Ordine degli avvocati di Ancona – €20,000 Fine (Italy, 2023)

The data subject, a lawyer, registered in the 'free legal aid system' offered by the controller, the Ancona Bar Association. This system was intended to register lawyers and enable them to submit requests for legal assistance paid by the State in favor of their clients. During the registration process, the data subject was required to fill in a form with various personal data, including the username and password to access their certified email. These credentials were used to authenticate the registered lawyers each time they submitted a request for free legal aid. Once the credentials were collected through the form, they were encrypted and stored in a cookie installed on the data subject's browser. Each time a request was submitted on the controller's website, the credentials were decrypted by the system and used to access the data subject/lawyer's certified email. Then, the system would send the request from the data subject's account to the controller. The data subject disagreed with the procedure adopted by the controller and filed a complaint with the Italian DPA, claiming that it violated the GDPR as there was no other way to submit the requests. In defense, the controller claimed that Presidential Decree 115/02 establishes that the application for legal aid must be presented to the Council of the Bar Association with territorial jurisdiction to assess it and that the data subjects were asked to consent to the processing of their data. According to the controller, the purpose of the online form was only to facilitate the process and to provide a faster assessment of the request, but data subjects had the alternative of submitting paper applications by mail. Therefore, it argued that the data processing was based both on Article 6 (1)(a) and (e), since the credentials were necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. As for the use of certified email credentials,