Garante per la protezione dei dati personali (Italy) - 9897055

Garante per la protezione dei dati personali - 9897055
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5 GDPR Article 139 Civil Code
Type:	Investigation
Outcome:	Violation Found
Started:	18.01.2023
Decided:	13.04.2023
Published:	13.04.2023
Fine:	15,000.00 EUR
Parties:	Citynews S.p.A.
National Case Number/Name:	9897055
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	melogranojuice

The Italian DPA fined an online newspaper €15,000 for publishing detailed medical information of a mafia boss. According to the DPA, the paper went beyond what was necessary and violated human dignity.

English Summary

Facts

“Palermo Today”, an online newspaper, published an article about the arrest of the data subject, a well-known mafia boss who had been a fugitive for 30 years. Among the circumstances of the arrest, the article also revealed information about the state of health of the data subject and included a complete copy of his laboratory records.

On 18 January 2023, the DPA adopted a temporary measure against the controller, Citynews S.p.A. (the owner of the newspaper), limiting the further dissemination of the data subject’s health data.

The controller complied with the above measures, modifying the article, deleting the data subject’s health records and requesting Google to deindex the information. It pointed out that the journalistic content had no intention of harming the dignity of the data subject and claimed that the information had been expressly deemed unpublishable, but the Director responsible, in an autonomous decision, considered it was of public interest and decided to publish it.

Holding

The DPA considered both Article 137 of the Italian Data Protection Code and Article 9 GDPR and recalled that sensitive data can be processed even without the consent of the data subject, provided that the processing complies with the principle of essentiality of information and the facts are of public interest.

Similarly, Article 10 of the Code of Journalistic Ethics prescribes that the publication is permitted in the context of pursuing the essentiality of information, provided that journalists respect human dignity and privacy, especially in cases of serious or terminal illness. For this reason, journalists should refrain from publishing analytical data of strictly clinical interest.

The DPA also considered Article 5 GDPR, in particular, the principles of lawfulness and data minimization.

Based on the above, the DPA concluded that the processing violated Article 5(1)(a) and (c) as well as Article 9 GDPR, prohibiting the controller to further process the data indicated and issuing a fine of €15,000.00.

Comment

In January 2023, the DPA had issued an order prohibiting the processing of the data subject's data to 4 different newspapers. The decision is also found on GDPRHub.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and dr. Fabio Mattei, general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the "Regulation");

HAVING REGARD TO the Personal Data Protection Code (Legislative Decree No. 196 of 30 June 2003);

HAVING REGARD to the Deontological Rules relating to the processing of personal data in the exercise of journalistic activity" (Official Gazette of 4 January 2019, n. 3), hereinafter "Deontological Rules";

DETECTED that the online newspaper "PalermoToday" published an article entitled: "XX" available at the link https://... in which detailed news was given of the pathology from which XX is affected (also indicated by the well-known alias XX used by him) and distributed, in support of the same, a complete copy of the report of an extremely detailed laboratory test;

HAVING REGARD TO the provision dated 18 January 2023 with which the Authority adopted against the data controller Citynews S.p.A. the extent of the temporary limitation of the treatment, pursuant to art. 58, par. 2, lit. f), referring to any further dissemination of the health data indicated in the article in question, including those contained in the aforementioned laboratory report, as well as any other similar information reported in any other articles published on the same site;

CONSIDERING that the aforesaid provision was adopted taking into account that:

- the art. 137 of the Code provides in paragraph 1, that the data referred to in art. 9 of the Regulation ("particular categories of personal data" which include "data relating to health") can be processed even without the consent of the interested party provided that in compliance with the ethical rules referred to in art. 139 of the Code, as well as, in paragraph 3, that in the event of dissemination of data for journalistic purposes, the limit of the "essential nature of the information regarding facts of public interest" remains unchanged;

- the art. 10 of the aforementioned Deontological Rules prescribes that:

“1. The journalist, in referring to the state of health of a specific person, identified or identifiable, respects his dignity, the right to privacy and personal decorum, especially in cases of serious or terminal illness, and refrains from publishing analytical data of strictly clinical interest.

