Ama S.p.a. – €239,000 Fine (Italy, 2023)

After numerous press reports, the Italian DPA learned that some cemeteries in Rome had a specific area for 'products of conception' and 'fetuses' that were buried in small graves over which the names of women who had had abortions were affixed on a cross. Differently from other areas of the cemeteries, where fetuses were buried after a cerimony, in this specific areas the burials were made at the request of the local health agency and did not receive a funeral. The Italian DPA then opened a wide investigation that was divided in 3 procedures: one against the local health agency (ASL), one against the public company that managed the cemeteries (AMA) and one against the City of Rome (owner of the public company). In the course of the investigations, the DPA found that AMA had signed a service contract with the City of Rome, through which it was identified as the processor, pursuant to Article 28 GDPR. After the investigations, the Italian DPA concluded that the AMA, originally a processor, acted beyond the instructions of the City of Rome, violating Article 29 GDPR. Therefore, it held that the company determined the purposes and means of that procesing and considered it as the controller. The DPA then highlighted that information about abortion constitutes health data and that the spontaneous or voluntary interruption of pregnancy for reasons of health risk is considered as a disease, according to Italian law. Moreover, the law establishes a strict regime of confidentiality to protect the woman's right to anonymity, criminalizing the disclosure of the identity of women by health professionals. The DPA further emphasized that there is no law requiring the names of women who had an abortion to be placed on the graves of the fetuses. According to the DPA, the controller should have implemented sufficient measures to ensure that only an identification code, associated with the name of the parents in the cemetery register, was placed on the graves. Finally, the DPA noted that upstream processing os these sensitive data, transferred from hospitals to the health agency and from the latter to the cemeteries must be adapted to comply with data protection. For instance, by applying the data minimization principle, health agencies should no longer include women's personal details in the transport and burial authorizations that are sent to the cemetery services. Instead, health agencies can implement technical (e.g. pseudonymisation or data encryption) and/or organizational measures to avoid the direct identification of the women concerned. For the above reasons, the DPA found violations of Articles 28, 29 and 32 GDPR and issued a fine of €239,000.00