Garante per la protezione dei dati personali (Italy) - 10220271
From GDPRhub
| Garante per la protezione dei dati personali - 10220271 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5 GDPR Article 9 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 29.01.2026 |
| Published: | 29.01.2026 |
| Fine: | 5000 EUR |
| Parties: | Dr. Montemurro |
| National Case Number/Name: | 10220271 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | GPDP (in IT) |
| Initial Contributor: | n/a |
The DPA fined a doctor €5,000 for unlawfully disclosing a patient's health data by publishing photos relating to a surgical procedure on a social media platform that were not effectively anonymized, and the consent obtained was invalid.
English Summary
Facts
A patient (a data subject) filed a complaint with the Italian DPA after photographs of her rhinoseptoplasty procedure were published on a social media platform on the public profile of the doctor (the controller).
The controller argued that the data subject had signed a consent form allowing use of images for scientific and educational purposes with a guarantee of anonymity, that the images were anonymized without name and with partial facial obscuring) and that the purpose was medical-scientific dissemination, not commercial. Also, after the complaint, the controller removed the images.
Holding
The Italian Data Protection Authority (DPA) held that the controller unlawfully processed the data subject’s health data by publishing photos that were not effectively anonymized, in violation of Articles 5(1)(a), (b), and (c) GDPR and Article 9 GDPR.
The consent obtained was invalid because it was based on the mistaken belief that the images were anonymous, and no specific consent was given for the dissemination of identifiable health data. The DPA emphasized that for scientific or educational publication, either full anonymization is required, or if anonymization is not possible, a specific, informed consent with pseudonymization must be obtained.
The DPA imposed a €5,000 fine, ordered revision of consent forms and privacy notices, mandated ensuring anonymity (or obtaining proper consent), and clarified that consent for necessary medical treatment is not required.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
[web doc. no. 10220271]
Provision of January 29, 2026
Register of Provisions
No. 39 of January 29, 2026
THE ITALIAN DATA PROTECTION AUTHORITY
IN today's meeting, attended by Professor Pasquale Stazione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Member, and Luigi Montuori, Attorney-at-Law, Secretary General;
CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, "General Data Protection Regulation" (hereinafter "Regulation");
SEEN Legislative Decree No. 196 of June 30, 2003, containing the "Personal Data Protection Code" (hereinafter the "Code");
SEEN Regulation No. 1/2019 concerning internal procedures of external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Journal No. 106 of May 8, 2019, and on www.gpdp.it, web doc. No. 9107633 (hereinafter "Regulation No. 1/2019");
SEEN the documentation in the file;
SEEN the observations made by the Secretary General pursuant to Article 15 of Regulation No. 1/2000 on the organization and functioning of the Office of the Italian Data Protection Authority, at www.gpdp.it, web doc. no. 1098801;
REPORTER: Professor Pasquale Stazione;
WHEREAS
1. Investigative activity.
In the month of XX, this Authority received a complaint alleging the dissemination on the social media platform Instagram, on the public profile of Dr. Paolo Montemurro, of photographs of the complainant, relating to a rhinoplasty procedure performed by the aforementioned professional.
According to the documents, the complainant had not consented to the dissemination of these images, even though the photographs depicting her bore a caption reading "Images with the patient's consent" (documentation in the documents).
Following the complaint, the Office initiated a preliminary investigation and, with a note dated XX, file no. XX), requested information from the professional, who responded in a note dated XX, summarizing the following:
"The undersigned had the patient sign, as is standard practice, an informational consent form for rhinoplasty, which, in Article 20, expressly provides for the possibility of using the images and videos obtained with the patient's consent for scientific and educational purposes, with the guarantee of anonymity."
"The form used is the format provided by the AICPE – Italian Association of Aesthetic Plastic Surgery – to protect the guarantees contained therein. Therefore, there is no one who cannot see how this form includes authorization to protect every aspect of the privacy regulations required by law."
"The patient expressly accepted and signed said consent on XX, even double-signing the aforementioned Article 20 so as to highlight its content."
"The data controller and data security officer, even if the undersigned specifically operated using an operating room at the Isber Clinic in Varese, is solely and exclusively the operating physician, as specified in the information signed on XX, which also complies with the formats issued by the AICPE";
"The photographs were published on a social media platform exclusively attributable to the undersigned and with the guarantee of anonymity for the sole purpose of medical-scientific dissemination," (...) stating that "the patient is in no way recognizable in the published images, having her eyes closed, being reclined, and being in a lateral position such that the identity of the subject depicted in profile is not revealed";
"The purpose of scientific dissemination (...) was pursued in accordance with the law, after obtaining the patient's specific consent and taking care to publish the images without allowing the patient's identity to be identified."
In light of these elements, the Office notified Dr. Dr. Montemurro initiated proceedings pursuant to Article 166, paragraph 5, of the Code (note of XX, file no. XX), alleging violations of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulations, as well as Article 2-septies, paragraph 8, of the Code.
With note of XX, Dr. Montemurro submitted his defense briefs, requesting a hearing.
At that hearing, he reiterated that he had acted in good faith, emphasizing that he had immediately removed the images from his social media profile following the complainant's complaints, and that they were for informational purposes, devoid of commercial connotations. It was also reiterated that the aforementioned professional acted in good faith, having "legitimately relied on a consent form provided by AICPE, the most important national professional association, believing it to be compliant with the law."
