Garante per la protezione dei dati personali (Italy) - 9779098

From GDPRhub
Garante per la protezione dei dati personali - 9779098
LogoIT.png
Authority: Garante per la protezione dei dati personali (Italy)
Jurisdiction: Italy
Relevant Law: Article 9(1) GDPR
Article 5 GDPR
Article 12 GDPR
Codice in materia di protezione dei dati personali
Type: Complaint
Outcome: Upheld
Started: 26.03.2020
Decided: 28.04.2022
Published:
Fine: 40,000 EUR
Parties: Il Sole 24 Ore S.p.a.
National Case Number/Name: 9779098
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Italian
Original Source: Garante Per La Protezione Dei Dati Personali (in IT)
Initial Contributor: Matty Weinberg

The Italian DPA fined a daily newspaper €40,000 for negligently publishing the personal details of a homosexual couple and their adopted child in an online article covering related judicial proceedings.

English Summary

Facts

The controller was a daily newspaper. The data subjects were a homosexual couple and their adopted child.

The controller published an article covering a court case relating to the data subjects, mistakenly attaching documents that contained the data subjects' personal data.

The data subjects requested that the data be deleted, and the controller complied a day later. Before the article was removed from the controller's website, it received nineteen unique visitors.

The controller did not respond to further data access requests regarding the identities of the recipients of the personal data, arguing that its prompt removal of the article made any further response unnecessary.

Holding

The Italian DPA (Garante per la protezione dei dati personali - GDPD) found that the controller had violated Article 5 and Article 9 GDPR; it fined the controller €40,000, balancing, among other things, the sensitive nature of the data disclosed (sexual orientation, data relating to the adoption of a minor) and the negligent nature of the infringement against the controller's journalistic purpose and prompt measures to eliminate the consequences of the breach.

The GDPD also issued a warning for failure to respond to the data subjects' requests for access, inviting the controller to implement additional measures to guarantee the effective exercise of future data subjects' rights under Article 12 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

Injunction order against Il Sole 24 Ore S.p.a. -

28 April 2022 [9779098]



                                                                              [web doc. no. 9779098]

Injunction order against Il Sole 24 Ore S.p.a. - 28 April 2022


                                                                        Register of Measures
                                                                           no. 157 of 22 April 2022

                  THE PERSONAL DATA PROTECTION GUARANTOR

At today's meeting, which was attended by Prof. Ginevra Cerrina Feroni
vice-president, Dr Agostino Ghiglia and Mr Guido Scorza, members, and Cons. Fabio Mattei,
secretary general;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

(hereinafter, the "Regulation");

HAVING REGARD to the Personal Data Protection Code, containing provisions for the adaptation
national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of 30 June 2003, as
amended by Legislative Decree No 101 of 10 August 2018, hereinafter referred to as the "Code");

HAVING REGARD to the note dated 26 March 2020 in which Mr Schuster, on behalf of XX, XX and the minor
XX, complained of a violation of Article 52 of the Code, as well as of the provisions protecting the
information relating to the status of an adopted child (Article 73, Law No. 183/1984) in relation to the

full publication by Il Sole 24 Ore S.p.a. ("Quotidiano Enti locali&Pa" in
the article entitled 'XX'), of the Order of the Court of Cassation No. XX
concerning the recognition in Italy of the order of a US judge concerning
the adoption of a child by a homosexual couple; this, despite the fact that there was
the order had the annotation referred to in Article 52 of the Code, ordered ex officio, aimed at requiring
the omission of the personal details of the persons concerned in the event of disclosure or reproduction of the document;


WHEREAS the applicants, in the same note of 26 March, also lodged
complaint pursuant to Article 77 of the Regulation, complaining of non-compliance with the request for access to the data made to Il Sole
access to the data formulated to Il Sole 24 Ore S.p.a., pursuant to Articles 15 to 22 of the Regulation,
having received a reply only in relation to the removal of the aforementioned order but not to the other requests formulated
requests made;

HAVING REGARD TO the request for information sent by the Office on 19 February 2021 (prot.

