Garante per la protezione dei dati personali (Italy) - 9445567
From GDPRhub
(Redirected from Garante per la protezione dei dati personali - 9445567)
| Garante per la protezione dei dati personali - 9445567 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6 GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 02.07.2020 |
| Published: | |
| Fine: | 1000 EUR |
| Parties: | XX TB s.r.l |
| National Case Number/Name: | 9445567 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | Garante (in IT) |
| Initial Contributor: | n/a |
The Garante uses the principle of necessity and proportionality to sanction the unlawful processing of personal data relating to an employee.
English Summary
Facts
Ms. XX, an employee of TB s.r.l., claims a violation of her data protection rights following the posting on the company notice board "visible to all employees and customers of the supermarket [of] the letter of [...] dismissal without just cause, with attached [...] personal details [of the complainant itself]".
Dispute
Is the controller's decision to publish the termination letter respectful of the GDPR?
Holding
The Garante clarifies that, following the termination of the employment relationship, there is an obligation to communicate to the employee, not to the general public (including the customers of the supermarket), to whom communication is not absolutely necessary.
The communication could instead be made to previous colleagues of the complainant, but in different ways, respectful of confidentiality and professional of the data subject (see art. 5, paragraph 1, letter a) and c) of the Regulation).
For the above reasons, the processing of personal data referred to the complainant is unlawful in relation to Articles 5, paragraph 1, letter a) and c) and 6 of the Regulation.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
Order injunction against TB srl - 2 July 2020
Register of measures
n. 124 of 2 July 2020
THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA
IN today's meeting, which was attended by Dr. Antonello Soro, president, Dr. Giovanna Bianchi Clerici and Prof. Licia Califano, members, and Dr. Giuseppe Busia, general secretary;
GIVEN the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (hereinafter, the "Regulation");
GIVEN the Code regarding the protection of personal data, containing provisions for the adaptation of national law to regulation (EU) 2016/679 (Legislative Decree 30 June 2003, n.196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter the "Code");
GIVEN the complaint submitted to the Guarantor pursuant to Article 77 of the Regulation by XX concerning the processing of personal data relating to the interested party carried out by TB srl;
EXAMINED the documentation in deeds;
GIVEN the observations made by the secretary general pursuant to art. 15 of the regulation of the Guarantor n. 1/2000;
Rapporteur dr. Antonello Soro;
WHEREAS
1. The complaint against the company and the preliminary activity.
1.1. With a complaint dated November 5, 2018, Ms XX complained about alleged violations of the Regulations by TB srl (hereinafter, the company), with reference to the posting on the company bulletin board "visible to all employees and customers of the supermarket [ of the] letter of [...] dismissal without just cause, with attached [...] personal details [of the complainant] ".
With a note dated January 14, 2019, the Office invited the company to provide feedback on the facts of the complaint. The request, in the absence of a reply from the company, was renewed with a note dated 17 June 2019 pursuant to art. 157 of the Code.
1.2. Since no reply was received from the company, the Office delegated the acquisition of the requested information to the Special Protection of Privacy and Technological Fraud Unit of the Guardia di Finanza. However, since the company's registered office was found closed, the company's lawyer, Mr. Roberto Comunian, contacted by telephone, was invited to appear on 16 October 2019 at the headquarters of the Compagnia Guardia di Finanza in Sesto San Giovanni, for the notification of documents. On this occasion, the legal representative declared (see minutes of operations carried out on 16.10.2019) that:
to. "As of February 4, 2019 the supermarket managed by the company TB srl located in Milan in via Piero della Francesca n. 57, year in which the complainant worked and where the notice board in question was also posted, has ceased activity ";
b. "Regarding the failure to reply to the request for information [...] sent to the Pec tbsrl@pec.it, [...] this address is incorrect as until 9/3/2019 the Pec of the company was tbsrls@pec.it, therefore he [has] never heard of this request. I also specify that from 9/3/2019 to today, the company's Pec address is tbsrl@mypec.eu ";
c. in relation to the merits of the complaint, considering that the complainant "for almost two years maintained the role of personnel management", the legal representative decided to post "a copy of the dismissal letter on the notice board reserved for communications with employees, to a few days, so that they are no longer subject to any communications or directives "of the complainant;
d. the company bulletin board where the posting took place was placed “within a reserved area and not publicly accessible”, with the consequent possibility of viewing by the employees and not by the customers of the supermarket.
