Associazione Nazionale Magistrati – €5,000 Fine (Italy, 2023)

An Italian association representing members of the judiciary (ANM – Associazione Nazionale Magistrati) opened a disciplinary proceeding against one of its adhering members. The data subject, a public prosecutor, lamented that the notification about the disciplinary proceeding was sent not to them directly, but rather to the office to which they belonged. The controller replied that a message directly addressed to the data subject would not have guaranteed adequate levels of protection in terms of security of communications. Moreover, the ANM decided to use the institutional email account in order to be certain that the data subject received the notification. The Italian DPA opened an investigation about potential violations of Articles 5(1)(f), 25 and 32 GDPR. The Italian DPA found that the controller violated the principle of confidentiality. The argument that sending the message to the public prosecutor’s personal email account would not have guaranteed security in communications was groundless. If the controller wanted to be certain that the notification was properly delivered, alternative and less intrusive measures could be put into place. The DPA fined the controller € 5,000 pursuant to Articles 58(2)(i) and 83 GDPR.