10392/21) and the reply note of the following 9 March in which Il Sole 24 Ore S.p.a
represented that:

      - the contents object of the grievance were not posted on the main website of the newspaper
      but in the magazine 'Quotidiano Enti locali&Pa', an editorial product distributed exclusively in
      digital format and whose contents are reserved for subscribers; - the publication of the order was the result of a mere inadvertent error on the part of the
      production graphic assistants in charge of attaching documents pertaining to the

      articles commenting on legal issues of interest, specifying that the article of
      commentary on the jurisdictional decision under complaint was in any case devoid of the
      personal data concerning the parties;

      - the Company removed the order on 14 December 2019, the day after
      of receipt of the warning, at the same time also communicating the removal of the copy in

      pdf format from its system, so that it could not be found via search engines;
      by doing so, it considered that it had complied with the complainant's request made
      with two separate e-mails of 13 December;

      - in light of the above, it considered it unnecessary to reply to the further letter of 17 January
      2020, as it was clear that "no further data remained in its possession, which

      no further processing could have been carried out and that the only one carried out had the
      obvious, inferable from the article, to which the measure had been posted';

      - on 20 April 2020, after the complaint had been lodged with the Garante, he received a further
      missive from the applicants' lawyer, with the subject matter of "Reminder of compensation for
      violation of rights in relation to the processing of personal data' to which - although

      considered superfluous in view of what had already been done, it replied on
      the following 9 May, thus deeming that it had exhausted the requests of the interested parties in terms of exercising their rights
      profile of the exercise of the rights under Articles 15 to 22 of the Regulation and instead remaining
      awaiting the counterparty's announced actions with regard to claims for damages;

HAVING REGARD TO the note dated 25 March 2021 in which the complainants' lawyer replied, pointing out that


      - contrary to the Publisher's assertion, the article in question was freely
      accessible by any visitor to the website, since there was a caption that
      the article in question was freely accessible to any visitor to the website, as it was marked in such a way as to allow non-subscribers to read it free of charge, thus
      of the news;

      - the proprietor, acknowledging the erroneous publication of the data, also admitted the violation
      of Article 52 of the Code, for which an administrative sanction is provided for (Article 166, para

      2 of the Code and Article 83(3) of the Regulation); this profile was the subject of a report
      to the Garante together with the complaint for violation of the provisions on the exercise of rights
      rights;

      - it is confirmed from the statements of il Sole 24 Ore S.p.a. that the latter did not
      provided a complete response to the request for access to the data formulated on several occasions by the

      complainants in that 'it has never communicated the names of the persons to whom it has transmitted
      the order in question, as the practice of sending legal information also by means of
      by means of newsletters or passing it on to other publishers or press agencies' and, having objected
      that there were only 30 accesses to the document in question, it did not however
      communicated its identity;


HAVING REGARD TO the note of 19 April 2021 in which Sole 24 Ore S.p.a., in acknowledging that there has been an
error and that it resulted in the disclosure of personal data even of a minor:

      - contested the assumption that, since it was a freely consultable pdf, it would be
      wide dissemination of the news because 'if it is true that the pdf was in consultation
      free of charge until 13 December 2019, therefore for 30 days, it is equally true that, in this

      period, it had only 30 views, from a total of 19 unique browsers';

      - dismissed the objections regarding the failure to respond to the request for access given the peculiarity of the journalistic and legal information sector which makes the purpose of the
      processing (excluding possible alternatives once the data had been deleted, as happened in the

      case at hand);

      - argued that it had not withheld information as to to whom the data would be
      communicated, for example by sending newsletters to subscribers, given the
      circumstance that the latter did not in any event allow direct access to the order
      de qua;


HAVING REGARD TO the Office's note of 7 October 2021 (prot. no. 50221/21) whereby, pursuant to Section 166,
paragraph 5, of the Code, Il Sole 24 Ore S.p.a. was notified of the commencement of the procedure for
the possible adoption of measures pursuant to Article 58, paragraph 2, of the Regulation and notified the
possible violations of the law in relation to the following provisions:

      - the general principles of the processing referred to in Article 5(1) of the Regulation and, in particular, the

      principle of "lawfulness and fairness" (sub. a);

      - art. 50 of the Code concerning the prohibition of publication of information likely to enable
      the identification of a minor in legal proceedings;

      - article 52(5) of the Code governing the limits on the dissemination of identification data in
      judicial measures in proceedings concerning family relations and the status of the

      persons;

      - article 9 of the Regulation concerning the limits to the processing of particular data, including those
      relating to a person's sex life or sexual orientation;

      - article 85 of the Regulation and Articles 136 et seq. of the Code governing the processing of
      data for journalistic purposes and other expressions of thought, with particular reference to

      article 137(3) of the Code;

      - the Deontological Rules in Annex A1 of the Code and in particular Art. 7 (Protection of the
      minor) and the Treviso Charter;

      - art. 2 - quater of the Code which states that compliance with the Rules of Ethics
      constitutes 'an essential condition for the lawfulness and fairness of the processing';

      - article 12(3) and (4) of the Regulation with reference to the exercise of the rights under the

      articles 15 - 22 of the Regulation itself;

