Azienda di Rilievo Nazionale ad Alta Specializzazione A.R.N.A.S. Civico - di Cristina Benfratelli (the controller) – €6,000 Fine (Italy, 2022)

A nurse (the data subject) filed a complaint with the Italian DPA against the hospital (the controller) where they worked due to the publication on the controller's institutional website of two measures (following the data subject's request for retirement) which contained personal data of the data subject, including health data. More specifically, the controller published on its institutional website, and indexed on search engines, measures that contained the data subject’s state of invalidity, as well as detailed information relating to the employment relationship (such as the request for retirement). However, there was an error in the calculation of the period of actual service of the data subject that needed to be rectified. The controller forwarded to the DPA the notification of the violation pursuant to Article 33 GDPR ascertaining its willingness to cooperate with the supervisory authority. Following that, the controller removed the measure after 6 days from publication. Moreover, as soon as the controller learnt from the DPA’s notification that the measure was still being indexed on the Internet, it immediately solved the problem by deactivating the indexation of the attachments by search engines. Additionally, the controller indicated that it started taking actions in line with the soon-to-be-approved Privacy Code of Conduct in Healthcare and had a solid intention to adopt it once authorised in accordance with Article 40 GDPR. Finally, it emphasised that the breach resulted from the intention to detail the justifications for the amendment of one of the 2 previously published provisions where that rectification was necessary to acknowledge the period of actual service. The Italian DPA claimed that the controller did not prove the existence of any specific regulatory provision allowing the publication of the measures which were subject to the complaint, nor did it consider sufficient the mere reference to the rules concerning the publicity of acts (such as Article 32 of the law no. 69 of 18 June 2009, referred to by the controller, as well as art. 124, legislative decree no. 267 of 18 August 2000). It argued, moreover, that the publication of the measures was in any case protracted, well beyond the 15-day period provided for by the legislation. It also considered that the dissemination of personal data relating to the data subject was done in the absence of an appropriate legal basis and, considering that these included data relating to the condition of invalidity, in violation of the general prohibition on the dissemination of data relating to health, the Italian DPA concluded that the controller breached Article 5 GDPR, Article 6 GDPR and Article 9 GDPR and Articles 2-ter as well as 2-septies (8) of the Code in the text prior to the amendments made by Law Decree No. 139 of 8 October 2021). Thus, taking into account the particular sensitivity of the unlawfully processed personal data, including those relating to health, as well as considering that the processing of personal data concerned only one data subject and that the controller notified the DPA of what had occurred (Article 33 GDPR) by taking steps to remove the personal data in question from its institutional website and that the indexation on generalist websites of the aforesaid measures occurred due to the presence of "a bug in the platform" that managed the publication of the documents. Also considering the absence of previous relevant violations committed by the data controller or previous measures pursuant to Article 58 GDPR, the Italian DPA imposed a €6,000 fine to the controller.