.I. S.p.a. responded to the aforementioned note by objecting that: - the Regulation "does not at all appear to allow the interested party to replace the owner in choosing the communication channel to use to exercise his rights", citing to this end the Guidelines n.1/2022 on the exercise of rights of the EDPB of 18 January/28 March 2022 in the part which establishes that «the data controller is not required to follow up on a request sent to a random or incorrect email (or postal) address, not provided directly by the data controller, or to any communication channel clearly not intended to receive requests relating to the rights of the interested party if the data controller has provided an adequate communication channel, which can be used by the interested party"; - the choice to proceed with the cancellation of the service was made in a purely conciliatory spirit and not as an implicit recognition of the unlawfulness of the processing; a circumstance which also renders the further requests made by the complainant regarding the measures undertaken by R.T.I. groundless. S.pa. to inform other data controllers who process the same data, as the interested party may have to initiate independent initiatives against them; GIVEN the note of 8 September in which the complainant, in objecting to the irregularity of the owner's further replies, notes: - the non-relevance, with respect to the case in question, of the reference made by the Company to par. 54 of the Guidelines n. 1/2022 given that «the communication channel used is neither random nor incorrect, being the one which at the date of sending the request was listed in the Chamber of Commerce Register» suitable, as a PEC, to give proof of receipt of the communication; - the Company's failure to identify an "appropriate" communication channel capable of providing the interested party with certain proof of the delivery of their request, as required by the aforementioned Guidelines which also expressly entrust the task to the owner to guarantee the effective exercise of the rights by the interested party even if the latter uses a communication channel other than the one dedicated to this purpose (art. 53); GIVEN the communication of 10 July 2023 with which the Company provided a reproduction of the service that is the subject of the complaint, at the request of this Authority (note of 5 July 2023, prot.n. 104099), given the unavailability of the service, once removed from the network, by the complainant; GIVEN the communication of 6 September 2023 (prot.124991) sent to RTI S.p.a. pursuant to art. 166, paragraph 5, relating to the initiation of proceedings for the alleged violation of articles. 5, par. 1 letter a and c) and 12 and 17 of the Regulation, as well as the specific provisions regarding processing carried out in the exercise of journalistic activity (articles 136-139 of the Code); HAVING SEEN the note from RTI S.p.a. of 3 October 2023 with which it highlighted that: - the subject of the complaint - and therefore of evaluation by the Guarantor - is the recognition of the right to be forgotten and in particular the conduct of the owner in relation to the request for cancellation presented by the interested party pursuant to art. 17 of the Regulation and the omitted response pursuant to art. 12 of the Regulation, cancellation which − following notification of the complaint − was nevertheless ordered; further profiles relating to other regulatory provisions therefore go beyond what is requested by the interested party; - «the exercise of rights pursuant to art. 12 GDPR by the interested parties through channels other than those provided by the owner - in a transparent and completely adequate manner to the regulatory dictates - can sometimes cause involuntary shortcomings"; - the Authority must consider "on the one hand the correct ways in which RTI - through the information provided to interested parties - has facilitated the exercise of their rights; on the other hand, the co-responsible conduct of the counterporte" who, aware of the presence of other communication channels (given the statement of having sent the prior request to Mediaset "information about the program Striscia la notizia in hand") "voluntarily decided to use communication channels communication intended for the reception of another type of communication"; - as regards more specifically the treatment carried out by "Striscia la Notizia", «the video was used to make a satirical criticism of President Silvio Berlusconi, according to the spirit of the broadcast», without prejudice to the interested party, of which it is only the image and its identifying data have been published, without other additional data; - the broadcast recalled a story that was the subject of wide attention and was re-proposed by many media outlets, whose services are still present online (as demonstrated by the documentation provided), due to the reputation of the Hon. Berlusconi and the complainant herself, who also became a well-known figure for having given, after the event, multiple interviews and having participated in various television programmes; notoriety such as to make "completely useless - as well as unjustified - the suppression of any reference to his person"; CONSIDERING that, unless the fact constitutes a more serious crime, anyone who, in proceedings before the Guarantor, falsely declares or certifies information or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code “False statements to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”; CONSIDERING that the processing that is the subject of the complaint concerns events that took place during a public event, filmed and documented by various information bodies, as an exercise of journalistic activity relating to public activities carried out by the Prime Minister in office; CONSIDERING also that the outcry of the affair, although linked to the figure of the Prime Minister, also led to exposure of the complainant, also in light of the public statements made by the same (art. 137, paragraph 3 of the Code); CONSIDERING that the publication in question is therefore compatible with the provisions on data processing in the context of journalistic activity; CONSIDERING, however, that the facts date back 10 years ago and that the right to be forgotten invoked by the complainant can therefore be based on the time that has passed since the facts themselves together with the nature of the processing, aimed at re-proposing the images and contents of the meeting had by the complainant herself with the Prime Minister on the occasion of which she found herself exposed to explicit double-entendre jokes and the consequent hilarity of the public present; NOTING