HAVING REGARD TO the note dated 8 November 2021 in which Il Sole 24 Ore S.p.a., in recalling its previous
defence, wished to specify that:

      - this is an isolated case due to an unintentional error in the face of a very
      significant number of court orders that have been ritually anonymised;


      - the Company has implemented a process for the procurement of judgments and
      of the Supreme Court to ensure full compliance with data protection provisions
      data protection provisions and has also dedicated particular care to training journalists in
      this field and with particular attention to the issue of minors;

      - 'only 19 people, therefore, some more than once, have seen the measure,

      by accessing the company's website, since it cannot be held liable for the further and undocumented use
      the violation is of minor importance and is not malicious in nature and in any case the Company took immediate action to remove the measure; - the violation is of minor importance and is not malicious in nature and in any case the
      immediately to remove the measure;


      - "the delayed and partial response to the request for access to the data, formulated by the interested parties is
      largely due to the superfluousness of the information requested, inferable from facts known to them
      known to them and the company having promptly removed the
      jurisdiction as requested by the data subjects by email of 13 December 2019, as well as
      [due] to the protection of the confidentiality of its users, as governed by its own

      Policy"; in any event, "after having received on 20 April 2020 a further missive with the subject
      the subject of "Waiver of compensation for violation of rights in relation to the processing of
      personal data processing', the company promptly provided a full reply to the interested parties
      on 9 May 2020';

WHEREAS, unless the act constitutes a more serious offence, any person, in a

proceedings before the Garante, falsely declares or attests information or circumstances or produces false deeds or documents
or documents shall be liable pursuant to Section 168 of the Code "False statements to the Guarantor
Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor';

NOTING that it is uncontested that, in the "Quotidiano Enti locali&Pa", published by Il Sole 24 Ore
S.p.a., on 13 November 2019 there was the full publication including data

identifying data of a court decision in the field of family relations concerning
the adoption of a child by a same-sex couple and to which was affixed
the annotation referred to in Article 52(2) of the Code aimed at prescribing the omission of the
particulars of the persons concerned in the event of disclosure or reproduction of the document;

WHEREAS:


      - article 50 of the Code prohibits the publication of information enabling the identification of
      a minor even in judicial proceedings in matters other than criminal law;

      - article 52(4) of the Code provides that "in the event of dissemination also by third parties of
      judgments or other measures bearing the annotation referred to in paragraph 2, or of the relevant
      legal maxims, the particulars and other identifying data of the person concerned shall be omitted" and
      of the person concerned" and the following paragraph 5 states that "whoever disseminates judgments or other

      measures of the judicial authority of any order and degree is obliged to
      omit in any event, even in the absence of the annotation referred to in subsection 2, the personal particulars,
      other identifying data or other data also relating to third parties from which the identity of minors may be inferred, even indirectly
      indirectly the identity of minors, or of the parties in proceedings concerning family and personal status
      family and personal status';


      - article 9 of the Regulation prohibits the processing of data concerning a person's sex life or sexual orientation
      sexual orientation of the person;

      - article 137(3) of the Code requires that the dissemination of data for journalistic purposes
      for journalistic purposes must comply with the 'essential nature of the information concerning facts of
      public interest';


      - the Deontological Rules set out in Appendix A1 of the Code and, in particular, Article 7
      recognise the pre-eminence of the child's right to privacy over the right to report the news
      and prescribe the adoption of precautions to guarantee anonymity;

      - the Charter of Treviso, in the text in force at the time of publication
      prescribed that "in cases of fostering or adoption and those of parents

      separated or divorced parents, without prejudice to the right to report and criticise the decisions
      of the judicial authority and the usefulness of articles or enquiries, it is however necessary also in these cases to protect the anonymity of the child so as not to affect the harmonious development of his or her personality,
      avoiding sensationalism and any form of speculation'; similar principle of protection

      anonymity of the minor is provided for in the text of the Charter revised and updated by the
      Council of the Order of Journalists at its meeting of 6 July 2021 (Articles 2 and 7);

      - article 2-quater of the Code states that compliance with the Rules of Ethics constitutes
      "an essential condition for the lawfulness and fairness of the processing".

