Educationest s.r.l. – €1,000 Fine (Italy, 2022)

On 15 February 2021, the Italian DPA received a complaint about unlawful communication of personal data by a controller to third parties. The controller is private nursery school Educationest s.r.l. The data-subject is a teacher at this school. The private nursery school emailed a group of parents of the children enrolled in the school about the prolonged absence of a teacher. In doing so, the school informed the parents that the teacher was on pregnancy leave. The school did not inform the teacher that it disclosed her pregnancy to the parents. The school claimed that the processing of personal data was lawful based on Articles 6(c) and 9(2)(b). The school did not specify the source of the legal obligation under Article 6(1)(c) GDPR, nor the source of the obligations or of the specific rights of the controller or of the data subject under Article 9(2)(b). The DPA found multiple violations of the GDPR. The DPA held that personal data was processed without a lawful ground as there was no legal obligation to disclose the pregnancy (Article 6(1)(c)). The DPA also held that the processing of personal data was a violation of the data minimization principle (Article 5(1)(c)) as it was also not necessary for its purpose, namely the execution of the employment relationship. The school was fined for €1000, taking into account the peculiar situation of the education sector during the pandemic.