The hearing of Dr. Montemurro took place on XX. In this case, Dr. Montemurro, through his lawyer, further clarified his arguments, emphasizing the difficulty of identifying the interested party and the legitimate reliance placed on the consent form prepared by the AICPE. The professional also reiterated "the difficulty of identifying the interested party from the aforementioned images, believing that she could be recognized at most only by family members and, as a result, the images can be considered anonymous."
In a note dated XX, Dr. Montemurro produced a pro veritate opinion from the AICPE Scientific Council, dated XX, which states that the use of patient images for dissemination, educational, and scientific purposes, while guaranteeing their anonymity, requires the specific consent of the interested party and that the form used by the aforementioned professional is used "by the majority of Italian plastic surgeons."
2. Outcome of the preliminary investigation.
Having acknowledged the content of the documents in the case and the written submissions, we note that:
Under the Regulation, "personal data" means "any information relating to an identified or identifiable natural person ('data subject')." Furthermore, "an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person" (Article 4, paragraph 1, of the Regulation), and "data concerning health" means personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about that natural person's health (Article 4, paragraph 1, paragraph 15, of the Regulation).
Pursuant to the Regulation, personal data must be "processed lawfully, fairly, and in a transparent manner in relation to the data subject (lawfulness, fairness, and transparency)," collected for specified, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes (purpose limitation principle), and "adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed" (data minimization principle) (Article 5, paragraph 1, letters a), b), and c) of the Regulation);
Dissemination of personal data means "the disclosure of personal data to unspecified persons, in any form, including by making them available or consulting them" (Article 2-ter, paragraph 4 of the Code);
Data protection legislation does not apply to "anonymous information, that is, information that does not relate to an identified or identifiable natural person, or to personal data rendered anonymous in such a way that the data subject is not, or no longer, identified" (see Recital 26 of the Regulation and WP29 Opinion 05/2014 on Anonymization Techniques, adopted on 10 April 2014).
Anonymization cannot be considered achieved by simply removing the data subject's personal details. Indeed, anonymized data is only considered such if it does not in any way allow for the direct or indirect identification of a natural person, taking into account all the means (financial, informational, technological, skillful, time) available to the person (controller or other entity) attempting to use such tools to identify a data subject. An anonymization process cannot be considered truly anonymized if it is not capable of preventing anyone using such data, in combination with "reasonably available" means, from isolating an individual in a group (single-out), connecting an anonymized piece of data to data relating to a person in a separate dataset (linkability), and inferring new information relating to a person from an anonymized piece of data (inference). These requirements must be met in conjunction.
Anonymization must be considered dynamic processing, with the data controller required to remove any singularity if, by any means, it becomes aware of it at a later stage, and to track such events in order to repeat the re-identification risk assessment upon reaching a predefined threshold, appropriate to the context, identified on the total number of records included in the database.
The dissemination of data capable of revealing the health status of data subjects is, in general, expressly prohibited unless one of the lawful cases referred to in Article 13 of the GDPR applies.9, paragraph 2 of the Regulation (Article 2-septies, paragraph 8, and Article 166, paragraph 2, of the Code);
In this regard, the Guarantor has repeatedly emphasized that with the full implementation of the Regulation, unlike in the past, healthcare professionals, subject to professional secrecy, no longer need to request patient consent for treatments necessary for the healthcare service requested by the data subject, regardless of whether they operate as a freelancer (in a medical practice) or within a public or private healthcare facility (see the provision "Clarifications on the application of the regulations for the processing of health-related data in the healthcare sector" of March 7, 2019, web doc. no. 9091942);
In cases where processing is not strictly necessary for treatment purposes and the legal basis is the data subject's consent, given the nature of such data, which is particularly sensitive in terms of fundamental rights and freedoms, such consent must be given through a positive act by which the data subject expresses a freely given, specific, informed, and unambiguous wish to process their personal data (Article 9, paragraph 2, letter a) of the Regulation and paragraph 4 of the Guidelines 5/2020 on consent pursuant to Regulation (EU) 2016/679, adopted by the European Data Protection Board on May 4, 2020);
Furthermore, as highlighted in the aforementioned Guidelines, "the General Data Protection Regulation strengthens the requirement that consent be informed. Pursuant to Article 5 of the Regulation, transparency is a fundamental principle, closely linked to the principles of fairness and lawfulness. Providing information to data subjects before obtaining their consent is essential to enable them to make informed decisions, understand what they are consenting to, and, for example, exercise the right to withdraw consent. If the data controller does not provide accessible information, the user's control becomes illusory, and consent will not constitute a valid basis for processing. If the requirements for informed consent are not met, consent will not be valid, and the data controller may be in breach of Article 6 of the Regulation."