CONSIDERING that the processing described constitutes a violation of the aforementioned provisions and of the

general principle that personal data must be processed lawfully and fairly (Art.
5(1)(a) of the Regulation;

CONSIDERING therefore, pursuant to Article 57(1)(f) of the Regulation, that it is necessary to declare
that the processing is unlawful and, consequently, pursuant to Article 58(2)(f) of the Regulation, to
order the prohibition of further processing of the complainants' personal data, with the exception of their

conservation, also for the purpose of possible use in judicial proceedings;

NOTING that with regard to the exercise of the rights under Articles 15-21 of the Regulation, the data controller has
provided a timely response to the complainants' first request (first email of 13 December
2019), removing the measure complained of on the day following
to the request made by the complainants, failing, however, to respond to the further requests made

on the same date by the data subjects regarding the processing of their data, including, in particular, the scope of
communication of the data themselves, information which is indeed particularly relevant given the nature of the
data themselves and easily ascertainable, at least in the first instance, in the terms and with the
arguments it subsequently provided, after a further reminder (20 April 2020), to the
complainants (note of 9 May 2020) and to this Authority in the course of the investigation;


CONSIDERED that such conduct evidences elements abstractly capable of constituting
of an infringement of Article 12 of the Regulation;

CONSIDERING therefore that a warning should be addressed to Il Sole 24 Ore S.p.a., pursuant to Art.
58(2)(a) of the Regulation, in relation to the circumstance that the incomplete and
late response to a request attributable to the exercise of one of the rights provided for in Articles 15-21 of the
Regulation constitutes conduct contrary to the law, which is also liable to a penalty (Article 83(5).

b), inviting the Company to identify, in relation to future similar cases, measures
appropriate measures to guarantee the effective exercise of the rights of the persons concerned within the terms and in the manner
provided for in the aforementioned Article 12 of the Regulation;

NOTING also that the complainants have brought an action before the civil courts for
compensation for damages;


WHEREAS, moreover, failure to comply with Articles 5 and 9 of the Regulation is sanctioned
by Article 83(5)(a) of the Regulation and that, similarly, failure to comply with the provisions of
of Article 52(4) and (5) of the Code and of the Rules of Ethics is sanctioned under the combined provisions of Art
combined provisions of Articles 2-quater, 166(2) of the Code and 83(5) of the
Rules;


CONSIDERED, therefore, that it is necessary to adopt an injunction order, pursuant to Articles 166, paragraph
7, of the Code and 18 of law no. 689/1981, for the application to Il Sole 24 Ore S.p.a.
of the administrative fine provided for in the combined provisions of Articles 2-quater,
166, paragraph 2, of the Code, and 83, paragraphs 3 and 5, of the Regulation;

HAVING REGARD TO Article 83, paragraph 3, of the Regulation, pursuant to which if, in relation to the same processing operation

or related processing operations, a controller or processor intentionally or negligently infringes various
provisions of the Regulation, the amount of the fine shall not exceed the amount applicable for the most serious breach;

NOTING that in determining the amount of the fine, account should be taken of

account must be taken of the factors referred to in Article 83(2) of the Regulation and that in the present case it is necessary to
be taken into account as aggravating circumstances:

      (a) the seriousness of the infringement (Article 83(2)(a) of the Regulation), having regard to the
      particular nature of the data processed capable of revealing the identity of a minor and his or her status as an
      adopted child - information protected as such by the law (Law of 4 May 1983,

      no. 184 of 4 May 1983)- as well as the sexual orientation of the parents; this in relation to a particularly
      sensitive issue that has not yet been fully regulated in Italy
      Italy;

      b) again with reference to the seriousness of the breach, the fact that the dissemination of
      this data was disseminated, without the knowledge of the persons concerned, for journalistic purposes and, in

      particular, of information on a profile/case study of law (the recognition of a
      foreign judgment of adoption by same-sex adoptive parents) that
      totally disregarded the identity of the persons concerned;

      (c) again, in terms of seriousness, the level of harm suffered by the persons concerned, in view of
      the impact of such publication in the social context of reference of the 'constituent

      family unit in the Italian legal system, in view of the above-mentioned lack of legislative recognition of
      legislative recognition of adoption by parents of the same sex;

      (d) the negligent nature of the infringement (Article 83(2)(b) of the Regulation), given
      account of the fact stated by the holder himself that he had implemented a proven
      system for the procurement of judgments and court orders - whose

      commentary on which represents, in significant part, the purpose of the review - and that, also in view of
      of the Company's economic and organisational conditions in the publishing field, should have
      should have ensured a careful verification of the material being published, especially
      where - as in the present case, also by express admission of the Company - the
      legal measure had been formally annotated pursuant to Art.

