Garante per la protezione dei dati personali (Italy) - 10076481

Garante per la protezione dei dati personali - 10076481

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 6(1) GDPR Article 8(1) GDPR Art. 2-quinquies D.lgs. 196/2003 Art. 320 c.c.
Type:	Complaint
Outcome:	Upheld
Started:	07.03.2024
Decided:	13.11.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	10076481
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	frabiss

The DPA held that, under Italian law, the consent of both parents is needed in order to share the picture of a child on a social network.

English Summary

Facts

The father of the data subject, a child who is below 14, shared a picture of them on Facebook. The aim of this post was to show how the data subject resembled to their step-sibling, who was also in the picture.

The mother of the data subject, who is divorced from the father, formally requested the father to remove the picture from Facebook, believing that this processing was unlawful.

Since this did not happen, the mother filed a complaint with the Italian DPA (Garante per la protezione dei dati personali).

The father argued that he had the right to publish that picture online, since the custody of the data subject is shared between the two parents. Moreover, he pointed out that the child is smiling with his eyes closed, and therefore there is no data protection violation.

The mother argued that, according to consistent national case law, the online publication of minors' pictures is an act that goes beyond the "normal administration". Therefore, pursuant to Article 320(1) of the Italian civil code (Codice civile - c.c.), the consent of both parents was needed.

Holding

First, the DPA noted that, implementing Article 8(1) GDPR, Article 2-quinquies(1) of the Italian Data Protection Code (D.lgs. 196/2003) has set the age for autonomous consent of a child at 14 years old. However, the DPA noted that the data subject at hand was not 14 yet. Therefore, the DPA considered that, given that the child was younger than 14 years old, the consent of both parents was needed for posting that picture.

Secondly, the DPA agreed with the mother's argument and pointed out that consistent case law of Italian courts states that the consent of both parents is needed in order to lawfully share pictures of children online. For the purpose of sharing pictures of the child, it is irrelevant the parents have joint custody, and thus, consent of both parents is always needed (see, e.g., Trib. Rieti, sent. n. 443, 17/10/2022; Trib. Ravenna, sent. n. 1038, 15/10/2019).

Therefore, the DPA found that the processing at hand lacked a valid legal basis. For these reasons, the DPA found a violation of Articles 5(1)(a), 6 and 8 GDPR and of Article 2-quinquies(1) of the Italian Data Protection Code.

On these grounds, the DPA issued a reprimand to the father and, pursuant to Article 58 GDPR banned him from further processing the picture.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

- Newsletter of December 3, 2024

[web doc. no. 10076481]

Measure of November 13, 2024

Register of measures
no. 681 of November 13, 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councilor Fabio Mattei, Secretary General;

HAVING SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”);

HAVING SEEN the Personal Data Protection Code, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”);

HAVING SEEN the complaint of 7 March 2024 in which Ms XX complained of a violation of the current legislation on the protection of personal data with reference to the publication, made by Mr XX through his Facebook profile, of a photo of the complainant’s minor son under the age of fourteen, conceived in the context of the relationship with Mr XX, specifying that she had already addressed a preliminary request to the latter for the purpose of removing the photo which, however, had a negative outcome;

HAVING SEEN the note of 5 June 2024 in which Mr XX represented and defended by the lawyer XX, responded to the request for observations from this Office dated 10 May 2024 by stating:

«that he has every right to the publication of the photo, since the minor is in joint custody with both parents»;

that the image, depicting both the child he had with Ms. XX and a second minor conceived with his current partner, merely highlights some peculiar characteristics and similarities of the two children, since they were both born to the same father;

that the publication of the photo respects the dignity and reputation of the minor;

that «the image is not clear and the children are smiling with their eyes closed, therefore the photo does not appear to be in conflict with the legislation in force regarding the protection of personal data»;

CONSIDERING the note dated 14 June 2024 with which the appellant, represented and defended by the lawyer XX, responded to the observations of Mr. XX noting the incorrectness of what was stated and, in particular, that:

«the publication on social networks of photographs depicting minors requires the necessary prior explicit consent of both parents pursuant to and for the purposes of art. 320 of the Civil Code, as it is an act that exceeds ordinary administration which has as its object the processing of sensitive personal data, including the image of the minor (see Rieti Court, 10.17.2022 no. 443)»;

the consent of both persons exercising parental responsibility is also required where the parents, although no longer living together, have been granted joint custody of the child;

«the association between the published image and the accompanying caption (How did I make you look the same with two different mothers? Boh) reinforces the superficiality and harmfulness of the publication conduct of Mr. XX, evoking a banal and immature perception of parenthood by the same, as well as a discriminatory concept of parenthood itself, almost as if the father Mr. XX should be recognized as having merit (non-existent) only for having fathered two allegedly similar children from two different mothers";

the aforementioned association also expresses the will of Mr. XX to disclose information regarding the minor's family, consequently impacting on the right to privacy and respect for the private life of the complainant;

what Mr. XX claims about the lack of clarity of the image depicting the two children is inconsistent and untrue, placing this statement in contradiction with the main purpose of the publication which, as stated by Mr. XX himself, was aimed at highlighting the physical characteristics of similarity and attributable to the father of the aforementioned children;

the publication of the photo causes serious damage to the honor and reputation of the minor;

the publication of images of minors on the Internet - the latter constituting a "telematic square" open to all and suitable for disseminating the contents shared therein - now constitutes an activity likely to harm the interests of minors, so much so as "to exonerate the need to assess the concrete danger, at the moment in which the material, in fact, is inserted within a very popular social network";

the publication on the social network by Mr. XX of the photo of the minor, in the face of the explicit dissent of the mother, constitutes the violation of art. 10 of the Civil Code, of the legislation on the protection of personal data and of the New York Convention on the Rights of the Child, also constituting "serious behavior prejudicial to the interests of the minor, an expression of the father's lack of parental capacity (see Trani Court, order 30 August 2021; Mantua Court 19 September 2017)";

