Ama S.p.a. – €239,000 Fine (Italy, 2023)

After numerous press reports, the Italian DPA learned that some cemeteries in Rome had a specific area for 'products of conception' and 'fetuses' that were buried in small graves over which the names of women who had had abortions were affixed on a cross. Differently from other areas of the cemeteries, where fetuses were buried after a cerimony, in this specific areas the burials were made at the request of the local health agency and did not receive a funeral. The Italian DPA then opened a wide investigation that was divided in 3 procedures: one against the local health agency (ASL), one against the public company that managed the cemeteries (AMA) and one against the City of Rome (owner of the public company). In the course of the investigations, the DPA found that AMA had signed a service contract with the City of Rome, through which it was identified as the processor, pursuant to Article 28 GDPR. After the investigations, the Italian DPA concluded that the AMA, originally a processor, acted beyond the instructions of the City of Rome, violating Article 29 GDPR. Therefore, it held that the company determined the purposes and means of that procesing and considered it as the controller. The DPA then highlighted that information about abortion constitutes health data and that the spontaneous or voluntary interruption of pregnancy for reasons of health risk is considered as a disease, according to Italian law. Moreover, the law establishes a strict regime of confidentiality to protect the woman's right to anonymity, criminalizing the disclosure of the identity of women by health professionals. The DPA further emphasized that there is no law requiring the names of women who had an abortion to be placed on the graves of the fetuses. According to the DPA, the controller should have implemented sufficient measures to ensure that only an identification code, associated with the name of the parents in the cemetery register, was placed on the graves. Finally, the DPA n