Garante per la protezione dei dati personali (Italy) - 9967845

Garante per la protezione dei dati personali - 9967845
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 137 Codice Privacy Article 6 Regole deontologiche relative al trattamento di dati personali nell’esercizio dell’attività giornalistica Article 7 Regole deontologiche relative al trattamento di dati personali nell’esercizio dell’attività giornalistica
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	16.11.2023
Published:
Fine:	n/a
Parties:	Editoriale Argo S.r.l.
National Case Number/Name:	9967845
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	GARANTE PER LA PROTEZIONE DEI DATI PERSONALI (in IT)
Initial Contributor:	Luca Brocca

The Italian DPA upheld a data subject's complaint against Editoriale Argo S.r.l.. The controller was found to have disclosed in a newspaper article excessive personal data of the data subject, contrary to the principle of data minimisation.

English Summary

Facts

A data subject lodged a complaint with the Italian DPA against Editoriale Argo S.r.l. (the controller), the publisher of the newspaper "CronacaQui." The complaint pertained to the publication of an article reporting a robbery at the data subject's residence. The newspaper, in both its print and online versions, disclosed extensive personal details about the data subject, including her name, photograph, street address, and information about her family.

Despite the data subject's opposition and request to remove the identifying details, the online version was only partially modified, and the data subject was still indirectly identifiable. Thus, the data subject contacted the controller requesting the remaining details to also be deleted, which the controller refused.

In light of this, the data subject claimed to the DPA that the disclosure violated, in particular, the principles of lawfulness of processing enshrined in Article 5(1)(a) GDPR and of data minimisation, as outlined in Article 5(1)(c) GDPR.

Holding

Considering the facts of the case, the Italian DPA noted that data processing carried out for journalistic purposes can be considered lawful, also when carried out without the consent of the data subject, provided that it complies with the rights, fundamental freedoms and dignity of the data subject, pursuant to Articles 136 and 102(2)(a) of the Italian Privacy Code. The articles, indeed, mandate that also in situations of journalistic purposes the rules of fairness and non-discrimination should be observed when communicating or disseminating personal data.

Specifically, the DPA acknowledged, as mentioned by the controller, that Article 137 of the Italian Privacy Code, which pertains to the processing of data for journalistic purposes, applied, as the information had public importance due to frequent thefts in the area. However, the DPA observed that the published information was not only excessive for understanding the news but also increased the risks to the data subject and her family, including the daughter, who was a minor. As it is reflected also in Article 6 of the Ethics Rules for Journalistic Conduct, the DPA emphasised that journalistic processing, while allowed, should adhere to the principles of essentiality and respect for the dignity of individuals, especially victims of crimes. The DPA also emphasised that according to Article 7 of the Ethics Rules for Journalistic Conduct, victims, especially minors, should be granted specific protection, and the data controller's actions created unwarranted risks for the data subject and her family.

Lastly, considering the present was the controller's first violation, the DPA reprimanded the controller and banned further processing of the personal data in question online under Article 58(2)(f) GDPR.

Comment

Although not mentioned explicitly, it could be deduced that the DPA found that the controller violated data protection principles outlined in the GDPR. In particular, it held that the data controller failed to adhere to the principle of data minimisation enshrined in Article 5(1)(c) GDPR since the extensive disclosure of personal details, including those of the data subject's family, went beyond what was necessary for the public interest in understanding the news of the robbery.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web no. 9967845]

Provision of 16 November 2023

Register of measures
n. 534 of 16 November 2023

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members, and Dr. Claudio Filippi, deputy general secretary;

HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”);

HAVING REGARD to the Code regarding the protection of personal data, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”);

GIVEN the complaint presented, pursuant to art. 77 of the Regulation, to the Guarantor with whom XX, in his own interest and that of his younger daughter, represented by the lawyer XX, asked to order Editoriale Argo S.r.l., as publisher of the newspaper "CronacaQui", to remove the information personal data concerning her contained in an article published on the 20th - entitled "XX", in the paper version, and "XX", in the online version - which gave an account of a robbery suffered by her in her own home, publishing numerous details suitable for identifying it;