HAVING SEEN the note of 8 July 2024 with which, pursuant to art. 166, paragraph 5, of the Code, the Authority communicated to Mr. XX the initiation of the procedure for the possible adoption of the measures referred to in art. 58, paragraph 2, of the Regulation and the alleged violations of the law, identified, in this case, in the violation of arts. 5, paragraph 1, letter a), 6, paragraph 1, letter a) and 8 of the Regulation and art. 2-quinquies of the Code;

CONSIDERING that, unless the act constitutes a more serious crime, anyone who, in a proceeding before the Guarantor, falsely declares or certifies information or circumstances or produces false acts or documents is liable pursuant to art. 168 of the Code “False declarations to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”;

HAVING SEEN art. 2-quinquies, paragraph 1, of the Code which, in implementation of art. 8, paragraph 1, of the Regulation, recognizes the minor who has reached the age of fourteen the right to express valid consent, while for minors under fourteen, the consent of the person exercising parental responsibility is otherwise required;

CONSIDERING that, as repeatedly supported in case law, for the purposes of publishing images of minors on social networks, the prior consent of both parents is required, even where the shared custody regime of the minor has been established (see Pavia Court, order of 30 July 2024; Rieti Court, judgment no. 443 of 17 October 2022; Trani Court, judgment no. 30 August 2021; Ravenna Court, judgment no. 1038 of 15 October 2019; Mantua Court, judgment of 19 September 2017);

CONSIDERING, with regard to the case in question, that:

the respondent stated that the minor portrayed in the photo that is the subject of the complaint is entrusted jointly to the complainant and to Mr. XX himself;

Mr. XX proceeded to publish the contested photo, depicting his son under fourteen, through his Facebook profile;

the photo is clear and allows for the easy identification of the subjects portrayed;

the publication took place without the authorization of the complainant and, therefore, in the absence of the consent of both parents of the minor;

CONSIDERING therefore that the publication of the photo that is the subject of the complaint took place in the absence of an appropriate legal basis, constituting a violation of the principle of lawfulness of the processing (see art. 5, par. 1, letter a), of the Regulation), as well as of arts. 6 and 8 of the Regulation and art. 2-quinquies of the Code;

CONSIDERING that it is therefore necessary to declare the unlawfulness of such processing and to have to order against Mr. XX, pursuant to art. 58, par. 2, letter f), of the Regulation, the measure of the prohibition of further processing of the image of the minor child in the absence of the consent of both parents;

CONSIDERING that Mr. XX has never been subject to any complaint and no measures have been previously taken against him and that, therefore, the application of the warning measure is proportionate in the case in question;

CONSIDERING therefore, pursuant to art. 58, par. 2, letter b), of the Regulation, that Mr. XX must be warned for failure to comply with the provisions referred to above;

CONSIDERING that the conditions for proceeding with the annotation in the internal register of the Authority referred to in art. 57, par. 1, letter u), of the Regulation, regarding the measures adopted in the specific case in accordance with art. 58, par. 2, of the Regulation itself, also exist;

CONSIDERING the documentation in the files;

HAVING SEEN the observations formulated by the Secretary General pursuant to art. 15 of the Regulation of the Guarantor no. 1/2000;

REPORTER Prof. Ginevra Cerrina Feroni;

CONSIDERING ALL THE ABOVE, THE GUARANTOR

pursuant to art. 57, par. 1, letter f), of the Regulation declares the unlawfulness of the processing in the terms set out in the introduction and for the effect:

a) pursuant to art. 58, par. 2, letter f), of the Regulation, orders Mr. XX to prohibit further processing of the image of his minor child without the consent of both parents, except for its mere conservation, also for the purposes of possible use in court;

b) pursuant to art. 58, par. 2, letter b), of the Regulation, orders the measure of a warning against Mr. XX for the violations ascertained during the present proceedings;

c) pursuant to art. 17 of the regulation of the Guarantor no. 1/2019, orders the annotation in the internal register of the Authority referred to in art. 57, par. 1, letter u), of the Regulation, of the measures adopted against Mr. XX, in compliance with art. 58, par. 2, of the Regulation.

The Guarantor invites, pursuant to art. 157 of the Code and 58, par. 1, letter a), of the Regulation, Mr. XX, within 30 days from the date of receipt of this provision, to communicate what initiatives have been undertaken, in order to fully implement what is prescribed therein. It is recalled that failure to respond to the above request is punishable by the administrative sanction referred to in art. 166 of the Code and art. 83, par. 5, letter e), of the Regulation.

Pursuant to art. 78 of the Regulation, as well as art. 152 of the Code and 10 of Legislative Decree no. 150 of 1 September 2011, an objection to this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with that of the place of residence of the interested party within thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.

Rome, 13 November 2024

THE PRESIDENT
Stanzione

THE REPORTER
Cerrina Feroni

THE GENERAL SECRETARY
Mattei

- Newsletter of 3 December 2024

[web doc. no. 10076481]

Provision of 13 November 2024

Register of provisions
n. 681 of 13 November 2024

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, attended by Prof. Pasquale Stanzione, President, Prof. Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia and Attorney Guido Scorza, members, and Councillor Fabio Mattei, Secretary General;

SEEN Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”);