With specific reference to the publication of clinical cases, the Code of Medical Ethics approved by the National Federation of the Orders of Surgeons and Dentists in 2014 (as amended in 2016, 2017, and 2020) provides that "the physician shall ensure that the subjects involved in the publication or scientific dissemination of clinical data and studies cannot be identified" (Article 11 - Confidentiality of Personal Data);
Also relevant is the Code of Conduct for the Use of Health Data for Teaching and Scientific Publishing Purposes approved by the Italian Data Protection Authority with the provision of January 14, 2021, which clarified that the use of personal data for teaching and scientific publishing purposes by healthcare professionals may only occur after adopting specific anonymization and, secondarily, pseudonymization measures; If anonymization of the data is not possible, the data controller must obtain specific consent from the data subject. Once consent is obtained, the data will be pseudonymized before being disseminated (web doc. no. 9535354 and art. 5 of the aforementioned Code of Conduct – regarding the publication on social media of images and videos of patients undergoing medical procedures, see also provisions of April 15, 2021, web doc. nos. 9587071, 9587089, 9587637, of January 11, 2024, web doc. no. 9983210, and of December 12, 2024, web doc. no. 10095836).
Based on the documentation acquired and the defense presented, it is observed that the published images contain personal data capable of revealing the data subject's health status, which—as also acknowledged by Dr. Montemurro - identifiable, at least within a limited circle of individuals, based on clearly visible facial features.
The measures adopted by the professional (absence of personal data, obscuring a facial detail) are not suitable for achieving effective anonymization according to the criteria identified by the legislation and the interpretative guidelines cited.
It follows that the dissemination of the images involved the unlawful processing of health data, lacking a valid basis for lawfulness pursuant to Article 9 of the Regulation. The consent obtained cannot be considered valid, as it was given on the basis of the prospect of dissemination of anonymous data. This, in light of the evidence presented, did not actually materialize, as highlighted in the Code of Conduct for the Use of Health Data for Educational and Scientific Publication Purposes cited above. A healthcare professional wishing to disseminate images and videos of patients for educational or scientific purposes, in accordance with the professional code of ethics, may, after providing prior information, disseminate only data, images, and videos that have been properly anonymized. If this is not possible due to the clinical characteristics or specific circumstances of the case, it is necessary to obtain the patient's specific, free, and informed consent and proceed with the publication of pseudonymized data/images.
Therefore, if Dr. Montemurro had properly anonymized the complainant's images, he should not have requested her informed consent for dissemination because, as noted above, the regulations on personal data protection do not apply to anonymous information; in such cases, only complete disclosure is sufficient. If, as in this case, the measures adopted did not effectively anonymize the data, Dr. Montemurro should have requested specific consent from the patient, highlighting that the data disclosed would be personal, although not directly identifiable.
3. Conclusions.
In light of the above considerations, taking into account the statements made by the data controller during the investigation – and considering that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances or produces false documents or records is liable pursuant to Article 168 of the Code, "False statements to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority" – the information provided by the data controller in the defense briefs does not allow the findings notified by the Office with the initiation of the proceedings to be overcome. Furthermore, none of the cases envisaged in Article 11 of the Data Protection Authority Regulation No. 1222/2013 apply. 1/2019.
For these reasons, the processing of personal data carried out by Dr. Paolo Montemurro as set out in the grounds is unlawful, in violation of the basic principles of processing set out in Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, as well as Article 2-septies, paragraph 8, of the Code.
Violation of the aforementioned provisions may result in the application of the administrative sanction provided for in Article 83, paragraph 5 of the Regulation.
4. Corrective measures
Article 58, paragraph 2, provides the Garante with a series of corrective powers, both prescriptive and punitive, to be exercised in the event that unlawful processing of personal data is ascertained. Among these powers, Article 58, paragraph 2, letter a), provides: Article 58(2)(d) of the Regulation provides for the power to "order the controller or processor to bring processing operations into conformity with the provisions of this Regulation, where appropriate, in a specific manner and within a specific period."
In light of the above considerations, it is deemed appropriate to order Dr. Paolo Montemurro, pursuant to the aforementioned Article 58(2)(d) of the Regulation, to adopt the following corrective measure within ninety days of notification of this provision: to revise the document in which he provides his patients with the information referred to in Articles 13 and 14 of the Regulation and in which the data subject's consent is requested (Appendices 2 and 3 to footnote XX in the documents):
providing that the use of health data for educational and scientific publication purposes must guarantee the anonymity of the patient and that, where this is not possible, given the characteristics and specificities of the clinical case, specific informed consent must be obtained;
Eliminating consent to data processing for healthcare purposes, since, pursuant to Article 9, paragraph 2, letter h) and paragraph 3 of the Regulation, healthcare professionals, subject to professional secrecy, are not required to request patient consent for processing strictly necessary for the healthcare service requested by the data subject;
Specifying the retention period for the data processed for each of the distinct processing purposes pursued, taking care to also indicate for how long pseudonymized images of the patient will be published on the data controller's social media channels.
5. Adoption of an injunction order for the application of the administrative fine and additional penalties (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code).
Violation of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, as well as Article 166, paragraph 7, of the Code. 2-septies, paragraph 8, of the Code, caused by the conduct carried out by Dr. Montemurro is subject to the application of the administrative pecuniary sanction pursuant to art. 83, paragraph 5, of the Regulation and art. 166, paragraph 2 of the Code.
The Garante, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 83 of the Regulation, by issuing an injunction (Article 18, Law No. 689 of 24 November 1981), in relation to the processing of personal data carried out by Dr. Montemurro, which has been found to be unlawful, in the terms set out above.
