G.O.L. Impresa Sociale S.r.l. – Violation Found (Italy, 2022)

A news company named G.O.L. Impresa Sociale S.r.l. published an article in the newspaper Open Online.it reporting on a news story involving the director of a high school (identified by her first name, last name and a photo) and an 18-year-old high school student (referred to by the initials of his first and last name), following the revelation of a love affair between the two, which is currently being investigated by the competent school offices. The article published excerpts of the messages allegedly exchanged between the director and the student related to details of the personal relations between them, placing a particular focus on the contents of these messages. The story gained wide public notoriety in Italy, and prompted the Italian DPA (Garante per la Protezione dei Dati Personali – Garante) to launch a preliminary investigation into the protection of the personal data of the persons mentioned in the news story, weighed against considerations regarding freedom of expression and information in the context of the journalistic activity carried out by the news company. In its analysis of the case, the Garante took into consideration Article 9 GDPR, which establishes that data revealing a person’s sex life are special categories of personal data, and Article 85 GDPR, which establishes that Member States shall by law reconcile the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes. The Garante also observed Article 137(3) of the [https://www.garanteprivacy.it/pdf?p_p_id=PdfUtil&p_p_lifecycle=2&p_p_state=normal&p_p_mode=view&p_p_resource_id=%2Foffering%2FprintPDF&p_p_cacheability=cacheLevelPage&_PdfUtil_articleId=9067692 Italian Data Protection Code] (hereinafter the Code) which provides that the dissemination or communication of personal data for journalistic purposes can be limited in order to protect the rights mentioned in Article 1 of the Code (human dignity, fundamental rights and freedoms), and according to the essential nature of the information concerning facts of public interest. The Garante also referred to Articles 5 and 6 of the [https://www.garanteprivacy.it/pdf?p_p_id=PdfUtil&p_p_lifecycle=2&p_p_state=normal&p_p_mode=view&p_p_resource_id=%2Foffering%2FprintPDF&p_p_cacheability=cacheLevelPage&_PdfUtil_articleId=9067692 Italian Deontological rules on the processing of personal data in the exercise of journalistic activity], which establish that when special categories of personal data are collected, including data revealing a person’s sexual sphere, journalists must guarantee that the right to information is based on essential facts of public interest, and that the disclosure of news of major public or social interest must be limited to what is indispensable in order to describe the facts. The Garante held that the excessive focus on the details described and commented upon, related to the excerpts of the messages between the data subjects, added nothing with regard to the reporting and clarification of the matter, especially taking into consideration that investigations to determine the facts were currently ongoing. Therefore, pursuant to its powers under Article 58(2)(f) GDPR, the Garante ordered the news company, in its capacity as data controller, to abide by a provisional order to cease any further dissemination of the content of the messages between the student and the director, as a matter of urgency in order to guarantee their confidentiality and dignity. The Garante also held that the restriction shall take immediate effect as from the date of receipt of the decision, without prejudice to any other decision to be taken upon the outcome of the preliminary investigation into the case. Additionally, the Garante also ordered the news company to communicate what steps it had taken to implement the decision and to provide adequately documented feedback.