Garante per la protezione dei dati personali (Italy) - 9779098
From GDPRhub
| Garante per la protezione dei dati personali - 9779098 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 9(1) GDPR Article 5 GDPR Article 12 GDPR Codice in materia di protezione dei dati personali |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 26.03.2020 |
| Decided: | 28.04.2022 |
| Published: | |
| Fine: | 40,000 EUR |
| Parties: | Il Sole 24 Ore S.p.a. |
| National Case Number/Name: | 9779098 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Italian |
| Original Source: | Garante Per La Protezione Dei Dati Personali (in IT) |
| Initial Contributor: | Matty Weinberg |
The Italian DPA fined a daily newspaper €40,000 for negligently publishing the personal details of a homosexual couple and their adopted child in an online article covering related judicial proceedings.
English Summary
Facts
The controller was a daily newspaper. The data subjects were a homosexual couple and their adopted child.
The controller published an article covering a court case relating to the data subjects, mistakenly attaching documents that contained the data subjects' personal data.
The data subjects requested that the data be deleted, and the controller complied a day later. Before the article was removed from the controller's website, it received nineteen unique visitors.
The controller did not respond to further data access requests regarding the identities of the recipients of the personal data, arguing that its prompt removal of the article made any further response unnecessary.
Holding
The Italian DPA (Garante per la protezione dei dati personali - GDPD) found that the controller had violated Article 5 and Article 9 GDPR; it fined the controller €40,000, balancing, among other things, the sensitive nature of the data disclosed (sexual orientation, data relating to the adoption of a minor) and the negligent nature of the infringement against the controller's journalistic purpose and prompt measures to eliminate the consequences of the breach.
The GDPD also issued a warning for failure to respond to the data subjects' requests for access, inviting the controller to implement additional measures to guarantee the effective exercise of future data subjects' rights under Article 12 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Injunction order against Il Sole 24 Ore S.p.a. -
28 April 2022 [9779098]
[web doc. no. 9779098]
Injunction order against Il Sole 24 Ore S.p.a. - 28 April 2022
Register of Measures
no. 157 of 22 April 2022
THE PERSONAL DATA PROTECTION GUARANTOR
At today's meeting, which was attended by Prof. Ginevra Cerrina Feroni
vice-president, Dr Agostino Ghiglia and Mr Guido Scorza, members, and Cons. Fabio Mattei,
secretary general;
HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
(hereinafter, the "Regulation");
HAVING REGARD to the Personal Data Protection Code, containing provisions for the adaptation
national legislation to Regulation (EU) 2016/679 (Legislative Decree No. 196 of 30 June 2003, as
amended by Legislative Decree No 101 of 10 August 2018, hereinafter referred to as the "Code");
HAVING REGARD to the note dated 26 March 2020 in which Mr Schuster, on behalf of XX, XX and the minor
XX, complained of a violation of Article 52 of the Code, as well as of the provisions protecting the
information relating to the status of an adopted child (Article 73, Law No. 183/1984) in relation to the
full publication by Il Sole 24 Ore S.p.a. ("Quotidiano Enti locali&Pa" in
the article entitled 'XX'), of the Order of the Court of Cassation No. XX
concerning the recognition in Italy of the order of a US judge concerning
the adoption of a child by a homosexual couple; this, despite the fact that there was
the order had the annotation referred to in Article 52 of the Code, ordered ex officio, aimed at requiring
the omission of the personal details of the persons concerned in the event of disclosure or reproduction of the document;
WHEREAS the applicants, in the same note of 26 March, also lodged
complaint pursuant to Article 77 of the Regulation, complaining of non-compliance with the request for access to the data made to Il Sole
access to the data formulated to Il Sole 24 Ore S.p.a., pursuant to Articles 15 to 22 of the Regulation,
having received a reply only in relation to the removal of the aforementioned order but not to the other requests formulated
requests made;
HAVING REGARD TO the request for information sent by the Office on 19 February 2021 (prot.
