Regione di Veneto (the Controller) – €100,000 Fine (Italy, 2022)

Following the entry into force of the [https://www.gazzettaufficiale.it/eli/id/2021/04/01/21G00056/sg Legislative Decree No. 44/2021], the Veneto Region (the controller) transmitted the lists of health care workers who were not vaccinated on the date of 15 April 2021 (data subjects), to the competent doctor of each employer through a password-protected list, to persuade them, in good faith, to adhere to the vaccination as set out in the legislative decree No. 44/2021. The competent doctor would receive personal details of the data subjects, such as their tax code, surname, first name, date of birth and gender. Moreover, the employers were asked to provide the contact details of each competent doctor, then a vaccination invitation model was sent, with a request for rapid transmission to the data subjects concerned. Based on dozens of complaints and reports from data subjects (mostly medical and nursing staff employed in healthcare facilities in the Veneto Region) and on the basis of questions raised by competent doctors working at regional healthcare facilities, the Italian DPA launched a preliminary investigation into the processing operations carried out by the controller during the implementation of the Legislative Decree No. 44/2021. The controller ascertained that the verifications that it carried out were transmitted to the figure expressly appointed to deal with the health aspects of the workers, (i.e., the competent doctor). The competent doctor would then transmit this information to the local health authority pursuant to Legislative Decree 44/2021. Moreover, the controller allegedly ensured that the transmission of the lists of data subjects to the competent doctors was carried out to perform a task in the public interest and for the exercise of public powers vested in the controller. The controller reaffirmed the difficult period during which it had to act and the fact that [https://www.gazzettaufficiale.it/eli/id/2021/04/01/21G00056/sg Article 4 of the Legislative Decree No. 44/2021] was subject to subsequent amendments which led to uncertainty in the regulatory framework (such as extension of the vaccination obligation to all workers employed in residential, social welfare and social health facilities, and extension of the effectiveness of the vaccination to a longer time-period). The Italian DPA noted that the systematic and generalised transmission to the competent doctors working at the regional health authorities of lists of all data subjects who were not vaccinated at the time of the events, gave rise to a communication of personal data not provided by sectoral law relating to the verification of vaccination as a professional requirement (Article 4 of the Legislative Decree no. 44/2021) nor by the law on safety in the workplace (Legislative Decree no. 81/2008). Therefore, the data processing occurred in the absence of a valid legal basis, in breach of Article 5(1)(a) and Article 6 GDPR, as well as [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Articles 2-ter and 2-sexies of the Italian Data Protection Code]. According to the DPA, there was no disclosure of data relating to health under Article 9 GDPR. Additionally, the Italian DPA reminded that the disclosure of data to third parties by public entities is only permissible when provided for by a provision of law, or in cases falling under Article 6(2) GDPR. Moreover, the Italian DPA noted that the controller did not follow ordinary channels of communication when transmitting the lists of data subjects, therefore confirming that it acted outside the regulatory framework. Pursuant to Article 58 GDPR and Article 83 GDPR, the DPA took into account the nature, object and purpose of the processing as well as the particularly large number of data subjects concerned (as the transmitted lists contained the names and other personal data of approximately 12,580 public health workers) and their vulnerability in their work environment, as well as the consequences on a relational and professional level of the circulation of personal information in such context. The DPA also considered the emergency context in which the events in question occurred. The uncertainty of the legal framework of reference allegedly led the controller to take the initiative at regional level, misinterpreting the role of the competent doctors for the purposes of data protection and mistakenly relying on the legitimacy of the data transmission. For the DPA, the controller acted in good faith, with the aim of supporting its health authorities at a particularly complicated time and to raise awareness of vaccination in an area already heavily affected by deaths among health personnel. The controller also cooperated during the investigation to reduce the consequences of the disclosure of data. In consideration of all these points, the Italian DPA imposed a €100,000 fine to the controller.