XX (data subject) – Complaint Upheld (Italy, 2022)

The Italian DPA received a complaint from the data subject concerning the dissemination of personal data concerning him and his son as well as information on his son’s injuries following a fall inside his school. These pieces of information were published in a Council resolution on the municipality of Brindisi’s website. The data subject had already requested the controller to remove any data from its website which could directly trace back to his minor son’s identity and pathology and republish it in compliance with the rules in force. The controller directly acted upon this request and deleted the resolution from its Municipal Notice Board. However, information on the legal proceedings including names and the circumstance of the existence of these legal proceedings could still be found in the subject of the resolution on the controller’s website. 2 years later there was no contest from the data subject to the controller, however the data subject lodged a complaint with the Italian DPA. The Italian DPA considered the fact that the controller had already removed the full text of the contested resolution from the web as requested by the data subject and that it kept the contested personal data included in the subject of the resolution only by mere mistake. Moreover, the controller asked to take into consideration the objective difficulty of sometimes balancing transparency and the protection of personal data. It pointed out the existence of a need, for the purposes of transparency of administrative action, to leave public the subject of the resolution with the names of the parties in clear; as well as the large number of acts to be published online. The Italian DPA held that the need for transparency could be achieved without disseminating online the personal data of the parties involved in the proceedings and therefore held that the controller breached Article 5(1)(c) in that it was inconsistent with the principle of data minimisation since the data were not limited to what is necessary in relation to the purposes for which they were processed. The Italian DPA also held that the controller lacked the appropriate regulatory prerequisites for the period exceeding the fifteen days provided for by Article 124(1) of Legislative Decree no. 267/2000 for publication on the public notice board, in breach of Article 2-ter(1) and (3) of the Legislative decree 30/06/2003, n.196 also called “Codice in materia di protezione dei dati personali”; and of Article 6(1)(c), Article 6(1)(e), Article 6(2) and Article 6(3)(b). The Italian DPA did not impose a fine because it considered the controller's cooperation, because the relevant data did not qualify as sensitive data under Article 9 GDPR and Article 10 GDPR, it only involved two data subjects, and no other breaches were found.