10392/21) and the reply note of the following 9 March in which Il Sole 24 Ore S.p.a
represented that:
- the contents object of the grievance were not posted on the main website of the newspaper
but in the magazine 'Quotidiano Enti locali&Pa', an editorial product distributed exclusively in
digital format and whose contents are reserved for subscribers; - the publication of the order was the result of a mere inadvertent error on the part of the
production graphic assistants in charge of attaching documents pertaining to the
articles commenting on legal issues of interest, specifying that the article of
commentary on the jurisdictional decision under complaint was in any case devoid of the
personal data concerning the parties;
- the Company removed the order on 14 December 2019, the day after
of receipt of the warning, at the same time also communicating the removal of the copy in
pdf format from its system, so that it could not be found via search engines;
by doing so, it considered that it had complied with the complainant's request made
with two separate e-mails of 13 December;
- in light of the above, it considered it unnecessary to reply to the further letter of 17 January
2020, as it was clear that "no further data remained in its possession, which
no further processing could have been carried out and that the only one carried out had the
obvious, inferable from the article, to which the measure had been posted';
- on 20 April 2020, after the complaint had been lodged with the Garante, he received a further
missive from the applicants' lawyer, with the subject matter of "Reminder of compensation for
violation of rights in relation to the processing of personal data' to which - although
considered superfluous in view of what had already been done, it replied on
the following 9 May, thus deeming that it had exhausted the requests of the interested parties in terms of exercising their rights
profile of the exercise of the rights under Articles 15 to 22 of the Regulation and instead remaining
awaiting the counterparty's announced actions with regard to claims for damages;
HAVING REGARD TO the note dated 25 March 2021 in which the complainants' lawyer replied, pointing out that
- contrary to the Publisher's assertion, the article in question was freely
accessible by any visitor to the website, since there was a caption that
the article in question was freely accessible to any visitor to the website, as it was marked in such a way as to allow non-subscribers to read it free of charge, thus
of the news;
- the proprietor, acknowledging the erroneous publication of the data, also admitted the violation
of Article 52 of the Code, for which an administrative sanction is provided for (Article 166, para
2 of the Code and Article 83(3) of the Regulation); this profile was the subject of a report
to the Garante together with the complaint for violation of the provisions on the exercise of rights
rights;
- it is confirmed from the statements of il Sole 24 Ore S.p.a. that the latter did not
provided a complete response to the request for access to the data formulated on several occasions by the
complainants in that 'it has never communicated the names of the persons to whom it has transmitted
the order in question, as the practice of sending legal information also by means of
by means of newsletters or passing it on to other publishers or press agencies' and, having objected
that there were only 30 accesses to the document in question, it did not however
communicated its identity;
HAVING REGARD TO the note of 19 April 2021 in which Sole 24 Ore S.p.a., in acknowledging that there has been an
error and that it resulted in the disclosure of personal data even of a minor:
- contested the assumption that, since it was a freely consultable pdf, it would be
wide dissemination of the news because 'if it is true that the pdf was in consultation
free of charge until 13 December 2019, therefore for 30 days, it is equally true that, in this
period, it had only 30 views, from a total of 19 unique browsers';
- dismissed the objections regarding the failure to respond to the request for access given the peculiarity of the journalistic and legal information sector which makes the purpose of the
processing (excluding possible alternatives once the data had been deleted, as happened in the
case at hand);
- argued that it had not withheld information as to to whom the data would be
communicated, for example by sending newsletters to subscribers, given the
circumstance that the latter did not in any event allow direct access to the order
de qua;
HAVING REGARD TO the Office's note of 7 October 2021 (prot. no. 50221/21) whereby, pursuant to Section 166,
paragraph 5, of the Code, Il Sole 24 Ore S.p.a. was notified of the commencement of the procedure for
the possible adoption of measures pursuant to Article 58, paragraph 2, of the Regulation and notified the
possible violations of the law in relation to the following provisions:
- the general principles of the processing referred to in Article 5(1) of the Regulation and, in particular, the
principle of "lawfulness and fairness" (sub. a);
- art. 50 of the Code concerning the prohibition of publication of information likely to enable
the identification of a minor in legal proceedings;
- article 52(5) of the Code governing the limits on the dissemination of identification data in
judicial measures in proceedings concerning family relations and the status of the
persons;
- article 9 of the Regulation concerning the limits to the processing of particular data, including those
relating to a person's sex life or sexual orientation;
- article 85 of the Regulation and Articles 136 et seq. of the Code governing the processing of
data for journalistic purposes and other expressions of thought, with particular reference to
article 137(3) of the Code;