1.3. On 7 November 2019, the Office carried out, pursuant to art. 166, paragraph 5, of the Code, the notification to the company of the alleged violations of the Regulation found, with reference to Articles 5, par. 1, lett. a) and c) and 6 of the Regulation. No confirmation was given by the company to the aforementioned notification of violation.
2. The outcome of the investigation and the procedure for the adoption of corrective and sanctioning measures.
Upon examination of the declarations made to the Authority during the procedure as well as of the documentation acquired, provided that, unless the fact constitutes a more serious crime, anyone, in a proceeding before the Guarantor, falsely declares or certifies news or circumstances o produces false deeds or documents and is liable pursuant to art. 168 of the Code ("False statements to the Guarantor and interruption of the execution of the tasks or the exercise of the powers of the Guarantor"), it is considered, on a preliminary basis, and limited to the failure to respond to the request for information formulated by the Office pursuant to of the art. 157 of the Code, to accept the reasons given by the data controller regarding the fact that the omission depended on sending the aforementioned request to an incorrect Pec address,which did not allow the same to become aware of the request itself.
From a different point of view, it emerges that the company posted the dismissal of the complainant on the company bulletin board at the store of the supermarket where the same was serving; in this way it made visible - at least - to all employees the expulsive measure in its entirety (it was not possible, in this regard, to ascertain whether the position of the notice board could allow the viewing of what was posted not only to employees but also to customers). This occurred in the absence of a suitable legitimation criterion on the part of the employer: according to the regulations in force, in fact, the processing of workers' data can be carried out by the employer only if "necessary" to fulfill an obligation to law or the execution of a contract (see art.6, par.1, lett.b) and c) of the Regulation).
With regard to the procedure relating to the termination of the employment relationship for justified objective reasons, the obligation of communication is envisaged towards the worker, not third parties. In particular, the publication of the dismissal letter makes the specific reasons for withdrawal and the information contained therein known to third parties which, although not included, as a rule, in the context of "particular" data, are to be considered sensitive, even in reason for the economic and social consequences deriving from the withdrawal itself.
Furthermore, the employer carried out the processing in violation of the principle of proportionality: based on this principle, in fact, he could have informed the employees that the complainant was no longer part of the company structure in other ways, in compliance with confidentiality and the dignity, including professional, of the person concerned (see art. 5, par. 1, lett. a) and c) of the Regulations).
3. Conclusions: illegality of the treatment. Sanctioning measure pursuant to art. 58, par. 2, Regulation.
For the aforementioned reasons, the processing of personal data relating to the complainant carried out by the company through the publication of the dismissal letter on the company bulletin board placed at the store of the supermarket where the complainant was serving is illegal, in the terms set out above, in relation to articles . 5, par. 1, lett. a) and c) and 6 of the Regulation.
Therefore, given the corrective powers attributed by art. 58, par. 2 of the Regulation, in light of the circumstances of the specific case:
- a pecuniary administrative sanction is imposed pursuant to art. 83 of the Regulation, commensurate with the circumstances of the specific case (Article 58, paragraph 2, letter i) of the Regulation).
4. Injunction order.
Pursuant to art. 58, par. 2, lett. i) of the Regulations and art. 166, paragraphs 3 and 7 of the Code, the Guarantor orders the application of the pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art.18, l.24.11.1981, n.689), in relation to the processing of personal data referring to the complainant carried out by the company through the publication of the dismissal letter on the bulletin board company whose unlawfulness has been ascertained, within the terms set out above, in relation to Articles 5, par. 1, lett. a) and c) and 6 of the Regulation, following the outcome of the procedure pursuant to art. 166, paragraph 5.
