Garante per la protezione dei dati personali (Italy) - 9779098
|Garante per la protezione dei dati personali - 9779098|
|Authority:||Garante per la protezione dei dati personali (Italy)|
|Relevant Law:||Article 9(1) GDPR|
Article 5 GDPR
Article 12 GDPR
Codice in materia di protezione dei dati personali
|Parties:||Il Sole 24 Ore S.p.a.|
|National Case Number/Name:||9779098|
|European Case Law Identifier:||n/a|
|Original Source:||Garante Per La Protezione Dei Dati Personali (in IT)|
|Initial Contributor:||Matty Weinberg|
The Italian DPA fined a daily newspaper €40,000 for negligently publishing the personal details of a homosexual couple and their adopted child in an online article covering related judicial proceedings.
English Summary[edit | edit source]
Facts[edit | edit source]
The controller was a daily newspaper. The data subjects were a homosexual couple and their adopted child.
The controller published an article covering a court case relating to the data subjects, mistakenly attaching documents that contained the data subjects' personal data.
The data subjects requested that the data be deleted, and the controller complied a day later. Before the article was removed from the controller's website, it received nineteen unique visitors.
The controller did not respond to further data access requests regarding the identities of the recipients of the personal data, arguing that its prompt removal of the article made any further response unnecessary.
Holding[edit | edit source]
The Italian DPA (Garante per la protezione dei dati personali - GDPD) found that the controller had violated Article 5 and Article 9 GDPR; it fined the controller €40,000, balancing, among other things, the sensitive nature of the data disclosed (sexual orientation, data relating to the adoption of a minor) and the negligent nature of the infringement against the controller's journalistic purpose and prompt measures to eliminate the consequences of the breach.
The GDPD also issued a warning for failure to respond to the data subjects' requests for access, inviting the controller to implement additional measures to guarantee the effective exercise of future data subjects' rights under Article 12 GDPR.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Injunction order against Il Sole 24 Ore S.p.a. - 28 April 2022  [web doc. no. 9779098] Injunction order against Il Sole 24 Ore S.p.a. - 28 April 2022 Register of Measures no. 157 of 22 April 2022 THE PERSONAL DATA PROTECTION GUARANTOR At today's meeting, which was attended by Prof. Ginevra Cerrina Feroni vice-president, Dr Agostino Ghiglia and Mr Guido Scorza, members, and Cons. Fabio Mattei, secretary general; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation"); HAVING REGARD to the Personal Data Protection Code, containing provisions for the adaptation national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No 101 of 10 August 2018, hereinafter referred to as the "Code"); HAVING REGARD to the note dated 26 March 2020 in which Mr Schuster, on behalf of XX, XX and the minor XX, complained of a violation of Article 52 of the Code, as well as of the provisions protecting the information relating to the status of an adopted child (Article 73, Law No. 183/1984) in relation to the full publication by Il Sole 24 Ore S.p.a. ("Quotidiano Enti locali&Pa" in the article entitled 'XX'), of the Order of the Court of Cassation No. XX concerning the recognition in Italy of the order of a US judge concerning the adoption of a child by a homosexual couple; this, despite the fact that there was the order had the annotation referred to in Article 52 of the Code, ordered ex officio, aimed at requiring the omission of the personal details of the persons concerned in the event of disclosure or reproduction of the document; WHEREAS the applicants, in the same note of 26 March, also lodged complaint pursuant to Article 77 of the Regulation, complaining of non-compliance with the request for access to the data made to Il Sole access to the data formulated to Il Sole 24 Ore S.p.a., pursuant to Articles 15 to 22 of the Regulation, having received a reply only in relation to the removal of the aforementioned order but not to the other requests formulated requests made; HAVING REGARD TO the request for information sent by the Office on 19 February 2021 (prot. 10392/21) and the reply note of the following 9 March in which Il Sole 24 Ore S.p.a represented that: - the contents object of the grievance were not posted on the main website of the newspaper but in the magazine 'Quotidiano Enti locali&Pa', an editorial product distributed exclusively in digital format and whose contents are reserved for subscribers; - the publication of the order was the result of a mere inadvertent error on the part of the production graphic assistants in charge of attaching documents pertaining to the articles commenting on legal issues of interest, specifying that the article of commentary on the jurisdictional decision under complaint was in any case devoid of the personal data concerning the parties; - the Company removed the order on 14 December 2019, the day after of receipt of the warning, at the same time also communicating the removal of the copy in pdf format from its system, so that it could not be found via search engines; by doing