- the Deontological Rules in Annex A1 of the Code and in particular Art. 7 (Protection of the
minor) and the Treviso Charter;
- art. 2 - quater of the Code which states that compliance with the Rules of Ethics
constitutes 'an essential condition for the lawfulness and fairness of the processing';
- article 12(3) and (4) of the Regulation with reference to the exercise of the rights under the
articles 15 - 22 of the Regulation itself;
HAVING REGARD TO the note dated 8 November 2021 in which Il Sole 24 Ore S.p.a., in recalling its previous
defence, wished to specify that:
- this is an isolated case due to an unintentional error in the face of a very
significant number of court orders that have been ritually anonymised;
- the Company has implemented a process for the procurement of judgments and
of the Supreme Court to ensure full compliance with data protection provisions
data protection provisions and has also dedicated particular care to training journalists in
this field and with particular attention to the issue of minors;
- 'only 19 people, therefore, some more than once, have seen the measure,
by accessing the company's website, since it cannot be held liable for the further and undocumented use
the violation is of minor importance and is not malicious in nature and in any case the Company took immediate action to remove the measure; - the violation is of minor importance and is not malicious in nature and in any case the
immediately to remove the measure;
- "the delayed and partial response to the request for access to the data, formulated by the interested parties is
largely due to the superfluousness of the information requested, inferable from facts known to them
known to them and the company having promptly removed the
jurisdiction as requested by the data subjects by email of 13 December 2019, as well as
[due] to the protection of the confidentiality of its users, as governed by its own
Policy"; in any event, "after having received on 20 April 2020 a further missive with the subject
the subject of "Waiver of compensation for violation of rights in relation to the processing of
personal data processing', the company promptly provided a full reply to the interested parties
on 9 May 2020';
WHEREAS, unless the act constitutes a more serious offence, any person, in a
proceedings before the Garante, falsely declares or attests information or circumstances or produces false deeds or documents
or documents shall be liable pursuant to Section 168 of the Code "False statements to the Guarantor
Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor';
NOTING that it is uncontested that, in the "Quotidiano Enti locali&Pa", published by Il Sole 24 Ore
S.p.a., on 13 November 2019 there was the full publication including data
identifying data of a court decision in the field of family relations concerning
the adoption of a child by a same-sex couple and to which was affixed
the annotation referred to in Article 52(2) of the Code aimed at prescribing the omission of the
particulars of the persons concerned in the event of disclosure or reproduction of the document;
WHEREAS:
- article 50 of the Code prohibits the publication of information enabling the identification of
a minor even in judicial proceedings in matters other than criminal law;
- article 52(4) of the Code provides that "in the event of dissemination also by third parties of
judgments or other measures bearing the annotation referred to in paragraph 2, or of the relevant
legal maxims, the particulars and other identifying data of the person concerned shall be omitted" and
of the person concerned" and the following paragraph 5 states that "whoever disseminates judgments or other
measures of the judicial authority of any order and degree is obliged to
omit in any event, even in the absence of the annotation referred to in subsection 2, the personal particulars,
other identifying data or other data also relating to third parties from which the identity of minors may be inferred, even indirectly
indirectly the identity of minors, or of the parties in proceedings concerning family and personal status
family and personal status';
- article 9 of the Regulation prohibits the processing of data concerning a person's sex life or sexual orientation
sexual orientation of the person;
- article 137(3) of the Code requires that the dissemination of data for journalistic purposes
for journalistic purposes must comply with the 'essential nature of the information concerning facts of
public interest';
- the Deontological Rules set out in Appendix A1 of the Code and, in particular, Article 7
recognise the pre-eminence of the child's right to privacy over the right to report the news
and prescribe the adoption of precautions to guarantee anonymity;
- the Charter of Treviso, in the text in force at the time of publication
prescribed that "in cases of fostering or adoption and those of parents
separated or divorced parents, without prejudice to the right to report and criticise the decisions
of the judicial authority and the usefulness of articles or enquiries, it is however necessary also in these cases to protect the anonymity of the child so as not to affect the harmonious development of his or her personality,
avoiding sensationalism and any form of speculation'; similar principle of protection
anonymity of the minor is provided for in the text of the Charter revised and updated by the
Council of the Order of Journalists at its meeting of 6 July 2021 (Articles 2 and 7);
- article 2-quater of the Code states that compliance with the Rules of Ethics constitutes
"an essential condition for the lawfulness and fairness of the processing".
CONSIDERING that the processing described constitutes a violation of the aforementioned provisions and of the
general principle that personal data must be processed lawfully and fairly (Art.
