Garante per la protezione dei dati personali (Italy) - 9866622

Garante per la protezione dei dati personali - 9866622

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 15 GDPR Article 17 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	05.05.2021
Decided:	11.01.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	9866622
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (Italy) (in IT)
Initial Contributor:	mg

The Italian DPA issued a reprimand against a controller which did not reply to a data subject´s access and erasure requests in written form.

English Summary

Facts

A security officer was tried and convicted of aggression thanks to some images captured by cameras installed by their employer in the workplace. During the criminal proceeding, the data subject requested access and erasure of their personal data to the controller pursuant to Articles 15 and 17 GDPR. The controller orally replied that access and erasure were not possible, as there were no personal data involved in the processing. The Italian DPA opened an investigation on the basis of the data subject´s complaint. The controller claimed that the signs were properly displayed. In addition, cameras did not point at the place where the data subject worked and did not record videos. The only images recorded (and used in the criminal proceeding) were pictures taken live from the monitoring screens with a smartphone.

Holding

According to the Italian DPA, the controller violated Articles 12(1) and 15(3) GDPR, as it did not provide the data subject with a written reply to his access request. The same conclusions were drawn with regard to Article 17 GDPR: the controller should have replied in written form, even if it thought the conditions for erasure were not met. The fact that the controller displayed the signs and complied with Article 13 did not exclude the violation. This provision pursues purposes which do not completely overlap with access and erasure requests. The fact that the camera did not point at the data subject´s seat and the lack of recording were not relevant either. However, the Italian DPA considered these “minor” violations and issued only a reprimand pursuant to Article 58(2)(b) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web no. 9866622]

Provision of 11 January 2023

Register of measures
no. 11 of 11 January 2023

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei, general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

HAVING REGARD TO the Code regarding the protection of personal data, containing provisions for the adaptation of the national legal system to Regulation (EU) 2016/679 (legislative decree 30 June 2003, n. 196, as amended by legislative decree 10 August 2018, n. 101, hereinafter "Code");

GIVEN the complaint presented to the Guarantor, pursuant to art. 77 of the Regulation, dated 5 May 2021 with which XX asked to order Google LLC to remove some URLs available in association with his name connected to articles in which information relating to an event connected with the political commitment carried out is reported from the same to the time of the facts and with respect to which a period of time has now elapsed such as to determine the loss of the public interest in the relative knowledgeability;

CONSIDERING that the interested party has complained about the damage suffered to his personal and professional reputation deriving from the online availability of such contents dating back over time and with respect to which there has been no judicial follow-up against him, also noting that his political career is it ended five years ago;

HAVING REGARD to the note of 4 June 2021 with which the Authority asked the data controller to provide his observations regarding what was represented in the introductory act of the procedure and to communicate his intention, if any, to comply with the requests of the complainant;

HAVING REGARD to the note dated June 24, 2021 with which Google LLC disclosed:

with reference to the URL http://..., that he has not identified the name of the interested party on the relevant page and has therefore adopted manual measures aimed at preventing his positioning among the results associated with the aforementioned name;

not to be able to comply with the request of the interested party with regard to the additional URLs since these are contents connected to the political role played by the same at the time of publication and relating to a video made by him in the exercise of his political functions aimed at convincing voters to vote for the party to which he belonged;

that therefore this video, having been made during the course of the electoral campaign, "was deliberately published by the claimant for the purpose of public sharing", however, arousing a stir in consideration of the fact that it was deemed to convey XX;

these circumstances determine the existence of a public interest in having knowledge of such information also taking into account the fact that, although the complainant does not currently hold political offices, he still plays a public role in his capacity as an entrepreneur;

the journalistic nature of a large part of the disputed content published by newspapers of national importance;

CONSIDERING that, unless the fact constitutes a more serious offence, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor";