Having deemed it appropriate to apply Article 83, paragraph 3 of the Regulation, which provides that "if, in relation to the same or related processing operations, a controller […] infringes, intentionally or negligently, several provisions of this Regulation, the total amount of the administrative pecuniary sanction shall not exceed the amount specified for the most serious infringement." The total amount of the sanction is calculated so as not to exceed the maximum amount established by the same Article. 83, paragraph 5.
In light of the above and, in particular, of the category of personal data affected by the breach, which, by its nature, is particularly sensitive in terms of fundamental rights and freedoms, the disclosure of such data from XX to XX, and the lack of intentional conduct on the part of the data controller (the breach having occurred in good faith in the belief that the consent form used, provided by the AICPE association, complied with personal data protection regulations), the severity of the breach committed by Dr. Montemurro is considered high (see European Data Protection Board, "Guidelines 04/2022 on the calculation of administrative fines under the GDPR" of May 23, 2023, point 60).
With reference to the elements listed in Article 83, paragraph 5, of the GDPR, 2 of the Regulation for the purposes of applying the administrative fine and quantifying it, given that the fine must be "effective, proportionate and dissuasive in each individual case" (Article 83, paragraph 1 of the Regulation), it is noted that, in the case at hand, the following circumstances were taken into account:
As soon as the data controller received the complainant's complaints, it promptly removed the aforementioned images from its Instagram profile (Article 83, paragraph 2, letter c) of the Regulation).
There are no previous relevant violations committed by the data controller, nor have any measures pursuant to Article 58 of the Regulation been previously taken (Article 83, paragraph 2, letter e) of the Regulation);
Dr. Montemurro has cooperated fully with the Authority throughout this proceeding.
Based on the above factors, assessed as a whole, it is deemed appropriate to determine the amount of the fine provided for in Article 58 of the Regulation. 83, paragraph 5, letters a) and b), of the Regulation, in the amount of €5,000 (five thousand) for violations of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, as well as Article 2-septies, paragraph 8, of the Code, as an administrative pecuniary sanction deemed, pursuant to Article 83, paragraph 1, of the Regulation, to be effective, proportionate, and dissuasive.
It is also believed that the additional sanction of publication of this provision on the website of the Data Protection Authority should apply, as provided for by Article 166, paragraph 7, of the Code and Article 16 of the Data Protection Authority Regulation No. 1/2019, also taking into account the type of personal data subject to unlawful processing.
Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.
NOW THEREFORE, THE GUARANTOR
declares the processing of personal data carried out by Dr. Paolo Montemurro unlawful for violation of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, and Article 2 septies, paragraph 8 of the Code, as set out in the grounds.
ORDERS
Pursuant to Articles 58, paragraph 2, letter i), and 83 of the Regulation, as well as Article 166 of the Code, Dr. Paolo Montemurro, Tax Code XX, to pay the sum of €5,000 (five thousand) as an administrative fine for the violations indicated in this order. It is hereby stated that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half the imposed fine.
ORDERS
Dr. Paolo Montemurro, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, to pay the sum of €5,000 (five thousand) according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981;
pursuant to Article 58, paragraph 2, letter d), of the Regulation, to bring the processing operations into conformity with the provisions of the Regulation by adopting, within ninety days of notification of this order, the following corrective measure: revising the document with which he provides his patients with the information referred to in Articles 13 and 14 of the Regulation, which require the data subject's consent (Annexes XX and XX to the footnote to XX):
providing that, for the use of health data for educational and scientific publication purposes, patient anonymity must be guaranteed and that, where this is not possible due to the characteristics and specifics of the clinical case, specific informed consent must be required;
eliminating consent to data processing for treatment purposes, since, pursuant to Art. 9, paragraph 2, letter h) and paragraph 3 of the Regulation, healthcare professionals, subject to professional secrecy, must not request patient consent for processing strictly necessary for the healthcare service requested by the data subject;
specifying the retention period of the data processed for each of the distinct processing purposes pursued, taking care to also indicate how long pseudonymized images of the patient will be published on the data controller's social media channels.
Failure to comply with an order issued pursuant to Art. 58, paragraph 2, letter h) of the Regulation will result in the data subject being subject to a specific consent requirement. 2 of the Regulation is punishable by the administrative sanction referred to in Article 83, paragraph 6 of the Regulation;
pursuant to Article 58, paragraph 1, letter a), of the Regulation and Article 157 of the Code, to communicate what initiatives have been undertaken to implement the provisions of the aforementioned paragraph 4, and to provide adequately documented feedback no later than 20 days after the expiration of the aforementioned deadline. Failure to respond to a request made pursuant to Article 157 of the Code is punishable by the administrative sanction pursuant to the combined provisions of Articles 83, paragraph 5 of the Regulation and 166 of the Code.
ORDERS
- pursuant to Article 166, paragraph 7, of the Code, the publication of this provision in full on the Guarantor's website and the recording of this provision in the Authority's internal register, provided for by Article 57, paragraph 1, letter u), of the Regulation, of violations and measures adopted in accordance with Article 58, paragraph 2, of the Regulation;
- the transmission of this provision to the AICPE – Italian Association of Aesthetic Plastic Surgery so that it may align the information and consent forms it offers its members with the indications provided in this provision.