2. Publication is permitted in the context of pursuing the essentiality of information and always with respect for the dignity of the person if this holds a position of particular social or public importance";

- the health data disseminated, already at a first analysis, appeared to be in contrast, as well as with confidentiality, with the dignity of the interested party, despite being the news of significant public interest;

HAVING REGARD to the note dated 18 January 2023 with which the aforementioned provision for the provisional limitation of processing was sent to the data controller and requested to communicate, within 3 days following the notification, the initiatives undertaken in order to implement as prescribed by the Authority;

GIVEN the note dated 19 January 2023 with which Citynews S.p.A. provided the requested reply, pointing out that the "journalistic content was meant exclusively to disseminate news information without any intention of harming the dignity of the person, indicating the details of a pathology, unfortunately very widespread" and communicated the initiatives immediately undertaken with the assistance of its own DPO in order to implement the provisions of the aforementioned provision;

GIVEN the note of 8 February 2023 with which the Authority, on the basis of the evidence that emerged, communicated to Citynews S.p.A. the initiation of the procedure pursuant to art. 166, paragraph 5, of the Code for the eventual adoption of the provisions pursuant to art. 58, par. 2, of the Regulation, notifying the alleged violations of the law identified, in this case, in the violation of articles 5, par. 1 lit. a) and c), e, 9 of the Regulation and of the articles 137, paragraphs 1 and 3 and 2 quater, paragraph 4, of the Code, as well as articles 5, paragraph 1, 6, paragraph 1, and 10, of the Deontological Rules;

HAVING REGARD to the note of 7 March 2023 with which Citynews S.p.A., in response to the disputed by the Authority, represented that:

- Citynews is an editorial group "which boasts hundreds of journalists, divided into 54 newsrooms active throughout Italy, operating for several years, both nationally and locally";

- given the freedom of the journalists of the editorial group to deal with the issues closest to their local area, the Company is "extremely vigilant that they comply with the principles established both by the legislation on the processing of personal data and by the Code of Conduct for journalists" ;

- Citynews "not only trains its staff (employee or collaborator) but verifies that what is published complies with the law, making the appropriate changes adopted - if necessary";

- PalermoToday specializes in the news of the Palermo neighborhood;

- the detailed information on the data subject's state of health had been expressly deemed unpublishable;

- their publication was the result of an independent choice by the Responsible Director, who made an evident error of assessment, "consequence of the frenzy of those working hours" in which he acknowledged the news and the exceptional public interest of the story;

- the article concerned the circumstances of the arrest of the last major mafia boss, a fugitive for 30 years and who lived in Sicily, "in close contact with the Palermitans, sharing the path of treatment with ordinary people, equally affected by similar ills ”;

- this assessment led to the conclusion that "there is a public interest in the details of XX's health and in recognizing the essential nature of the information";

- on 18 January 2023, before the limitation provision was notified, the Company proceeded in complete autonomy to remove the report;

- immediately after notification of the aforesaid provision, the Company modified the article "by deleting the details in question (as well as the report) from its database", identified and eliminated any links to the same on all Citynews mastheads and requested deindexing to Google;

- the following day, the Company opened a disciplinary proceeding against the Chief Executive Officer Andrea Perniciaro, for violation of company directives and of the code of ethics for journalists;

CONSIDERING that, unless the fact constitutes a more serious offence, whoever, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the performance of the duties or exercise of the powers of the Guarantor";

CONSIDERING that the limitation imposed on the data controller consists of a provision of a temporary nature which, in order to consolidate the relative effects, must be followed by a further provision which, on the basis of an examination carried out on the merits, establishes in a stable manner the lawfulness and correctness of the treatment carried out;

NOTING that, during the proceedings, no new elements emerged such as to modify the preliminary assessments already expressed by this Authority in the aforementioned provision of 18 January 2023, taking into account that art. 137 of the Code envisages, in general terms, the aforementioned principle of the "essential nature of information" as a criterion for determining the publication of personal data in the journalistic field and that the Deontological Rules, in recalling and specifying this principle, intended to guarantee a greater rigor with reference to the collection and dissemination of data suitable for revealing the state of health of identified or identifiable persons (Articles 5, paragraph 1, 6, paragraph 1, and 10 of the aforementioned Rules of Conduct);

CONSIDERING that compliance with the aforementioned Rules of Conduct is an essential condition for the lawfulness and correctness of the processing of personal data (Article 2 quater of the Code);

CONSIDERING that the art. 5 par.1, lett. a) of the Regulation requires the processing of data in a lawful and correct manner, and at lett. c) establishes the principle of data minimisation;

NOTING, therefore, that in the present case, the dissemination of the health data indicated in the article in question, including those contained in the aforementioned laboratory report accompanying the same, is to be deemed to have occurred in contrast with articles 5, par. 1, lit. a) and c) and 9 of the Regulation, as well as with art. 137, paragraphs 1 and 3 and 2 quater, paragraph 4, of the Code, as well as with articles 5, paragraph 1, 6, paragraph 1, and 10 of the Deontological Rules, and that the related treatment is to be considered unlawful;

NOTING, in particular, that the publication of the report has considerably expanded the media coverage of the news on the health conditions of the person concerned, presented, through this publication, in their integrity and medical officialdom;

HAVING ACKNOWLEDGED the measures put in place during the investigation by Citynews S.p.A.;

CONSIDERED, however, due to the violations found, to:

