Conservatorio Santa Cecilia di Roma – €6,000 Fine (Italy, 2022)

At the St Cecilia Conservatory of Music in Rome (the controller), a student association held an assembly through the Zoom platform. An unknown person saved a video recording of the assembly on a USB drive and left the drive on the premises, where it was found and viewed by the Conservatory's Principal. The Principal held that one of the Conservatory's students (the data subject) offended the school's reputation during the assembly. For this reason, the Conservatory initiated disciplinary proceedings against the student, and appointed a sworn expert who transcribed the student's statements on the video recording. The data subject subsequently filed a complaint with the Italian DPA. In its defense, the controller observed that principals have disciplinary powers over students under Italian law and may investigate student misconduct outside of school. For this reason, the controller claimed that it processed the data subject's data on the legal basis of the exercise of official authority (Article 6(1)(e) GDPR). The controller also argued that students had no expectation of privacy during the assembly because links to the Zoom session were publicly available on social media. The DPA held that the principal had no authority to access personal data which was randomly discovered on a misplaced USB drive. For this reason, the DPA held that the original collection of the data lacked a legal basis. As a consequence, the DPA found that all further processing of the data during the disciplinary proceedings (including their disclosure to the sworn expert) also lacked a legal basis, and violated the purpose limitation principle. The DPA also clarified that the public and open character of the student assembly was not relevant, as the means through which it was collected in this case (random discovery of a misplaced object) cannot be constitute a sifficient reason to legitimise the processing of personal data. For these reasons, the DPA held that the controller violated Articles 5(1)(a), 5(1)(b), and (6) GDPR as well as [https://www.gazzettaufficiale.it/dettaglio/codici/datiPersonali/2_0_3 Article 2-ter] of the Italian privacy codeThe bold text in the link highlights subsequent modifications to the Article. The DPA referred to the older version of the Article in the case. . The DPA also discovered, during its investigation, that the Principal was the controller's data protection officer at the time of the complaint. The DPA held this to be a violation of Article 38(6) GDPR because the officer was in a position of a conflict of interest. In this regard, the DPA reference its own guidelinesGPDP, 'Documento di indirizzo su designazione, posizione e compiti del Responsabile della protezione dei dati (RPD) in ambito pubblico', 29 April 2021 (available [https://www.garanteprivacy.it/documents/10160/0/Documento+di+indirizzo+su+designazione%2C+posizione+e+compiti+del+Responsabile+della+protezione+dei+dati+%28RPD%29+in+ambito+pubblico.pdf/04f7e00d-548d-9c2c-8582-79219dfa1838?version=1.0 here]). and case lawGPDP, [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9718134 Provvedimento n. 318 del 16 settembre 2021 [9718134]] as well as the Article 29 Working Party GuidelinesWP29, ‘Guidelines on Data Protection Officers (‘DPOs’)’, WP243rev.01, 5 April 2017 (available [https://ec.europa.eu/newsroom/article29/items/612048/en here])..