Pursuant to Article 78 of the Regulation, Articles 152 of the Code, and Article 10 of Legislative Decree no. 150/2011, an appeal against this provision may be lodged before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of notification of the provision itself, or within sixty days if the appellant resides abroad.
Rome, January 29, 2026
THE PRESIDENT
Stanzione
THE REPORTER
Stanzione
THE SECRETARY GENERAL
Montuori
[web doc. no. 10220271]
Provision of January 29, 2026
Register of Provisions
no. 39 of January 29, 2026
THE AUTHORITY FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, attended by Professor Pasquale Stazione, President, Professor Ginevra Cerrina Feroni, Vice President, Dr. Agostino Ghiglia, Member, and Attorney Luigi Montuori, Secretary General;
CONSIDERING Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the "General Data Protection Regulation" (hereinafter the "Regulation");
CONSIDERING Legislative Decree No. 196 of 30 June 2003, the "Personal Data Protection Code" (hereinafter the "Code");
CONSIDERING Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Italian Data Protection Authority, approved by Resolution No. 98 of 4/4/2019, published in the Official Journal No. 106 of 8/5/2019 and in www.gpdp.it, web doc. no. 9107633 (hereinafter "Regulation of the Italian Data Protection Authority no. 1/2019");
SEEN the documentation in the file;
SEEN the observations made by the Secretary General pursuant to Article 15 of Regulation of the Italian Data Protection Authority no. 1/2000 on the organization and functioning of the Office of the Italian Data Protection Authority, in www.gpdp.it, web doc. no. 1098801;
REPORTER: Professor Pasquale Stazione;
WHEREAS
1. The preliminary investigation.
In the month of XX, this Authority received a complaint regarding the dissemination on the social media platform Instagram, on the public profile of Dr. Paolo Montemurro, of some photographs of the complainant relating to a rhinoplasty surgical procedure performed by the aforementioned professional.
According to the documents, the complainant had not consented to the dissemination of these images, even though the photographs depicting her bore a label stating "Images taken with the patient's consent" (documentation in the documents).
Following the complaint, the Office initiated a preliminary investigation and, with a note dated XX (file no. XX), requested information from the professional. The professional responded with a note dated XX, stating, in summary, that:
"The undersigned had the patient sign, as is standard practice, an informational consent form for rhinoseptoplasty, which, in Article 20, expressly provides for the possibility of using the images and videos obtained with the patient's consent for scientific and educational purposes, with the guarantee of anonymity."
"The form used is the one provided by the AICPE – Italian Association of Aesthetic Plastic Surgery – to protect the guarantees contained therein. Therefore, it is clear that this form includes the authorization to protect every aspect of the privacy regulations required by law."
"The patient expressly accepted and signed the aforementioned consent on XX, even double-signing the aforementioned Article 20 to highlight its content."
"The data controller, responsible for data processing and data security, even though the undersigned specifically operated using an operating room at the Isber Clinic in Varese, is solely and exclusively the operating physician, as specified in the information signed on XX, which also complies with the formats issued by the AICPE."
"The photographs were published on a social media platform exclusively attributable to the undersigned and with the guarantee of anonymity for the sole purpose of medical-scientific dissemination," (...) stating that "the patient is in no way recognizable in the published images, having her eyes closed, being reclined, and being in a lateral position such that the identity of the subject portrayed in profile is not revealed";
"The purpose of scientific dissemination (...) was pursued in accordance with the law, after obtaining the patient's specific consent, and taking care to publish the images without allowing the patient's identity to be identified."
In light of these elements, the Office notified Dr. Montemurro of the initiation of proceedings pursuant to Article 166, paragraph 5, of the Code (note of XX, protocol no. XX), alleging violation of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, as well as Article 166, paragraph 5, of the Code (note of XX, protocol no. XX). 2-septies, paragraph 8, of the Code.
In a note dated 20th, Dr. Montemurro submitted his defense briefs, requesting a hearing.
He reiterated that he had acted in good faith, emphasizing that he had immediately removed the images from his social media profile following the complainant's complaints, and that they were for informational purposes, free of commercial connotations. It was also reiterated that the aforementioned professional acted in good faith, having "legitimately relied on a consent form provided by AICPE, the most important national professional association, believing it to be compliant with the law."
Dr. Montemurro's hearing took place on 20th, during which he, through his lawyer, further elaborated his arguments, emphasizing the difficulty of identifying the interested party and the legitimate reliance placed on the consent form prepared by AICPE. The professional also reiterated "the difficulty in identifying the interested party from the aforementioned images, believing that she could be recognized at most only by family members, and therefore the images can be considered anonymous."
In a note dated XX, Dr. Montemurro submitted a pro veritate opinion from the AICPE Scientific Council, dated XX, stating that the use of patient images for dissemination, educational, and scientific purposes, while guaranteeing their anonymity, requires the specific consent of the interested party and that the model used by the aforementioned professional is used "by the majority of Italian plastic surgeons."
