XX (the data subject) – €5,000 Fine (Italy, 2022)

Fondazione Teatro Regio di Torino (the controller) is a non-profit opera organisation which was also involved in public procurement procedures. A former employee (the data subject), was in charge of two tender procedures. However, due to illness she could no longer be part of these biddings. In relation to this, the controller published on its website several decisions containing personal data of the data subject. These decisions addressed the replacement of the data subject from the responsibilities assigned to her in the tender procedures due to sickness. They also contained the data subject's illness certificate as well as information relating to the transfer of powers and functions following her suspension. On 15 November 2021, the data subject filed a complaint with the Italian DPA, which started an investigation on the case. In its defence, the controller argued that it had to fulfill its transparency obligations and thus had to publish infromation about the replacement of the person in charge of the tender procedure. Moreover, as soon as it received the notification from the DPA, the controller took care to remove the data that were the subject of the complaint, which were no longer visible on the website as of 21 February 2022. Additionally, no employee had ever raised an issue of a personal data breach against the controller prior to this case. Allegedly, the incident was caused by a material error of an employee who carried out the publication in full, not realising that among the various documents in his hands, some contained health data, which should not be published. Finally, the controller argued that the damage suffered by the data subject was minor because documents containing her personal data were published in a section of the controller's website that was not immediately accessible to the "average" user. The Italian DPA held that the controller, although subject to transparency obligations, published on its website data relating to health, the disclosure of which is expressly prohibited by law ([https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 2-septies (8) of the Italian Data Protection Code]). Moreover, the DPA held that this information was not indispensable with respect to the purposes of processing and could reveal the pending disciplinary proceedings against the data subject. The DPA found that the processing of personal data carried out by the controller did not comply with the principles of lawfulness, fairness, transparency and data minimisation, thus violating Article 5(1)(a) and Article 5(1)(c) GDPR. The controller processed health data without a valid legal basis (Article 6(1) GDPR) and in breach of the prohibition to process sensitive data ([https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 2-septies (8) of the Code] and Article 9(4) GDPR). Pursuant to Article 83(3) GDPR, the DPA considered several aggravating and mitigating circumstances, when deciding on sanctions against the controller. Notably, the DPA took into account the incorrect assessment as to the type of data to be published in compliance with the transparency obligations; the data breach constituting an isolated event; the absence of previous data protection law infringements by the controller; the fact that the controller deleted data relating to the data subject from its website and organised training courses for all its staff as soon as it received notification of the commencement of proceedings from the DPA; and the controller’s cooperation with the DPA during the investigation. Based on the afore-mentioned elements, the Italian DPA imposed a €5,000 fine on the controller.