Cluster S.r.l. – €18,000 Fine (Italy, 2023)

A company called Cluster S.r.l. (the controller) arranged a workshop for postgraduate psychiatry students. The teaching materials included an expert's opinion from a juvenile justice case, which contained details about a deceased minor's (the data subject) medical and criminal history, as well as the personal data of members of his family. The opinion was not properly pseudonymized and revealed the data subject's surname. Furthermore, data had been published on a third-party website. A complaint was brought to the DPA by the data subject's mother. Following a request for information by the DPA, the controller explained that the material in question was shared for training purposes only with the course participants, who were also subject to professional secrecy, and the disclosure of which was expressly forbidden. The controller also added that it had not known that the material had been published on a third-party website. The controller further clarified that it had uploaded the expert's opinion to their internal system to make it available for the workshop and to have emailed the students a URL to access this information after, upon request of one of the speakers. The controller's system was not publicly accessible from the Internet, and the URL was the only way for the public to access the expert's opinion. However, the controller also acknowledged to have failed to verify whether the speaker had removed all the personal data of the data subject and his mother. Finally, the controller suggested that some students may have shared the URL and made it available on the Internet. After finding out about these concerns, the controller immediately removed the expert's opinion from its system. On the basis of the information provided, the Italian DPA stated that without prejudice to the failure to assess whether the person who drafted the expert's opinion correctly anonymised the data processed, the controller was obliged to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the data processing. This means ensuring the confidentiality of the processing and regularly testing and evaluating the effectiveness of the technical and organisational measures to provide the security of processing, in accordance with Article 32(1)(b) and (d) GDPR. In the case at hand, the DPA noted that the controller processed the personal data of the data subject and his family members in violation of the GDPR as it failed to provide adequate measures to ensure confidentiality and to verify the effectiveness of the technical and organisational measures adopted. As a matter of fact, the controller neither had an authentication procedure to limit access to the expert's opinion, nor did it assess the adequacy of its anonymisation measures. Therefore, considering the duration of the breach and the categories of personal data concerned, the level of seriousness of the breach committed by the controller was high. Hence, the DPA fined the controller €18,000 for failing to process personal data securely, in violation of Articles 5(1)(f) GDPR and Article 32(1)(b) and (d) GDPR.