5(1)(a) of the Regulation;
CONSIDERING therefore, pursuant to Article 57(1)(f) of the Regulation, that it is necessary to declare
that the processing is unlawful and, consequently, pursuant to Article 58(2)(f) of the Regulation, to
order the prohibition of further processing of the complainants' personal data, with the exception of their
conservation, also for the purpose of possible use in judicial proceedings;
NOTING that with regard to the exercise of the rights under Articles 15-21 of the Regulation, the data controller has
provided a timely response to the complainants' first request (first email of 13 December
2019), removing the measure complained of on the day following
to the request made by the complainants, failing, however, to respond to the further requests made
on the same date by the data subjects regarding the processing of their data, including, in particular, the scope of
communication of the data themselves, information which is indeed particularly relevant given the nature of the
data themselves and easily ascertainable, at least in the first instance, in the terms and with the
arguments it subsequently provided, after a further reminder (20 April 2020), to the
complainants (note of 9 May 2020) and to this Authority in the course of the investigation;
CONSIDERED that such conduct evidences elements abstractly capable of constituting
of an infringement of Article 12 of the Regulation;
CONSIDERING therefore that a warning should be addressed to Il Sole 24 Ore S.p.a., pursuant to Art.
58(2)(a) of the Regulation, in relation to the circumstance that the incomplete and
late response to a request attributable to the exercise of one of the rights provided for in Articles 15-21 of the
Regulation constitutes conduct contrary to the law, which is also liable to a penalty (Article 83(5).
b), inviting the Company to identify, in relation to future similar cases, measures
appropriate measures to guarantee the effective exercise of the rights of the persons concerned within the terms and in the manner
provided for in the aforementioned Article 12 of the Regulation;
NOTING also that the complainants have brought an action before the civil courts for
compensation for damages;
WHEREAS, moreover, failure to comply with Articles 5 and 9 of the Regulation is sanctioned
by Article 83(5)(a) of the Regulation and that, similarly, failure to comply with the provisions of
of Article 52(4) and (5) of the Code and of the Rules of Ethics is sanctioned under the combined provisions of Art
combined provisions of Articles 2-quater, 166(2) of the Code and 83(5) of the
Rules;
CONSIDERED, therefore, that it is necessary to adopt an injunction order, pursuant to Articles 166, paragraph
7, of the Code and 18 of law no. 689/1981, for the application to Il Sole 24 Ore S.p.a.
of the administrative fine provided for in the combined provisions of Articles 2-quater,
166, paragraph 2, of the Code, and 83, paragraphs 3 and 5, of the Regulation;
HAVING REGARD TO Article 83, paragraph 3, of the Regulation, pursuant to which if, in relation to the same processing operation
or related processing operations, a controller or processor intentionally or negligently infringes various
provisions of the Regulation, the amount of the fine shall not exceed the amount applicable for the most serious breach;
NOTING that in determining the amount of the fine, account should be taken of
account must be taken of the factors referred to in Article 83(2) of the Regulation and that in the present case it is necessary to
be taken into account as aggravating circumstances:
(a) the seriousness of the infringement (Article 83(2)(a) of the Regulation), having regard to the
particular nature of the data processed capable of revealing the identity of a minor and his or her status as an
adopted child - information protected as such by the law (Law of 4 May 1983,
no. 184 of 4 May 1983)- as well as the sexual orientation of the parents; this in relation to a particularly
sensitive issue that has not yet been fully regulated in Italy
Italy;
b) again with reference to the seriousness of the breach, the fact that the dissemination of
this data was disseminated, without the knowledge of the persons concerned, for journalistic purposes and, in
particular, of information on a profile/case study of law (the recognition of a
foreign judgment of adoption by same-sex adoptive parents) that
totally disregarded the identity of the persons concerned;
(c) again, in terms of seriousness, the level of harm suffered by the persons concerned, in view of
the impact of such publication in the social context of reference of the 'constituent
family unit in the Italian legal system, in view of the above-mentioned lack of legislative recognition of
legislative recognition of adoption by parents of the same sex;
(d) the negligent nature of the infringement (Article 83(2)(b) of the Regulation), given
account of the fact stated by the holder himself that he had implemented a proven
system for the procurement of judgments and court orders - whose
commentary on which represents, in significant part, the purpose of the review - and that, also in view of
of the Company's economic and organisational conditions in the publishing field, should have
should have ensured a careful verification of the material being published, especially
where - as in the present case, also by express admission of the Company - the
legal measure had been formally annotated pursuant to Art.
