Garante per la protezione dei dati personali (Italy) - 9779098
| Garante per la protezione dei dati personali - 9779098 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 9(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 26.03.2020 |
| Decided: | 28.04.2022 |
| Published: | |
| Fine: | 40,000 EUR |
| Parties: | Il Sole 24 Ore S.p.a. |
| National Case Number/Name: | 9779098 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante Per La Protezione Dei Dati Personali (in IT) |
| Initial Contributor: | Matty Weinberg |
The Italian DPA fined a daily newspaper €40,000 for negligently publishing the personal details of a homosexual couple and their adopted child.
English Summary
Facts
The controller was a daily newspaper. The data subjects were a homosexual couple and their adopted child. The controller accidentally published personal details of the data subjects in an article on its website that covered a court case related to their adoption process. The data subjects requested the article be taken down and requested the identities of the parties to whom the article had been distributed. A day later, the controller removed the article from its website, but it did not respond to the access request. Before the article was removed from the controller's website, it received nineteen unique visitors.
Holding
The Italian DPA (Garante per la protezione dei dati personali - GDPD) found that the controller had violated Article 5 and Article 9 GDPR; it fined the controller €40,000, balancing, among other things, the sensitive nature disclosed (sexual orientation, data relating to the adoption of a minor) and the negligent nature of the infringement against the journalistic purpose and the controller's prompt measures to eliminate the consequences of the breach. The GDPD also issued a warning for failure to respond to the data subjects' requests for access and invited the controller to implement measures to guarantee the effective exercise of data subjects' rights under Article 12 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
