RCS Mediagroup S.p.a – €10,000 Fine (Italy, 2023)

On 17 February 2023 the complainant brought a case to the Italian DPA claiming a violation of her data protection right concerning the dissemination by an Italian newspaper on 23 January 2023 of an article containing a picture of a holographic will of an actress. According to the complainant, the will clearly showed the name, date, place of birth, address and title of witness assumed by the complainant. The complainant further asserted to have requested RCS Mediagroup S.p.a (the data controller) to exercise her rights provided for from Article 15 GDPR to Article 22 GDPR but did not receive feedback. On 2 March 2023, the Italian DPA requested the data controller to respond to the complainant’s requests and to state whether they would comply with them. On 21 March 2023, the data controller declared that the will is a public deed which can be accessed by anyone with an interest and that the information of the witnesses is an integral part of that public deed. Hence, the public nature of the will deprived it of any confidentiality, and the photograph of the page of the will and the publication of the complainant’s personal data took place lawfully. To which the complainant responded that [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1556386 Article 6 of the Deontological Rules], which states that the disclosure of news of major public or social interest is not contrary to respect for the private sphere when the information is indispensable, does not apply and that the data controller should have refrained from disseminating the data of the complainant. Following this, the DPA issued a statement of the commencement of proceedings. The DPA assessed that the failure to reply to the request of the complainant by the data controller could be considered excusable since the complainant made an unclear request, as it referred to compensation for damages and to a streaming reproduction that the data controller never carried out. However, it also found that the data controller breached [https://www.garanteprivacy.it/codice Article 136 of the Italian Privacy Code], [https://www.garanteprivacy.it/codice Article 137(3) of the Italian Privacy Code], [https://www.garanteprivacy.it/codice Article 139 of the Italian Privacy Code] and [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1556386 Article 6 of the Deontological Rules], and to the general principles of lawfulness and fairness in the processing of personal data set out in Article 5(1)(a) GDPR. The DPA stated that a will is not a public document to which anyone with an interest may have access, even if such data was public and acquired lawfully. Moreover, the fact that the complainant's data were essential for the validity of the holographic will did not make them essential for the right to report, which could have been pursued without providing all the complainant’s personal data. In fact, the data disseminated were more than those necessary for proper information as it exposed the data subject well beyond the circle of her acquaintances, as by publishing it, the online newspaper made the data available on the Internet to an indeterminate number of people. Since the complainant was not a public figure, the reproduction had to be subject to the requirements of fairness, relevance, non-excessiveness and necessity in relation to the public interest concerned. Thus, the DPA prohibited the data controller from further processing the complainant’s first and last name, date of birth and address of residence, and it fined the data controller €10,000 under Article 58(2)(i) GDPR and Article 83 GDPR.