CONSIDERING that the interested party represented in particular:

that he had suffered a robbery at his home on XX;

that the newspaper published by Editoriale Argo S.r.l., on XX, published the news both on the front page and in the article contained in the paper version of the newspaper "Cronaca Qui", publishing the same article also in the online version of the newspaper ;

that the front page of the paper newspaper also contained a photograph of her - taken from her "Facebook" profile - as well as the image of a neighbor in the act of pointing to the balcony of her home, specifying that the same images were also published to accompany the version published online;

that the paper version of the article published inside contained a further photo of the complainant - also taken from her Facebook profile - together with an image of the property and a series of detailed information, including her name and surname, the street address, the description of the property in which he lives with his younger daughter, the school attended by the latter and the occupation of his partner;

that the article finally contained an interview with the neighbour, whose name and surname was reported, in which various details relating to his home were reported, noting that the same information was also present in the online version;

that on the same day the article was published, he contacted the newspaper in order to obtain the removal of all details that could lead to his identification or that of his family members, also due to fears linked to the fact that one of the robbers were still in circulation, and he specified that "Cronaca Qui" took steps to modify the online version - not being able to intervene on the paper version - also removing the photos which, however, remained available online for several days thereafter;

that the modified version still contains some details that allow us to indirectly trace one's identity (the address of residence, the type of property, the name and surname of the neighbor and the school attended by the daughter);

that in the days following the report she was contacted by all her acquaintances who learned of the affair through the information published by the publisher, highlighting that she had even received an XX";

who on XX asked the publisher to delete the details still present in the article, but received negative feedback on XX;

in the case in question, there was a violation of the principle of minimization referred to in art. 5 of the Regulation, as well as the principle of essentiality of information referred to in art. 6 of the Rules of Ethics, as there is no prerequisite of public interest in knowing one's identity which, as a victim of crime, should be protected, as clarified in various circumstances also by the Guarantor, also taking into account the risks to which she and her daughter minor were exposed by virtue of the recognisability of their home, also creating, with regard to the minor herself, a violation of article 7 of the ethical rules regarding processing for journalistic purposes;

that the use of one's image occurred in the absence of consent, taking into account the fact that the publication of photographs on one's Facebook profile is motivated by private purposes and not to allow subsequent dissemination to third parties;

HAVING REGARD to the note of 28 March 2023 with which the Authority asked the data controller to provide its observations regarding what was represented in the document introducing the procedure and to communicate its possible intention to comply with the complainant's requests;

GIVEN the communication of 5 April 2023 with which the data controller represented that:

the information disseminated concerned an event of undoubted public importance also due to the extreme social danger that characterized the conduct of those responsible for the event;

having taken note of the opposition of the interested party, steps were taken, prior to the submission of the complaint, to modify the article published in the online version by eliminating any reference to the name of the same, an initiative appreciated by the latter and on which it is therefore considered the matter of dispute has ceased;

the same must be said for the photograph of the complainant, removed from the online version of the article following her opposition, while noting that such publication is to be considered lawful, even more so when connected to news events in relation to which it appears justified from justice and police purposes;

with reference to the other residual data, such as the name of the street of the house and the photo of the building, it found that the dissemination of the same took place in compliance with the applicable principles in the matter, taking into account the importance of the experience lived by Mrs XX as a warning for the other inhabitants of the area, given that it is a modest-sized centre;

the data relating to the school attended by the younger daughter is generic data as it refers to the school's order without further specifications, just as the reference to the presence of the complainant's "companion", without further additions, is functional to account for the dangerousness of the the attack occurred in broad daylight, at a time when other people could have been present on whose protection the victim could have counted;

although we considered the processing carried out to be lawful, it definitively ceased due to the cancellation of the article and its de-indexing;

GIVEN the note dated XX in which the complainant, in recalling what was already deduced in the complaint, noted the following:

that, in the present case, the criterion of continence has not been respected due to the publication of personal data concerning her and which have no use for purposes of public interest, specifying that the reference to justice and police purposes, invoked by the data controller to justify the publication of images, is consistent with the data referring to arrested persons and not to those of the victims;

the latter, in fact, must enjoy specific protection and the circumstance of the removal of some information following the reports submitted by you demonstrates that the comments made were shared by the publisher and that these assessments could have been made prior to publication, given that paper copies have been irremediably disseminated;

there are few homes in the street where your apartment is located, a circumstance which makes it easy, through the publication of images of the property and published details, to trace which one you own;

with reference then to the exception raised by the owner according to which the data relating to the school attended by his daughter would be generic data, he noted that in the municipality in which he resides there is only one middle school and it is therefore easy for anyone to trace the address of the same ;