52(2) of the Code;
e) the relevant organisational, economic and professional conditions of the
offender (Art. 83(2)(k) of the Regulation) taking into account the
financial statements for the year 2020;
and, as mitigating factors:
(f) the purposes pursued by the holder, attributable - in general terms - to the freedom of
information (Art. 85) and by the Code (Art. 136 et seq.);
g) the adoption of appropriate measures to eliminate the consequences of the breach (Art. 83, par. 2,
c) of the Regulation), the holder having promptly removed the measure;
(h) the cooperation shown in the course of the proceedings (Art. 83(2)(f) of the
(Art. 83(2)(f) of the Regulation) and the absence of previous objections by the Authority in the context of the proceedings
journalism (Art. 83(2)(e) of the Regulation);
CONSIDERING the above parameters and the principles of effectiveness, proportionality and dissuasiveness
set out in Article 83(1) of the Regulation;
CONSIDERING that, on the basis of all the above elements, the following penalty should be applied
administrative pecuniary sanction of EUR 40 000,00 (forty thousand) must be applied
fundamental rights of the data subjects, the type of data processed and the sector of activity of the data controller
that, pursuant to Articles 166(7) of the Code and 16(1) of the Regulation of the Garante
no. 1/2019, this measure should be published on the website of the
Garante's website, as an ancillary sanction;
CONSIDERED that the conditions are met for proceeding with the annotation in the internal register
of the Authority pursuant to Article 57(1)(u) of the Regulation, in relation to the measures adopted
in this case in accordance with Article 58(2) of the Regulation;
HAVING REGARD TO the documents in the file;
HAVING CONSIDERED the observations made by the Secretary-General pursuant to Rule 15 of the Regulation of the
Supervisor's Regulation No. 1/2000;
REFERRED to Mr Guido Scorza, lawyer;
ALL THE FOREGOING THE GUARANTOR
pursuant to Article 57(1)(f) of the Regulation. declares the unlawfulness of the processing in the terms
terms set out in the preamble and to that effect:
(a) pursuant to Article 58(2)(f) of the Regulation, orders the prohibition of further
processing of the complainants' personal data, with the exception of their storage, even
for the purposes of possible use in legal proceedings;
b) pursuant to Article 58(2)(a) of the Regulation, orders the measure of a warning
against Il Sole 24 Ore S.p.a. in relation to the circumstance that the incomplete and
and late response to a request attributable to the exercise of one of the rights provided for in Articles 15 to
21 of the Regulation constitutes conduct contrary to law, which is also liable to a penalty
(Art. 83(5)(b)), inviting the Company to identify, in relation to
similar cases in the future, appropriate measures to guarantee the effective exercise of the rights of the
interested parties within the terms and in the manner provided for by the aforementioned Article 12 of the Regulation.
ORDER
pursuant to Articles 58, paragraph 2 letter i) and 83 of the Regulation to Il Sole 24 Ore S.p.a., with
headquartered in Milan, viale Sarca 223, C.F. n. 00777910159, in the person of its legal representative
pro tempore, to pay the sum of euro 40,000.00 (forty thousand) by way of a fine
administrative fine for the violations indicated in the grounds, representing that the
violator, pursuant to Article 166, paragraph 8, of the Code has the right to settle the
dispute, by payment, within the term of thirty days, of an amount equal to
half of the penalty imposed;
INJUDGES
to Il Sole 24 Ore S.p.a., in the event of failure to settle the dispute pursuant to the aforementioned
article 166, paragraph 8, of the Code, to pay the sum of euro 40,000.00 (forty thousand)
according to the modalities indicated in the annex, within 30 days from the notification of this provision
measure, under penalty of the adoption of the consequent executive acts pursuant to Article 27 of the
law no. 689/1981.
ORDER
pursuant to Article 166, paragraph 7, of the Code, the publication in full of this provision on the website of the Guarantor and the entry in the internal register of the Authority referred to in
pursuant to Article 57(1)(u) of the Regulation, of the measures taken against Il Sole
24 Ore S.p.a. in accordance with Article 58(2) of the Regulation.
Pursuant to art. 78 of the Regulation, as well as articles 152 of the Code and 10 of Leg
september 2011, no. 150, opposition to this measure may be lodged
to the ordinary judicial authority, by means of an appeal filed, alternatively, with the court
of the place where the data controller resides or has its head office or at the court of the place of
place of residence of the data subject within a period of 30 days from the date of communication of the decision or 60 days from the date of the decision
the measure itself, or within 60 days if the appellant resides abroad.
Rome, 28 April 2022
THE VICE-PRESIDENT
Cerrina Feroni
THE SPEAKER
Scorza
THE SECRETARY GENERAL
Mattei