2. Outcome of the preliminary investigation.
Having acknowledged the information presented in the documents and the defense briefs, we note that:
Pursuant to the Regulation, "personal data" means "any information relating to an identified or identifiable natural person ('data subject')." Furthermore, "an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person" (Article 4, paragraph 1 of the Regulation), and "data concerning health" means personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about that natural person's health (Article 4, paragraph 1, paragraph 15 of the Regulation);
Pursuant to the Regulation, personal data must be "processed lawfully, fairly, and in a transparent manner in relation to the data subject (lawfulness, fairness, and transparency)," collected for specified, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes (purpose limitation principle), and "adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed" (data minimization principle) (Article 5, paragraph 1, letters a), b), and c) of the Regulation);
Dissemination of personal data means "the disclosure of personal data to unspecified persons, in any form, including by making them available or consulting them" (Article 2-ter, paragraph 4 of the Code);
Data protection legislation does not apply to "anonymous information, that is, information that does not relate to an identified or identifiable natural person, or to personal data rendered anonymous in such a way that the data subject is not, or no longer, identified" (see Recital 26 of the Regulation and WP29 Opinion 05/2014 on Anonymization Techniques, adopted on 10 April 2014).
Anonymization cannot be considered achieved by simply removing the data subject's personal details. Indeed, anonymized data is only considered such if it does not in any way allow for the direct or indirect identification of a natural person, taking into account all the means (financial, informational, technological, skillful, time) available to the person (controller or other entity) attempting to use such tools to identify a data subject. An anonymization process cannot be considered truly anonymized if it is not capable of preventing anyone using such data, in combination with "reasonably available" means, from isolating an individual in a group (single-out), connecting an anonymized piece of data to data relating to a person in a separate dataset (linkability), and inferring new information relating to a person from an anonymized piece of data (inference). These requirements must be met in conjunction.
Anonymization must be considered dynamic processing, with the data controller required to remove any singularity if, by any means, it becomes aware of it at a later stage, and to track such events in order to repeat the re-identification risk assessment upon reaching a predefined threshold, appropriate to the context, identified on the total number of records included in the database.
The dissemination of data capable of revealing the health status of data subjects is, in general, expressly prohibited unless one of the lawful cases referred to in Article 9, paragraph 1, applies. 2 of the Regulation (Article 2-septies, paragraph 8, and Article 166, paragraph 2, of the Code);
In this regard, the Guarantor has repeatedly emphasized that with the full implementation of the Regulation, unlike in the past, healthcare professionals, subject to professional secrecy, no longer need to request patient consent for treatments necessary for the healthcare service requested by the data subject, regardless of whether they operate as a freelancer (in a medical practice) or within a public or private healthcare facility (see the provision "Clarifications on the application of the regulations for the processing of health-related data in the healthcare sector" of March 7, 2019, web doc. no. 9091942);
In cases where processing is not strictly necessary for treatment purposes and the legal basis is the data subject's consent, given the nature of such data, which is particularly sensitive in terms of fundamental rights and freedoms, such consent must be given through a positive act by which the data subject expresses a freely given, specific, informed, and unambiguous wish to process their personal data (Article 9, paragraph 2, letter a) of the Regulation and paragraph 4 of Guidelines 5/2020 on consent pursuant to Regulation (EU) 2016/679, adopted by the European Data Protection Board on May 4, 2020);
Furthermore, as highlighted in the aforementioned Guidelines, "the General Data Protection Regulation strengthens the requirement that consent be informed. Pursuant to Article 5 of the Regulation, the requirement of transparency is one of the fundamental principles, closely linked to the principles of fairness and lawfulness."Providing information to data subjects before obtaining their consent is essential to enable them to make informed decisions, understand what they are consenting to, and, for example, exercise their right to withdraw consent. If the data controller fails to provide accessible information, the user's control becomes illusory, and consent will not constitute a valid basis for processing. If the requirements for informed consent are not met, consent will not be valid and the data controller may be in violation of Article 6 of the Regulation.
With specific reference to the publication of clinical cases, the Code of Medical Ethics approved by the National Federation of the Orders of Surgeons and Dentists in 2014 (as amended in 2016, 2017, and 2020) provides that "the physician shall ensure that the subjects involved in the publication or scientific dissemination of data and clinical studies cannot be identified" (Article 11 - Confidentiality of Personal Data).
Also relevant is the Code of Conduct for the Use of Health Data for Educational and Scientific Publication Purposes approved by the Italian Data Protection Authority with the provision of January 14, 2021, which clarifies that the use of personal data for educational and scientific publication purposes by healthcare professionals may only occur after adopting specific safeguards. Anonymization and, secondarily, pseudonymization; if anonymization of the data is not possible, the data controller must obtain specific consent from the data subject. Once consent is obtained, the data will be pseudonymized before being disseminated (web doc. no. 9535354 and art. 5 of the aforementioned Code of Conduct – regarding the publication on social media of images and videos of patients undergoing medical procedures, see also provisions of April 15, 2021, web doc. nos. 9587071, 9587089, 9587637, of January 11, 2024, web doc. no. 9983210, and of December 12, 2024, web doc. no. 10095836).
Based on the documentation acquired and the defenses presented, it is observed that the published images contain personal data capable of revealing the state of health. of the data subject, who is identifiable—as Dr. Montemurro also acknowledged—at least within a limited circle of individuals, based on clearly visible facial features.