Considering it necessary to apply paragraph 3 of art. 83 of the Regulation where it provides that "If, in relation to the same treatment or related treatments, a data controller [...] violates, with intent or negligence, various provisions of this regulation, the total amount of the pecuniary administrative sanction does not exceed the amount specified for the most serious violation ", considering that the ascertained violations are both subject to the sanction provided for by art. 83, par. 5 of the Regulation, the total amount of the sanction is calculated in such a way as not to exceed the maximum authorized by the same art. 83, par. 5, set at the sum of 20 million euros or, for companies, in 4% of the annual worldwide turnover of the previous year, whichever is higher.
With reference to the elements listed in art. 83, par. 2 of the Regulation for the purpose of applying the pecuniary administrative sanction and its quantification, taking into account that the sanction must "in any case [be] effective, proportionate and dissuasive" (Article 83, paragraph 1 of the Regulation), it is stated that , in the present case, the following circumstances were considered:
a) with reference to the willful or negligent nature of the violation and the degree of responsibility of the owner, the negligent conduct of the company and the degree of responsibility of the same that has not complied with the regulations on data protection relating to a plurality of provisions;
b) the absence of specific precedents (relating to the same type of treatment) charged to the company.
It is also believed that they assume relevance in the present case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness to which the Authority must comply in determining the amount of the sanction (Article 83, paragraph 1, of the Regulation), in firstly, the economic conditions of the offender, determined on the basis of the revenues achieved by the company with reference to the financial statements for micro-enterprises for the year 2017 and also taking into account that the bankruptcy procedure was initiated against the company. Lastly, account is taken of the legal notice imposed, in the previous regime, for the corresponding administrative offenses.
In the light of the elements indicated above and the assessments made, it is considered, in this case, to apply the administrative sanction of payment of a sum equal to Euro 1,000.00 (one thousand) to TB srl.
In this context it is also believed, in consideration of the type of violation ascertained, which concerned the general principles and conditions of lawfulness of the processing, that pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Guarantor Regulation n. 1/2019, this provision should be published on the Guarantor's website.
It is also believed that the conditions set out in art. 17 of Regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.
WHEREAS, THE GUARANTOR
declares the unlawfulness of the processing carried out by TB srl pursuant to art. 57, par. 1, lett. f) and 83 of the Regulations, for the violation of articles 5, par. 1, lett. a) and c) and 6 of the Regulation);
ORDER
to TB srl, in the person of the pro-tempore legal representative, with registered office in Via Piero della Francesca 57, 20154 Milan, PI 09814160967, pursuant to art. 58, par. 2, lett. i), of the Regulations, to pay the sum of Euro 1,000.00 (one thousand) as a pecuniary administrative sanction for the violations indicated in this provision;
INJUNCES
also to the same Company to pay the sum of Euro 1,000.00 (one thousand), according to the methods indicated in the annex, within 30 days from the notification of this provision, under penalty of the adoption of the consequent executive deeds pursuant to art. 27 of Law 689/1981. It should be remembered that the offender has the right to settle the dispute by paying - again according to the methods indicated in the annex - of an amount equal to half of the sanction imposed, within the term pursuant to art. 10, paragraph 3, of d. lgs. n. 150 of 1/9/2011 envisaged for the submission of the appeal as indicated below (Article 166, paragraph 8, of the Code);
HAS
the publication of this provision on the website of the Guarantor pursuant to art. 166, paragraph 7, of the Code and by art. 16, paragraph 1, of the Guarantor Regulation n. 1/2019, and believes that the conditions set out in art. 17 of regulation no. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.
Pursuant to art. 78 of the Regulations, as well as articles 152 of the Code and 10 of Legislative Decree no. 150/2011, an opposition to the ordinary judicial authority may be proposed against this provision, with an appeal filed with the ordinary court of the place identified in the same art. 10, within a period of thirty days from the date of communication of the provision itself, or sixty days if the applicant resides abroad.
Rome, 2 July 2020