that, although other services relating to the story described are present, the complainant has exercised the right to be forgotten towards R.T.I. S.p.a. and to this end he used a communication channel that was legally valid and active at the time - the PEC published in the Company Register - and that his request was not responded to; CONSIDERING that, based on art. 12 of the Regulation, the owner is required to facilitate the exercise of the rights of the interested party pursuant to articles 15 to 22 (par.1) and is required to provide feedback to the request made by the interested party - possibly also for refusal, provided that it is justified − within one month of receipt, unless an extension is requested (paragraphs 2 and 3); CONSIDERING that the Guidelines on the right of access adopted by the EDPB on 23 March 2023 establish that: - in principle, no particular requirement is required in the choice of the communication channel for the exercise of the rights by the interested party (par.52); - the owner is encouraged to provide an appropriate and "user-friendly" communication channel to guarantee the interested party the effectiveness of his request; however, if the interested party uses a communication channel other than the one indicated as preferable, the request must generally be considered effective and consequently managed by the data controller, given that «the controllers should undertake all reasonable efforts to make sure that the exercise of data subject rights is facilitated" (para. 53); - the data controller is not obliged to follow up on a request sent randomly or to an incorrect email (or postal) address, not provided directly by the data controller, nor to any communication channel clearly not intended to receive related requests to the rights of the interested party or relating to sectors outside this scope, if the owner himself has provided an appropriate communication channel that can be used by the interested party (paragraphs 54 and 55); - the EDPB considers it a "good practice" for the data controller to confirm receipt of requests in written form for the purposes of calculating the deadline - one month - within which he is required to provide feedback, in accordance with the provisions of the art. 12 of the Regulation (para. 57); NOTING that, even if the complainant used a communication channel (the PEC of R.T.I. S.p.a. and Mediaset S.p.a.) different from the one that the owner indicated in the privacy information for the purposes of exercising the rights referred to in the articles. 15-22 of the Regulation, it constituted and constitutes the official electronic address (digital domicile) of the owner and the relevant corporate group to which he or she belongs, intended for the transmission of documents having legal value; therefore not unrelated to a possible use also for the exercise of the rights provided for by the legislation on the protection of personal data (see par. 55 of the Guidelines cited above), also in light of the suitability of providing a certain date of receipt of the communication itself (para. 57 above cited); CONSIDERING that, in light of the above, the communication sent by the complainant is suitable to satisfy the requirements of a request formulated pursuant to articles. 15-22 of the Regulation and that therefore the owner should have provided feedback within the terms established by the art. 12 of the Regulation; CONSIDERING on the other hand that, without prejudice to the validity of the channel actually used by the complainant, also with a view to having certain proof of receipt of her request, she also had the address indicated by the owner in his privacy policy – as expressly stated in the complaint – to whom he could equally forward his request to further guarantee the completeness and effectiveness of his action; HAVING ALSO NOTED the measures to remove the content that is the subject of the complaint adopted by the Company and that, therefore, with regard to this profile, the conditions for the adoption of further provisions in this regard by the Authority do not exist; CONSIDERING therefore the overall circumstances of the case, which also make it plausible that there was an "involuntary failure" - according to the expression used by the owner - in the (omitted) processing of the complainant's request within the framework of the more consolidated procedures for managing ex-applications articles 15-22 of the Regulations implemented by the Company; HAVING RECOGNIZED, however, the need to have, pursuant to art. 58, par. 2, letter. a), of the Regulation and of the art. 154, paragraph 1, letter. f), of the Code, a warning against R.T.I. S.p.a. in relation to the need to guarantee the exercise of rights pursuant to articles. 15-22 of the Regulation - and in any case a response within the terms set out in the art. 12 of the Regulation − also in light of the use by the interested parties of communication channels other than those indicated in the information referred to in the art. 13 of the Regulation, within the limits indicated by the Guidelines on the right of access adopted by the EDPB on 23 March 2023; GIVEN the observations formulated pursuant to art. 15 of the Guarantor's regulation no. 1/2000; SPEAKER the lawyer. Guido Scorza; ALL THIS CONSIDERING THE GUARANTOR pursuant to art. 57, par. 1 letter f), of the Regulation a) takes note of the removal measures adopted by R.T.I. S.p.a. in compliance with the complainant's requests and therefore does not see the conditions for the adoption of further provisions in this regard; b) pursuant to art. 58, par. 2, letter. a), of the Regulation and of the art. 154, paragraph 1, letter. f), of the Code, warns R.T.I. S.p.a. regarding the need to guarantee the exercise of rights pursuant to articles. 15-22 of the Regulation - and in any case a response within the terms set out in the art. 12 of the Regulation − also in light of the use by interested parties of communication channels other than those indicated in the information pursuant to art. 13 of the Regulation, within the limits indicated by the Guidelines on the right of access adopted by the EDPB on 23 March 2023. Pursuant to art. 78 of the Regulation, as well as articles. 152 of the Code and 10 of the Legislative Decree. lg. 1 September 2011, n. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged, alternatively, with the court of the place where the data controller resides or has its registered office or with that of the place of residence of the interested party within the deadline of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad. Rome, 16 November 2023 PRESIDENT Stantion THE SPEAKER Zest THE DEPUTY SECRETARY GENERAL Philippi