The measures adopted by the professional (absence of personal data, obscuring a facial detail) are not suitable for achieving effective anonymization according to the criteria identified by the legislation and the interpretative guidelines cited.
It follows that the dissemination of the images involved the unlawful processing of health data, lacking a valid basis for lawfulness pursuant to Article 9 of the Regulation. The consent obtained cannot be considered valid, as it was given on the basis of the prospect of dissemination of anonymous data. This circumstance, in light of the evidence that has emerged, has not actually occurred, as highlighted in the Code of Conduct for the Use of Health Data for Educational and Scientific Publication Purposes cited above. A healthcare professional who intends to disseminate images and videos of patients for educational purposes In accordance with the professional code of ethics, educational or scientific data processors may, after providing prior information, only disseminate data, images, and videos that have been properly anonymized. If this is not possible due to the clinical characteristics or specific circumstances of the case, it is necessary to obtain the patient's specific, free, and informed consent and proceed with the publication of pseudonymized data/images.
Therefore, if Dr. Montemurro had properly anonymized the complainant's images, he should not have requested her informed consent for dissemination because, as noted above, the personal data protection regulations do not apply to anonymous information; in such cases, only complete disclosure is sufficient. If, as in this case, the measures adopted did not effectively anonymize the data, Dr. Montemurro should have requested specific consent from the patient, highlighting that the data being disseminated would be personal, although not directly identifiable.
3. Conclusions.
In light of the above considerations, and taking into account the statements made by the data controller during the of the investigation – and considering that, unless the act constitutes a more serious crime, anyone who, in proceedings before the Data Protection Authority, falsely declares or certifies information or circumstances or produces false documents or records is liable pursuant to Article 168 of the Code, "False declarations to the Data Protection Authority and interruption of the performance of the duties or exercise of the powers of the Data Protection Authority" – the information provided by the data controller in the defense briefs does not allow the findings notified by the Office with the document initiating the proceedings to be overcome, since, moreover, none of the cases envisaged in Article 11 of the Data Protection Authority Regulation No. 1/2019 apply.
For these reasons, the processing of personal data carried out by Dr. Paolo Montemurro in the terms set out in the grounds is found to be unlawful, in violation of the basic principles of processing set out in Articles 5, paragraph 1, letters a), b) and c) and 9 of the Regulation, as well as Article 2-septies, paragraph 8 of the Code.
Violation of the aforementioned provisions may result in the application of the administrative sanction provided for in Article 83, paragraph 5 of the Regulation.
4. Corrective measures
Article 58, paragraph 2, provides the Garante with a series of corrective powers, both prescriptive and punitive, to be exercised in the event that unlawful processing of personal data is ascertained. Among these powers, Article 58, paragraph 2, letter d) of the Regulation provides for the power to "order the controller or processor to bring processing operations into conformity with the provisions of this Regulation, where appropriate, in a specific manner and within a specific period."
In light of the above considerations, it is deemed appropriate to order Dr. Paolo Montemurro, pursuant to the aforementioned Article 58, paragraph 2, letter d) of the Regulation, to adopt the following corrective measure within ninety days of notification of this provision: A document providing its patients with the information referred to in Articles 13 and 14 of the Regulation and requesting the data subject's consent (Annexes 2 and 3 to Note XX in the documents):
Establishment that the use of health data for educational and scientific publication purposes must guarantee the patient's anonymity, and that where this is not possible, given the characteristics and specifics of the clinical case, specific informed consent must be requested;
Removing consent to data processing for treatment purposes, since, pursuant to Article 9, paragraph 2, letter h) and paragraph 3 of the Regulation, healthcare professionals, subject to professional secrecy, must not request patient consent for processing strictly necessary for the healthcare service requested by the data subject;
Specifying the retention period for the data processed for each of the distinct processing purposes pursued, including the length of time for which pseudonymized images of the patient will be published on the controller's social media channels.
5. Adoption of the ordinance Injunction for the application of the administrative pecuniary sanction and additional sanctions (Articles 58, paragraph 2, letter i), and 83 of the Regulation; Article 166, paragraph 7, of the Code).
The violation of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, as well as Article 2-septies, paragraph 8, of the Code, caused by the conduct of Dr. Montemurro, is subject to the application of the administrative pecuniary sanction pursuant to Article 83, paragraph 5, of the Regulation and Article 166, paragraph 2 of the Code.
The Guarantor, pursuant to Article 58, paragraph 2, letter i) of the Regulation and Article 166 of the Code, has the power to impose an administrative pecuniary sanction pursuant to Article 83 of the Regulation, by issuing an injunction. (Article 18, Law No. 689 of 24 November 1981), in relation to the processing of personal data carried out by Dr. Montemurro, which was found to be unlawful, as set out above.
Considering that Article 83, paragraph 3, of the Regulation should be applied, where it states that "if, in relation to the same or related processing operations, a controller […] infringes, intentionally or negligently, several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement," the total amount of the fine is calculated so as not to exceed the maximum amount set out in the same Article 83, paragraph 5.
In light of the above and, in particular, of the category of personal data affected by the infringement, which, by their nature, are particularly sensitive in terms of fundamental rights and freedoms, of the disclosure of the data from XX to XX, and of the lack of intentional action on the part of the controller (the infringement having occurred in good faith in (Conviction that the consent form used, provided by the AICPE association, complied with the legislation on the protection of personal data) it is believed that the level of severity of the violation committed by Dr. Montemurro is high (see European Data Protection Board, “Guidelines 04/2022 on the calculation of administrative fines under the GDPR” of 23 May 2023, point 60).