so, it considered that it had complied with the complainant's request made with two separate e-mails of 13 December; - in light of the above, it considered it unnecessary to reply to the further letter of 17 January 2020, as it was clear that "no further data remained in its possession, which no further processing could have been carried out and that the only one carried out had the obvious, inferable from the article, to which the measure had been posted'; - on 20 April 2020, after the complaint had been lodged with the Garante, he received a further missive from the applicants' lawyer, with the subject matter of "Reminder of compensation for violation of rights in relation to the processing of personal data' to which - although considered superfluous in view of what had already been done, it replied on the following 9 May, thus deeming that it had exhausted the requests of the interested parties in terms of exercising their rights profile of the exercise of the rights under Articles 15 to 22 of the Regulation and instead remaining awaiting the counterparty's announced actions with regard to claims for damages; HAVING REGARD TO the note dated 25 March 2021 in which the complainants' lawyer replied, pointing out that - contrary to the Publisher's assertion, the article in question was freely accessible by any visitor to the website, since there was a caption that the article in question was freely accessible to any visitor to the website, as it was marked in such a way as to allow non-subscribers to read it free of charge, thus of the news; - the proprietor, acknowledging the erroneous publication of the data, also admitted the violation of Article 52 of the Code, for which an administrative sanction is provided for (Article 166, para 2 of the Code and Article 83(3) of the Regulation); this profile was the subject of a report to the Garante together with the complaint for violation of the provisions on the exercise of rights rights; - it is confirmed from the statements of il Sole 24 Ore S.p.a. that the latter did not provided a complete response to the request for access to the data formulated on several occasions by the complainants in that 'it has never communicated the names of the persons to whom it has transmitted the order in question, as the practice of sending legal information also by means of by means of newsletters or passing it on to other publishers or press agencies' and, having objected that there were only 30 accesses to the document in question, it did not however communicated its identity; HAVING REGARD TO the note of 19 April 2021 in which Sole 24 Ore S.p.a., in acknowledging that there has been an error and that it resulted in the disclosure of personal data even of a minor: - contested the assumption that, since it was a freely consultable pdf, it would be wide dissemination of the news because 'if it is true that the pdf was in consultation free of charge until 13 December 2019, therefore for 30 days, it is equally true that, in this period, it had only 30 views, from a total of 19 unique browsers'; - dismissed the objections regarding the failure to respond to the request for access given the peculiarity of the journalistic and legal information sector which makes the purpose of the processing (excluding possible alternatives once the data had been deleted, as happened in the case at hand); - argued that it had not withheld information as to to whom the data would be communicated, for example by sending newsletters to subscribers, given the circumstance that the latter did not in any event allow direct access to the order de qua; HAVING REGARD TO the Office's note of 7 October 2021 (prot. no. 50221/21) whereby, pursuant to Section 166, paragraph 5, of the Code, Il Sole 24 Ore S.p.a. was notified of the commencement of the procedure for the possible adoption of measures pursuant to Article 58, paragraph 2, of the Regulation and notified the possible violations of the law in relation to the following provisions: - the general principles of the processing referred to in Article 5(1) of the Regulation and, in particular, the principle of "lawfulness and fairness" (sub. a); - art. 50 of the Code concerning the prohibition of publication of information likely to enable the identification of a minor in legal proceedings; - article 52(5) of the Code governing the limits on the dissemination of identification data in judicial measures in proceedings concerning family relations and the status of the persons; - article 9 of the Regulation concerning the limits to the processing of particular data, including those relating to a person's sex life or sexual orientation; - article 85 of the Regulation and Articles 136 et seq. of the Code governing the processing of data for journalistic purposes and other expressions of thought, with particular reference to article 137(3) of the Code; - the Deontological Rules in Annex A1 of the Code and in particular Art. 7 (Protection of the minor) and the Treviso Charter; - art. 2 - quater of the Code which states that compliance with the Rules of Ethics constitutes 'an essential condition for the lawfulness and fairness of the processing'; - article 12(3) and (4) of the Regulation with reference to the exercise of the rights under the articles 15 - 22 of the Regulation itself; HAVING