      52(2) of the Code;

      e) the relevant organisational, economic and professional conditions of the
      offender (Art. 83(2)(k) of the Regulation) taking into account the
      financial statements for the year 2020;
      and, as mitigating factors:

      (f) the purposes pursued by the holder, attributable - in general terms - to the freedom of

      information (Art. 85) and by the Code (Art. 136 et seq.);

      g) the adoption of appropriate measures to eliminate the consequences of the breach (Art. 83, par. 2,
      c) of the Regulation), the holder having promptly removed the measure;

      (h) the cooperation shown in the course of the proceedings (Art. 83(2)(f) of the
      (Art. 83(2)(f) of the Regulation) and the absence of previous objections by the Authority in the context of the proceedings

      journalism (Art. 83(2)(e) of the Regulation);

CONSIDERING the above parameters and the principles of effectiveness, proportionality and dissuasiveness
set out in Article 83(1) of the Regulation;

CONSIDERING that, on the basis of all the above elements, the following penalty should be applied
administrative pecuniary sanction of EUR 40 000,00 (forty thousand) must be applied
fundamental rights of the data subjects, the type of data processed and the sector of activity of the data controller

that, pursuant to Articles 166(7) of the Code and 16(1) of the Regulation of the Garante
no. 1/2019, this measure should be published on the website of the
Garante's website, as an ancillary sanction;

CONSIDERED that the conditions are met for proceeding with the annotation in the internal register
of the Authority pursuant to Article 57(1)(u) of the Regulation, in relation to the measures adopted

in this case in accordance with Article 58(2) of the Regulation;

HAVING REGARD TO the documents in the file;

HAVING CONSIDERED the observations made by the Secretary-General pursuant to Rule 15 of the Regulation of the
Supervisor's Regulation No. 1/2000;

REFERRED to Mr Guido Scorza, lawyer;


                                 ALL THE FOREGOING THE GUARANTOR

      pursuant to Article 57(1)(f) of the Regulation. declares the unlawfulness of the processing in the terms
      terms set out in the preamble and to that effect:

      (a) pursuant to Article 58(2)(f) of the Regulation, orders the prohibition of further
      processing of the complainants' personal data, with the exception of their storage, even

      for the purposes of possible use in legal proceedings;

      b) pursuant to Article 58(2)(a) of the Regulation, orders the measure of a warning
      against Il Sole 24 Ore S.p.a. in relation to the circumstance that the incomplete and
      and late response to a request attributable to the exercise of one of the rights provided for in Articles 15 to
      21 of the Regulation constitutes conduct contrary to law, which is also liable to a penalty

      (Art. 83(5)(b)), inviting the Company to identify, in relation to
      similar cases in the future, appropriate measures to guarantee the effective exercise of the rights of the
      interested parties within the terms and in the manner provided for by the aforementioned Article 12 of the Regulation.

                                                 ORDER

      pursuant to Articles 58, paragraph 2 letter i) and 83 of the Regulation to Il Sole 24 Ore S.p.a., with
      headquartered in Milan, viale Sarca 223, C.F. n. 00777910159, in the person of its legal representative

      pro tempore, to pay the sum of euro 40,000.00 (forty thousand) by way of a fine
      administrative fine for the violations indicated in the grounds, representing that the
      violator, pursuant to Article 166, paragraph 8, of the Code has the right to settle the
      dispute, by payment, within the term of thirty days, of an amount equal to
      half of the penalty imposed;


                                                INJUDGES

      to Il Sole 24 Ore S.p.a., in the event of failure to settle the dispute pursuant to the aforementioned
      article 166, paragraph 8, of the Code, to pay the sum of euro 40,000.00 (forty thousand)
      according to the modalities indicated in the annex, within 30 days from the notification of this provision
      measure, under penalty of the adoption of the consequent executive acts pursuant to Article 27 of the

      law no. 689/1981.

                                                ORDER

      pursuant to Article 166, paragraph 7, of the Code, the publication in full of this provision on the website of the Guarantor and the entry in the internal register of the Authority referred to in
      pursuant to Article 57(1)(u) of the Regulation, of the measures taken against Il Sole

      24 Ore S.p.a. in accordance with Article 58(2) of the Regulation.

      Pursuant to art. 78 of the Regulation, as well as articles 152 of the Code and 10 of Leg
      september 2011, no. 150, opposition to this measure may be lodged
      to the ordinary judicial authority, by means of an appeal filed, alternatively, with the court
      of the place where the data controller resides or has its head office or at the court of the place of

      place of residence of the data subject within a period of 30 days from the date of communication of the decision or 60 days from the date of the decision
      the measure itself, or within 60 days if the appellant resides abroad.

Rome, 28 April 2022

                                                                             THE VICE-PRESIDENT
                                                                                      Cerrina Feroni


                                                                                     THE SPEAKER
                                                                                             Scorza

                                                                     THE SECRETARY GENERAL
                                                                                              Mattei