With reference to the elements listed in Article 83, paragraph 2 of the Regulation for the purposes of applying the administrative fine and its quantification, considering that the fine must be "effective, proportionate and dissuasive in each individual case" (Article 83, paragraph 1 of the Regulation), it is noted that, in the case at hand, the following circumstances were taken into account:
As soon as the data controller received the complainant's complaints, it promptly removed the aforementioned images from its Instagram profile (Article 83, paragraph 2, letter c) of the Regulation).
There are no previous relevant violations committed by the data controller, nor have any measures pursuant to Article 58 of the Regulation been previously taken (Article 83, paragraph 2, letter e) of the Regulation).
Dr. Montemurro has cooperated fully with the Authority throughout this proceeding.
Based on the above factors, assessed as a whole, it is deemed appropriate to set the amount of the pecuniary sanction provided for by Article 83, paragraph 5, letters a) and b), of the Regulation, at €5,000 (five thousand) for violations of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, as well as Article 2-septies, paragraph 8, of the Code, as an administrative pecuniary sanction deemed, pursuant to Article 83, paragraph 1, of the Regulation, to be effective, proportionate, and dissuasive.
It is also deemed appropriate to apply the additional sanction of publication of this provision on the Garante's website, provided for by Article 166, paragraph 7, of the Code and Article 16 of the Garante's Regulation No. 1/2019, also taking into account the type of personal data subject to unlawful processing.
Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor, are met.
NOW CONSIDERING ALL THE ABOVE, THE GUARANTOR
declares the processing of personal data carried out by Dr. Paolo Montemurro unlawful for violation of Articles 5, paragraph 1, letters a), b), and c), and 9 of the Regulation, and Article 2 septies, paragraph 8 of the Code, as set out in the grounds.
ORDERS
Pursuant to Articles 58, paragraph 2, letter i), and 83 of the Regulation, as well as Article 166 of the Code, Dr. Paolo Montemurro, Fiscal Code XX, to pay the sum of €5,000 (five thousand) as an administrative fine for the violations indicated in this order; It is hereby stated that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half the imposed fine.
ORDERS
Dr. Paolo Montemurro, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, to pay the sum of €5,000 (five thousand) according to the methods indicated in the attachment, within 30 days of notification of this order, under penalty of the adoption of the subsequent enforcement proceedings pursuant to Article 27 of Law No. 689/1981;
pursuant to Article 58, paragraph 2, letter d) of the Regulation, to bring its processing operations into conformity with the provisions of the Regulation, adopting the following corrective measure within ninety days of notification of this provision: revising the document in which it provides its patients with the information referred to in Articles 13 and 14 of the Regulation and which requests the data subject's consent (Annex XX and XX to the footnote to XX):
providing that, for the use of health data for educational and scientific publication purposes, patient anonymity is guaranteed and that, where this is not possible, given the characteristics and specifics of the clinical case, specific informed consent is required;
eliminating consent to data processing for treatment purposes, since, pursuant to Article 9, paragraph 2, letter h) and paragraph 3 of the Regulation, healthcare professionals, subject to professional secrecy, must not request patient consent for processing operations strictly necessary for the healthcare service requested by the data subject;
specifying the retention period for the data processed for each of the distinct processing purposes pursued, taking care to also indicate for how long the pseudonymized images of the patient will be published on the data controller's social media channels.
Failure to comply with an order issued pursuant to Article 58, paragraph 2, of the Regulation is punishable by the administrative sanction referred to in Article 83, paragraph 6, of the Regulation;
pursuant to Article 58, paragraph 1, letter a), of the Regulation and Article 157 of the Code, to communicate what initiatives have been undertaken to implement the provisions of the aforementioned paragraph 4, and to provide adequately documented feedback no later than 20 days after the expiration of the aforementioned deadline. Failure to respond to a request issued pursuant to Article 157 of the Code is punishable by the administrative sanction pursuant to the combined provisions of Articles 83, paragraph 1, letter b), and 157 of the Code. 5 of the Regulation and Article 166 of the Code.
ORDERS
- Pursuant to Article 166, paragraph 7, of the Code, the publication of this provision in full on the Guarantor's website and the recording of this provision in the Authority's internal register, provided for by Article 57, paragraph 1, letter u), of the Regulation, of violations and measures adopted in accordance with Article 58, paragraph 2, of the Regulation;
- the transmission of this provision to the AICPE – Italian Association of Aesthetic Plastic Surgery so that it may align the information and consent forms it offers its members with the indications provided in this provision.
Pursuant to Article 78 of the Regulation, Articles 152 of the Code, and Article 10 of Legislative Decree no. 150/2011, an appeal against this provision may be filed before the ordinary judicial authority, under penalty of inadmissibility, within thirty days of the date of notification of the provision itself, or within sixty days if the appellant resides abroad.
Rome, January 29, 2026
THE PRESIDENT
Stanzione
THE REPORTER
Stanzione
THE SECRETARY GENERAL
Montuori