NOTING that Google, with reference to the URL http://..., declared that it had not identified the name of the interested party on the relevant page and that it had therefore adopted manual measures aimed at preventing its positioning among the results associated with the aforementioned name and therefore considered that the conditions for the adoption of provisions in this regard by the Authority do not exist;

CONSIDERED, with regard to the request for removal of the additional URLs indicated in the introductory deed brought against Google LLC, which, for the purpose of assessing the existence of the conditions for the recognition of the right to be forgotten pursuant to articles 17, par. 1, lit. c), and 21, par. 1 of the Regulation, it is necessary to take into account, in addition to the element constituted by the passage of time, also the additional criteria expressly identified by the WP Art. 29 - Article 29 Group on the protection of personal data through the specific "Guidelines" adopted on 26 November 2014 following the aforementioned judgment of the Court of Justice of the European Union, as well as the most recent "Guidelines" no. 5/2019 adopted by the European Data Protection Board (EDPB) on 7 July 2020, containing the criteria for the application of the right to be forgotten by search engines in the light of the Regulation;

NOTING that:

the contents available through the aforementioned URLs concern utterances made by the interested party on the occasion of the conduct of political elections held in the twentieth with respect to which almost ten years have now elapsed;

the complainant, according to what was stated in the course of the proceedings, has not held political office for the past five years;

on the basis of these circumstances, no specific information needs related to the disputed content are identified;

CONSIDERING, therefore, that the complaint must be considered founded in relation to the request for removal of the aforementioned URL and that, as a result, it must order Google LLC, pursuant to art. 58, par. 2, lit. c) and g), of the Regulation, to order its removal as a search result available in association with the name of the interested party within twenty days of receipt of this provision;

CONSIDERING, pursuant to art. 17 of the Guarantor's regulation n. 1/2019, that the conditions are met for proceeding with the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, in relation to the measures adopted in the specific case against Google LLC in accordance with art. 58, par. 2, of the same Regulation;

NOTING, however, that the measure adopted in the case in question against the aforesaid company derives from an assessment carried out by the Authority on the basis of the specifics of the individual case and that, therefore, its entry in the aforementioned internal register cannot be held, in any future proceedings against the same data controller, as a relevant precedent for the purposes set out in art. 83, par. 2) lit. c), of the Regulation;

NOTING that, in the event of non-compliance with the provisions of the Guarantor, the administrative sanction pursuant to art. 83, par. 5, letter. e), of the Regulation;

HAVING REGARD to the documentation in the deeds;

HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER Prof. Pasquale Stanzione;

ALL THIS CONSIDERING THE GUARANTOR

pursuant to art. 57, par. 1 lit. f), of the Regulation;

a) takes note of what has been declared by Google regarding the fact that it has not identified the name of the interested party on the page available via the URL http://... and has therefore adopted manual measures aimed at preventing the positioning among the results associated with the aforementioned name and therefore believes that the conditions for the adoption of provisions in this regard by the Authority do not exist;

b) declares the complaint founded with regard to the request for removal of the additional URL indicated in the complaint and, as a result, pursuant to art. 58, par. 2, lit. c) and g), of the Regulation, enjoins Google LLC to order its removal as a search result available in association with the name of the interested party within twenty days of receiving this provision;

c) pursuant to art. 17 of the Guarantor's regulation n. 1/2019, provides for the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, of the measures taken against Google LLC in accordance with art. 58, par. 2 of the Regulation itself, without however attributing to this annotation - for the reasons mentioned in the introduction - the value of precedent in any future proceedings against the same data controller, for the purposes set out in art. 83, par. 2), lit. c), of the Regulation.

Pursuant to art. 157 of the Code, Google LLC is invited to communicate, within thirty days from the date of receipt of this provision, what initiatives have been undertaken in order to implement the provisions therein. Please note that failure to respond to the above request is punished with the administrative sanction pursuant to art. 166 of the Code.

Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lg. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the interested party within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.

Rome, 11 January 2023

PRESIDENT
Station

THE SPEAKER
Station

THE SECRETARY GENERAL
Matthew