- impose on Citynews S.p.A., pursuant to art. 58, par. 2, lit. f) of the Regulation, the prohibition of the processing of health data indicated in the article in question, including those contained in the aforementioned laboratory report, as well as any other similar information reported in any other articles published on the same site;

- adopt an order-injunction, pursuant to articles 166, paragraph 7, of the Code and 18 of the law n. 689/1981, for the application against Citynews S.p.A. of the pecuniary administrative sanction provided for by the combined provisions of Articles 2-quater, 166, paragraph 2, of the Code, and 83, par. 3 and 5, of the Regulation;

NOTING that for the determination of the amount of the pecuniary sanction, it is necessary to take into account the elements indicated in art. 83, par. 2 of the Regulation and which, in this case, it is necessary to take into consideration, as aggravating circumstances:

a) the harmfulness, for the dignity and privacy of the interested party, of the conduct that led to the dissemination of data relating to his state of health (Article 83, paragraph 2, letter a) of the Regulation);

b) the economic, organizational and professional conditions of the offender (Article 83, paragraph 2, letter k) of the Regulation);

c) the particular nature of the data processed (see Article 83, paragraph 2, letter g) of the Regulation);
and what extenuating circumstances:

d) the purposes pursued by the owner, attributable to the exercise of the right to report and freedom of information, as well as the interest of the community in knowing the news;

e) the measures adopted by the data controller, the Company having promptly taken steps to remove the report and reformulate the article without detailed data, as well as the elimination of any links to it on all Citynews publications and the request deindexing to Google (Article 83, paragraph 2, letter c) of the Regulation);

CONSIDERING the above parameters and the principles of effectiveness, proportionality and dissuasiveness indicated in art. 83, par. 1, of the Regulation;

CONSIDERING that, on the basis of all the elements indicated above, the pecuniary administrative sanction should be applied in the amount of Euro 15,000.00 (fifteen thousand Euro/00);

CONSIDERING also that, pursuant to articles 166, paragraph 7, of the Code, and 16, paragraph 1, of the Guarantor's Regulation n. 1/2019, it is necessary to proceed with the publication of this provision on the website of the Guarantor, by way of ancillary sanction;

HAVING DEEMED that the conditions exist for proceeding with the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, in relation to the measures adopted in the specific case in compliance with art. 58, par. 2, of the same Regulation

HAVING REGARD to the documentation in the deeds;

HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER the lawyer Guido Scorza;

ALL THIS CONSIDERED

HAS

pursuant to art. 58, par. 2, lit. f) of the Regulations against Citynews S.p.A. the prohibition of the processing of health data indicated in the article in question, including those contained in the aforementioned laboratory report accompanying the same, as well as any other similar information reported in any other articles published on the same site, in the terms described above, as in contrast with the articles 137, paragraphs 1 and 3, and 2 quater, paragraph 4 of the Code as well as with articles 5, paragraph 1, 6, paragraph 1 and 10 of the Deontological Rules, and with the general principles referred to in art. 5, par. 1 lit. a) and c) and with the art. 9 of the Regulation, except for mere conservation for the purpose of their possible use in court;

ORDER

pursuant to articles 58, paragraph 2 lett. i) and 83 of the Regulations to Citynews S.p.A., with registered office in Viale Tunisia, 43, 20124 Milan, Tax Code/ VAT number 1078601000 to pay the sum of 15,000.00 (fifteen thousand) euros as an administrative fine for the violations indicated in motivation, representing that the offender, pursuant to art. 166, paragraph 8, of the Code, has the right to settle the dispute, by paying, within the term of thirty days, an amount equal to half of the fine imposed;

ENJOYS

to Citynews S.p.A., in the event of failure to resolve the dispute pursuant to the aforementioned art. 166, paragraph 8, of the Code, to pay the sum of Euro 15,000.00 (fifteen thousand) according to the methods indicated in the annex, within 30 days of notification of this provision, under penalty of adopting the consequent executive acts pursuant to art. 27 of the law n. 689/1981.

HAS

a) pursuant to art. 166, paragraph 7, of the Code, the full publication of this provision on the Guarantor's website;

b) pursuant to art. 17 of Regulation no. 1/2019 of the Guarantor the annotation in the internal register of the Authority pursuant to art. 57, par. 1, lit. u), of the Regulation, in relation to the measures adopted in the specific case in compliance with art. 58, par. 2, of the same Regulation.

Pursuant to art. 78 of the Regulation, as well as the articles 152 of the Code and 10 of Legislative Decree lg. 1 September 2011, no. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed, alternatively, with the court of the place where the data controller resides or has its registered office or with the court of the place of residence of the interested party within the term of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.

Rome, 13 April 2023

PRESIDENT
station

THE SPEAKER
Zest

THE SECRETARY GENERAL
Matthew