Cluster S.r.l. – €18,000 Fine (Italy, 2023)

A company called Cluster S.r.l. (the controller) arranged a workshop for postgraduate psychiatry students. The teaching materials included an expert's opinion from a juvenile justice case, which contained details about a deceased minor's (the data subject) medical and criminal history, as well as the personal data of members of his family. The opinion was not properly pseudonymized and revealed the data subject's surname. Furthermore, data had been published on a third-party website. A complaint was brought to the DPA by the data subject's mother. Following a request for information by the DPA, the controller explained that the material in question was shared for training purposes only with the course participants, who were also subject to professional secrecy, and the disclosure of which was expressly forbidden. The controller also added that it had not known that the material had been published on a third-party website. The controller further clarified that it had uploaded the expert's opinion to their internal system to make it available for the workshop and to have emailed the students a URL to access this information after, upon request of one of the speakers. The controller's system was not publicly accessible from the Internet, and the URL was the only way for the public to access the expert's opinion. However, the controller also acknowledged to have failed to verify whether the speaker had removed all the personal data of the data subject and his mother. Finally, the controller suggested that some students may have shared the URL and made it available on the Internet. After finding out about these concerns, the controller immediately removed the expert's opinion from its system. On the basis of the information provided, the Italian DPA stated that without prejudice to the failure to assess whether the person who drafted the expert's opinion correctly anonymised the data processed, the controller was obliged to implement appropriate technical and organisat