REGARD TO the note dated 8 November 2021 in which Il Sole 24 Ore S.p.a., in recalling its previous defence, wished to specify that: - this is an isolated case due to an unintentional error in the face of a very significant number of court orders that have been ritually anonymised; - the Company has implemented a process for the procurement of judgments and of the Supreme Court to ensure full compliance with data protection provisions data protection provisions and has also dedicated particular care to training journalists in this field and with particular attention to the issue of minors; - 'only 19 people, therefore, some more than once, have seen the measure, by accessing the company's website, since it cannot be held liable for the further and undocumented use the violation is of minor importance and is not malicious in nature and in any case the Company took immediate action to remove the measure; - the violation is of minor importance and is not malicious in nature and in any case the immediately to remove the measure; - "the delayed and partial response to the request for access to the data, formulated by the interested parties is largely due to the superfluousness of the information requested, inferable from facts known to them known to them and the company having promptly removed the jurisdiction as requested by the data subjects by email of 13 December 2019, as well as [due] to the protection of the confidentiality of its users, as governed by its own Policy"; in any event, "after having received on 20 April 2020 a further missive with the subject the subject of "Waiver of compensation for violation of rights in relation to the processing of personal data processing', the company promptly provided a full reply to the interested parties on 9 May 2020'; WHEREAS, unless the act constitutes a more serious offence, any person, in a proceedings before the Garante, falsely declares or attests information or circumstances or produces false deeds or documents or documents shall be liable pursuant to Section 168 of the Code "False statements to the Guarantor Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor'; NOTING that it is uncontested that, in the "Quotidiano Enti locali&Pa", published by Il Sole 24 Ore S.p.a., on 13 November 2019 there was the full publication including data identifying data of a court decision in the field of family relations concerning the adoption of a child by a same-sex couple and to which was affixed the annotation referred to in Article 52(2) of the Code aimed at prescribing the omission of the particulars of the persons concerned in the event of disclosure or reproduction of the document; WHEREAS: - article 50 of the Code prohibits the publication of information enabling the identification of a minor even in judicial proceedings in matters other than criminal law; - article 52(4) of the Code provides that "in the event of dissemination also by third parties of judgments or other measures bearing the annotation referred to in paragraph 2, or of the relevant legal maxims, the particulars and other identifying data of the person concerned shall be omitted" and of the person concerned" and the following paragraph 5 states that "whoever disseminates judgments or other measures of the judicial authority of any order and degree is obliged to omit in any event, even in the absence of the annotation referred to in subsection 2, the personal particulars, other identifying data or other data also relating to third parties from which the identity of minors may be inferred, even indirectly indirectly the identity of minors, or of the parties in proceedings concerning family and personal status family and personal status'; - article 9 of the Regulation prohibits the processing of data concerning a person's sex life or sexual orientation sexual orientation of the person; - article 137(3) of the Code requires that the dissemination of data for journalistic purposes for journalistic purposes must comply with the 'essential nature of the information concerning facts of public interest'; - the Deontological Rules set out in Appendix A1 of the Code and, in particular, Article 7 recognise the pre-eminence of the child's right to privacy over the right to report the news and prescribe the adoption of precautions to guarantee anonymity; - the Charter of Treviso, in the text in force at the time of publication prescribed that "in cases of fostering or adoption and those of parents separated or divorced parents, without prejudice to the right to report and criticise the decisions of the judicial authority and the usefulness of articles or enquiries, it is however necessary also in these cases to protect the anonymity of the child so as not to affect the harmonious development of his or her personality, avoiding sensationalism and any form of speculation'; similar principle of protection anonymity of the minor is provided for in the text of the Charter revised and updated by the Council of the Order of Journalists at its meeting of 6 July 2021 (Articles 2 and 7); - article 2-quater of the Code states that compliance with the Rules of Ethics constitutes "an essential condition for the lawfulness and fairness of the processing". CONSIDERING that the processing described constitutes a violation of the aforementioned