GIVEN the note dated 8 September 2023 with which, pursuant to art. 166, paragraph 5, of the Code, the Authority communicated to Editoriale Argo S.r.l. the initiation of the procedure for the possible adoption of the measures referred to in the art. 58, par. 2, of the Regulation and the alleged violations of the law, identified, in this case, in the violation of the articles. 5, par. 1, letter. a) and c), of the Regulation, of the art. 137, paragraph 3, of the Code and articles. 6 and 7 of the Ethics Rules;

HAVING REGARD to the memorandum of 11 October 2023 with which the data controller recalled the observations already set out in the memorandum filed during the proceedings and asked, where the Authority deems the disputed violations to exist, to take into account the circumstances of the individual case and the absence of precedents against him for the purposes of determining the measure to be applied;

CONSIDERING that, unless the fact constitutes a more serious crime, anyone who, in proceedings before the Guarantor, falsely declares or certifies information or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code “False statements to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor”;

NOTING that - as repeatedly supported by the Authority - in order to reconcile the rights of the person (in particular the right to privacy) with the freedom of expression of thought, the regulations on the protection of personal data provide specific guarantees and precautions in case of processing carried out for journalistic purposes, confirming their lawfulness, even where they are carried out without the consent of the interested parties, provided that they are carried out in compliance with the rights, fundamental freedoms and dignity of the persons to whom the processed data refers (see articles 136 et seq. and art. 102, paragraph 2, letter. a), of the Code) and provided that they are carried out in compliance with the principle of the essentiality of information regarding facts of public interest (art. 6 of the Ethics Rules);

NOTED, with regard to the matter described in the complaint, that:

the fact narrated in the article presents, in itself, an undoubted public interest, with particular regard to the inhabitants of the area which, as far as we know, has been affected by frequent thefts which have occurred, as in the case involving the interested party , even during the day;

however, in the case in question, the publisher has published, both in the paper version and in the one available online, numerous details suitable for identifying, unequivocally, the victim of the crime and her family members, including her minor daughter ;

in the article published by the newspaper, the name and surname of the complainant were in fact disclosed, including a photograph of the latter present from the first page, the street of her home - also accompanied by a photographic image of the building and the publication of a series of details provided by a neighbor during an interview suitable for identifying Mrs. XX's apartment with certainty - as well as information that allows us to trace her family members, as well as information referring to completely third parties unrelated to the matter (reference is made, for example, to the data on the hospitalization of the sister of the owner of the property where Mrs. XX lives);

the dissemination of this information - which, although removed in the online version of the article before the complaint was submitted, nevertheless remains in the paper version of the newspaper - does not appear in line with the principles that regulate the processing of data within the scope of the activity journalistic, with particular regard to the principle of essentiality of information, taking into account the fact that the details revealed were not indispensable for the purposes of understanding the news, but were on the other hand suitable for amplifying the risks to which the interested party and her family also in consideration of the easy availability of such information online in the period preceding the changes made by the publisher in the digital version of the article;

to this we must add that even the changes introduced in the online version of the latter, made before the definitive removal of the same which occurred during the procedure, were not adequate since, due to the numerous information retained in the text and the small size of the territorial context of reference of the newspaper, the possibility of indirectly identifying the complainant and her younger daughter remained;

CONSIDERING that the conduct carried out by the data controller appears likely to constitute a violation of the articles. 5, par. 1, letter. a) and c), 137, paragraph 3, of the Code, 6 and 7 of the Ethics Rules;

HAVING NOTED the measures adopted during the proceedings by the publisher who took steps to remove the digital version of the disputed article and that, therefore, with regard to this profile, the conditions for the adoption of measures in this regard by part of the Authority;

