XX and XX – €4,000 Fine (Italy, 2020)

Regione Campania published a document containing personal data of XX and XX on its website. The reporting parties complained that their names and addresses were disclosed online because they owed a debt to the Region, as provided by the final judgement of a civil suit. Regione Campania promptly removed personal information upon request of the parties. Moreover, the accused party stated that neither third parties, nor the complaining parties were harmed by the publication of the information and it argued that there was an obligation to publish those data in accordance with art. 73 of D. Lgs. 118/2011. Is the online publication of personal information of a debtor in compliance with art. 5 and 6 of the GDPR? The DPA held that Regione Campania violated art 5(1)(a)(c), art. 6(1)(c)(e), art. 6(2) and art. 6(3)(b) GDPR, and concluded that art. 73 of D. Lgs. 118/2011 imposed no obligation with regard to the online publication of personal information of debtors. Therefore, the DPA issued a sanction of € 4.000.