provisions and of the general principle that personal data must be processed lawfully and fairly (Art. 5(1)(a) of the Regulation; CONSIDERING therefore, pursuant to Article 57(1)(f) of the Regulation, that it is necessary to declare that the processing is unlawful and, consequently, pursuant to Article 58(2)(f) of the Regulation, to order the prohibition of further processing of the complainants' personal data, with the exception of their conservation, also for the purpose of possible use in judicial proceedings; NOTING that with regard to the exercise of the rights under Articles 15-21 of the Regulation, the data controller has provided a timely response to the complainants' first request (first email of 13 December 2019), removing the measure complained of on the day following to the request made by the complainants, failing, however, to respond to the further requests made on the same date by the data subjects regarding the processing of their data, including, in particular, the scope of communication of the data themselves, information which is indeed particularly relevant given the nature of the data themselves and easily ascertainable, at least in the first instance, in the terms and with the arguments it subsequently provided, after a further reminder (20 April 2020), to the complainants (note of 9 May 2020) and to this Authority in the course of the investigation; CONSIDERED that such conduct evidences elements abstractly capable of constituting of an infringement of Article 12 of the Regulation; CONSIDERING therefore that a warning should be addressed to Il Sole 24 Ore S.p.a., pursuant to Art. 58(2)(a) of the Regulation, in relation to the circumstance that the incomplete and late response to a request attributable to the exercise of one of the rights provided for in Articles 15-21 of the Regulation constitutes conduct contrary to the law, which is also liable to a penalty (Article 83(5). b), inviting the Company to identify, in relation to future similar cases, measures appropriate measures to guarantee the effective exercise of the rights of the persons concerned within the terms and in the manner provided for in the aforementioned Article 12 of the Regulation; NOTING also that the complainants have brought an action before the civil courts for compensation for damages; WHEREAS, moreover, failure to comply with Articles 5 and 9 of the Regulation is sanctioned by Article 83(5)(a) of the Regulation and that, similarly, failure to comply with the provisions of of Article 52(4) and (5) of the Code and of the Rules of Ethics is sanctioned under the combined provisions of Art combined provisions of Articles 2-quater, 166(2) of the Code and 83(5) of the Rules; CONSIDERED, therefore, that it is necessary to adopt an injunction order, pursuant to Articles 166, paragraph 7, of the Code and 18 of law no. 689/1981, for the application to Il Sole 24 Ore S.p.a. of the administrative fine provided for in the combined provisions of Articles 2-quater, 166, paragraph 2, of the Code, and 83, paragraphs 3 and 5, of the Regulation; HAVING REGARD TO Article 83, paragraph 3, of the Regulation, pursuant to which if, in relation to the same processing operation or related processing operations, a controller or processor intentionally or negligently infringes various provisions of the Regulation, the amount of the fine shall not exceed the amount applicable for the most serious breach; NOTING that in determining the amount of the fine, account should be taken of account must be taken of the factors referred to in Article 83(2) of the Regulation and that in the present case it is necessary to be taken into account as aggravating circumstances: (a) the seriousness of the infringement (Article 83(2)(a) of the Regulation), having regard to the particular nature of the data processed capable of revealing the identity of a minor and his or her status as an adopted child - information protected as such by the law (Law of 4 May 1983, no. 184 of 4 May 1983)- as well as the sexual orientation of the parents; this in relation to a particularly sensitive issue that has not yet been fully regulated in Italy Italy; b) again with reference to the seriousness of the breach, the fact that the dissemination of this data was disseminated, without the knowledge of the persons concerned, for journalistic purposes and, in particular, of information on a profile/case study of law (the recognition of a foreign judgment of adoption by same-sex adoptive parents) that totally disregarded the identity of the persons concerned; (c) again, in terms of seriousness, the level of harm suffered by the persons concerned, in view of the impact of such publication in the social context of reference of the 'constituent family unit in the Italian legal system, in view of the above-mentioned lack of legislative recognition of legislative recognition of adoption by parents of the same sex; (d) the negligent nature of the infringement (Article 83(2)(b) of the Regulation), given account of the fact stated by the holder himself that he had implemented a proven system for the procurement of judgments and court orders - whose commentary on which represents, in significant part, the purpose of the review - and that, also in view of of the Company's economic and organisational conditions