NOTED, however, that:

the personal data of the interested party and her minor daughter, the processing of which is to be considered illicit ab origine, remain in the paper version of the article which, as such, is kept by the publisher in the appropriate archive;

the information contained therein, although the scope of diffusion is in itself more limited than an article in digital format, still remains available to an undefined number of users, this circumstance being able to favor a persistent circulation of data whose publication is to be considered illicit;

that, in order to balance the need to keep track of the original article also for the purposes of their possible use in court with the need to guarantee the rights of the interested party and compliance with the legislation on the protection of personal data, it seems appropriate to limit, by external users, the accessibility to the paper copy of the article present in the newspaper's archive;

CONSIDERED that it is necessary to take action against Editoriale Argo S.r.l., pursuant to art. 58, par. 2, letter. f), of the Regulation, the measure of the prohibition of further processing, even online and including the historical archive, of the data directly or indirectly identifying the complainant and her minor daughter, except for the mere conservation of the same for the purposes of their possible use in judicial proceedings and, having regard to the paper copy still available in the archive, also for the purposes of proven research needs to be carried out within the limits of sector provisions;

REMEMBERED that, in case of non-compliance with the measure of the prohibition of processing established by the Guarantor, the criminal sanction referred to in the art. 170 of the Code, in addition to the administrative sanction referred to in art. 83, par. 5, letter. e), of the Regulation;

CONSIDERING, with respect to the violations ascertained, that:

the narrated fact, in itself, could be considered of interest to the relevant community and could be justified in the context of the exercise of journalistic activity, always within the limits of the correct performance of the latter;

the publisher nevertheless took steps to modify the digital version of the article before submitting the complaint, arranging for its definitive removal during the procedure;

there are no previous violations against Editoriale Argo S.r.l.;

the overall evaluation of the elements described leads us to consider the application of the warning measure proportionate in the case in question;

CONSIDERING that it is therefore necessary to issue a warning to the data controller pursuant to art. 58, par. 2, letter. b) of the Regulation, for failure to comply with the provisions regarding data processing in the context of the exercise of journalistic activity, with particular regard to the principle of essentiality of information, especially where minors are involved;

CONSIDERING that the conditions are met to proceed with the annotation in the internal register of the Authority referred to in the art. 57, par. 1, letter. u), of the Regulation, relating to the measures adopted in this case against Editoriale Argo S.r.l. in compliance with the art. 58, par. 2, of the Regulation itself;

HAVING SEEN the documentation in the documents;

GIVEN the observations formulated pursuant to art. 15 of the Guarantor's regulation no. 1/2000;

SPEAKER Dr. Agostino Ghiglia;

ALL THIS CONSIDERING THE GUARANTOR

pursuant to art. 57, par. 1 letter f), of the Regulation:

a) takes note of the measures adopted by the data controller during the procedure consisting in the removal of the digital version of the disputed article;

b) pursuant to art. 58, par. 2, letter. f) of the Regulation, provides for the prohibition of further processing, including online and including the historical archive, of the data directly or indirectly identifying the complainant and her minor daughter, except for the mere conservation of the same for the purposes of their possible use in judicial proceedings, having regard to the paper copy still available in the archive, also for the purposes of proven research needs to be carried out within the limits of sector provisions;

c) with regard to the violations ascertained against Editoriale Argo S.r.l., as publisher of the newspaper “CronacaQui”, warns the same for failure to comply with the provisions regarding data processing in the context of the exercise of journalistic activity , with particular regard to the principle of essentiality of information, especially where minors are involved;

d) pursuant to art. 17 of the Guarantor's regulation no. 1/2019, provides for the annotation in the internal register of the Authority referred to in the art. 57, par. 1, letter. u), of the Regulation, of the measures adopted against Editoriale Argo S.r.l., as publisher of the newspaper “CronacaQui”, in compliance with the art. 58, par. 2, of the Regulation itself

Pursuant to art. 78 of the Regulation, as well as articles. 152 of the Code and 10 of the Legislative Decree. lg. 1 September 2011, n. 150, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal lodged, alternatively, with the court of the place where the data controller resides or has its registered office or with that of the place of residence of the interested party within the deadline of thirty days from the date of communication of the provision itself or sixty days if the appellant resides abroad.

Rome, 16 November 2023

PRESIDENT
Stantion

THE SPEAKER
Ghiglia

THE DEPUTY SECRETARY GENERAL
Philippi