Edizioni Proposta Sud S.r.l. – €20,000 Fine (Italy, 2023)

The case involves a complaint filed against Edizioni Proposta Sud S.r.l., an Italian media outlet (the controller). The complaint concerns an article published on 21 December 2021 in "Il Quotidiano del Sud" owned by the controller. The article falsely reported that the complainant, a civil servant in the Municipality, had tested positive for COVID-19 and was in isolation. The publication included a photograph of the complainant and a caption indicating her supposed isolation. Subsequent articles on 23 December 2021 exacerbated the situation by linking her absence from a council meeting to a quarantine related to the virus. The complainant contested the accuracy of the information on the day of publication, requesting the removal of the article, but received no response from the controller. On 26 October 2022, the DPA requested the controller express its views on the complaint, to which the controller failed to respond. Only following a second request, for which the controller was charged with breaching [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 157 of the Codice Privacy] in conjunction with [https://www.garanteprivacy.it/codice Article 166(2) of the Codice Privacy], the controller defended its actions by claiming that the information was truthful and the information was of public interest and fell within the realm of freedom of the press. The Italian DPA concluded that the complainant's claim against the controller was justified. The DPA clarified that [https://www.garanteprivacy.it/codice Article 136 of the Privacy Code] does not exempt those who work in the field of journalism from complying with the general principles of data processing laid down in Article 5(1) GDPR. It further noted that [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9067692 Article 4 of the Deontological Rules] mandates journalists to correct inaccuracies without delay. In light of the present facts, the DPA considered that doing a COVID-19 test falls under Article 9 GDPR as health data and that in the field of journalism, the dissemination of health data is permitted under the freedom of information as long as the dignity of the person is respected, also if the latter is a public figure, as provided under [https://www.garanteprivacy.it/codice Article 137(3) of the Codice Privacy] and [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9067692 Article 11(2) of the Deontological Rules]. Therefore, the DPA concluded that the controller breached the provisions relating to journalistic activity referred to in [https://www.garanteprivacy.it/codice Articles 137(1) and (3), Article 139 of the Privacy Code] and [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9067692 Article 4 of the Deontological Rules]. Additionally, the DPA noted that the controller violated the general principles of data processing under Article 5(1) GDPR. Specifically, the principles of lawfulness and fairness, data minimisation and accuracy, as referred to in Article 5(1)(a), (c) and (d) GDPR. Hence, pursuant to [https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwilpLTHwv2CAxUV7rsIHbHPDQEQFnoECBIQAQ&url=https%3A%2F%2Fgdprhub.eu%2FArticle_58_GDPR&usg=AOvVaw0vOABZ6KomVqnu9X2G3RaM&opi=89978449 Article 58(2)(f) GDPR], the DPA prohibited the controller from further disseminating data concerning the complainant. The DPA further imposed a fine of €20,000 on the controller due to the latter violating [https://gdprhub.eu/Article_12_GDPR Article 12 GDPR] since the controller failed to respond to the complainant's contestation of the information's accuracy, and [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 157 of the Codice Privacy] in conjunction with [https://www.garanteprivacy.it/codice Article 166(2) of the Codice Privacy] for failing to respond to the DPA's request of 26 October 2022.