in the publishing field, should have should have ensured a careful verification of the material being published, especially where - as in the present case, also by express admission of the Company - the legal measure had been formally annotated pursuant to Art. 52(2) of the Code; e) the relevant organisational, economic and professional conditions of the offender (Art. 83(2)(k) of the Regulation) taking into account the financial statements for the year 2020; and, as mitigating factors: (f) the purposes pursued by the holder, attributable - in general terms - to the freedom of information (Art. 85) and by the Code (Art. 136 et seq.); g) the adoption of appropriate measures to eliminate the consequences of the breach (Art. 83, par. 2, c) of the Regulation), the holder having promptly removed the measure; (h) the cooperation shown in the course of the proceedings (Art. 83(2)(f) of the (Art. 83(2)(f) of the Regulation) and the absence of previous objections by the Authority in the context of the proceedings journalism (Art. 83(2)(e) of the Regulation); CONSIDERING the above parameters and the principles of effectiveness, proportionality and dissuasiveness set out in Article 83(1) of the Regulation; CONSIDERING that, on the basis of all the above elements, the following penalty should be applied administrative pecuniary sanction of EUR 40 000,00 (forty thousand) must be applied fundamental rights of the data subjects, the type of data processed and the sector of activity of the data controller that, pursuant to Articles 166(7) of the Code and 16(1) of the Regulation of the Garante no. 1/2019, this measure should be published on the website of the Garante's website, as an ancillary sanction; CONSIDERED that the conditions are met for proceeding with the annotation in the internal register of the Authority pursuant to Article 57(1)(u) of the Regulation, in relation to the measures adopted in this case in accordance with Article 58(2) of the Regulation; HAVING REGARD TO the documents in the file; HAVING CONSIDERED the observations made by the Secretary-General pursuant to Rule 15 of the Regulation of the Supervisor's Regulation No. 1/2000; REFERRED to Mr Guido Scorza, lawyer; ALL THE FOREGOING THE GUARANTOR pursuant to Article 57(1)(f) of the Regulation. declares the unlawfulness of the processing in the terms terms set out in the preamble and to that effect: (a) pursuant to Article 58(2)(f) of the Regulation, orders the prohibition of further processing of the complainants' personal data, with the exception of their storage, even for the purposes of possible use in legal proceedings; b) pursuant to Article 58(2)(a) of the Regulation, orders the measure of a warning against Il Sole 24 Ore S.p.a. in relation to the circumstance that the incomplete and and late response to a request attributable to the exercise of one of the rights provided for in Articles 15 to 21 of the Regulation constitutes conduct contrary to law, which is also liable to a penalty (Art. 83(5)(b)), inviting the Company to identify, in relation to similar cases in the future, appropriate measures to guarantee the effective exercise of the rights of the interested parties within the terms and in the manner provided for by the aforementioned Article 12 of the Regulation. ORDER pursuant to Articles 58, paragraph 2 letter i) and 83 of the Regulation to Il Sole 24 Ore S.p.a., with headquartered in Milan, viale Sarca 223, C.F. n. 00777910159, in the person of its legal representative pro tempore, to pay the sum of euro 40,000.00 (forty thousand) by way of a fine administrative fine for the violations indicated in the grounds, representing that the violator, pursuant to Article 166, paragraph 8, of the Code has the right to settle the dispute, by payment, within the term of thirty days, of an amount equal to half of the penalty imposed; INJUDGES to Il Sole 24 Ore S.p.a., in the event of failure to settle the dispute pursuant to the aforementioned article 166, paragraph 8, of the Code, to pay the sum of euro 40,000.00 (forty thousand) according to the modalities indicated in the annex, within 30 days from the notification of this provision measure, under penalty of the adoption of the consequent executive acts pursuant to Article 27 of the law no. 689/1981. ORDER pursuant to Article 166, paragraph 7, of the Code, the publication in full of this provision on the website of the Guarantor and the entry in the internal register of the Authority referred to in pursuant to Article 57(1)(u) of the Regulation, of the measures taken against Il Sole 24 Ore S.p.a. in accordance with Article 58(2) of the Regulation. Pursuant to art. 78 of the Regulation, as well as articles 152 of the Code and 10 of Leg september 2011, no. 150, opposition to this measure may be lodged to the ordinary judicial authority, by means of an appeal filed, alternatively, with the court of the place where the data controller resides or has its head office or at the court of the place of place of residence of the data subject within a period of 30 days from the date of communication of the decision or 60 days from the date of the decision the measure itself, or within 60 days if the appellant resides abroad. Rome, 28 April 2022 THE VICE-PRESIDENT Cerrina Feroni THE SPEAKER Scorza THE SECRETARY GENERAL Mattei