Ordine degli avvocati di Ancona – €20,000 Fine (Italy, 2023)

The data subject, a lawyer, registered in the 'free legal aid system' offered by the controller, the Ancona Bar Association. This system was intended to register lawyers and enable them to submit requests for legal assistance paid by the State in favor of their clients. During the registration process, the data subject was required to fill in a form with various personal data, including the username and password to access their certified email. These credentials were used to authenticate the registered lawyers each time they submitted a request for free legal aid. Once the credentials were collected through the form, they were encrypted and stored in a cookie installed on the data subject's browser. Each time a request was submitted on the controller's website, the credentials were decrypted by the system and used to access the data subject/lawyer's certified email. Then, the system would send the request from the data subject's account to the controller. The data subject disagreed with the procedure adopted by the controller and filed a complaint with the Italian DPA, claiming that it violated the GDPR as there was no other way to submit the requests. In defense, the controller claimed that Presidential Decree 115/02 establishes that the application for legal aid must be presented to the Council of the Bar Association with territorial jurisdiction to assess it and that the data subjects were asked to consent to the processing of their data. According to the controller, the purpose of the online form was only to facilitate the process and to provide a faster assessment of the request, but data subjects had the alternative of submitting paper applications by mail. Therefore, it argued that the data processing was based both on Article 6 (1)(a) and (e), since the credentials were necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. As for the use of certified email credentials, it claimed that they were stored in a browser's technical cookie and not on its servers. Thus, the website used them only at the time the request was made, in order to authenticate it and send the digitally signed application from the certified email to the controller. In addition, it stated that it had no economic interest in collecting such data, having entrusted the development and management of the system to a specialized company, since it did not have the necessary technical knowledge to do so. Firstly, the DPA recognized two data processing activities: a) one when credentials were collected by the controller's website during the registration process; and b) another when they were used to access the data subject's certified email and authenticate the requests. The DPA also recognized that the Ancona Bar Association was the controller in both data processing activities, considering that it was determining the purposes and means of data processing. Thus, it stated that the Bar Association remains liable even if the processing was entrusted to a third party. Secondly, the DPA noted that the cookies used by the website were not "technical cookies" as they were not strictly necessary for the provision of the service. Therefore, they could only be used based on consent. However, the DPA dismissed the claim that data processing was supported by consent since it was actually not request at the time of registration on the website. Moreover, even if there was a request for consent, it would not be free, as it was stated on the website cthat all requests should be submitted exclusively through the online form. Similarly, it held that the legislation referred to by the Council, while legitimizing the processing of data relating to the application for free legal aid, did not provide for the processing of the credentials to the data subject's certified email. In the DPA's view, this purpose could have been be pursued with less invasive means, which do not jeopardize the rights and freedoms of the data subjects. For these reasons, the DPA considered that the data processing lacked a legal basis, violating Article 6(1) GDPR. Thirdly, the DPA pointed out that the misuse of these credentials could enable unauthorized access to the certified emails of the lawyers, which contains personal data also belonging to particular categories or relating to criminal convictions and crimes. Therefore, it held that the data processing involved serious and unjustified risks which were not considered by the controller. Due to the lack of adequate safeguards, it found a violation of the principle of integrity and confidentiality provided for by Article 5(1)(f) GDPR. Fourthly, the DPA noted that, although there was a link to the privacy policy on the webpage, the information provided therein was extremely generic. In particular, it did not contain references to the specific processings carried out through the system and to its legal basis. Therefore, it found a violation of Article 5(1)(a) and 13 GDPR. Finally, it highlighted that the controllers must implement the principles of data protection by design and by default according to Article 25 GDPR. Even if the development and operation of the system is entrusted to a third party, it is up to the controller to supervise the processor's activities and ensure that they are compliant with the GDPR. In the case at hand, the DPA found that the controller, in determining the means of the processing, failed to adopt adequate measures and to to effectively implement the principles of "lawfulness, correctness and transparency" and of "integrity and confidentiality", taking into account the high risks for the rights and freedoms of the affected data subjects For these reasons, the DPA issued a fine of €20,000.00 for the violation of Articles 5, 6, 13 and 25 GDPR.