Reti Televisive Italiane S.p.a. – Complaint Upheld (Italy, 2023)

A data subject filed a complaint with the Italian DPA, under Article 77 GDPR, asserting the violation of her right to be forgotten. The complaint revolved around an episode of an Italian satirical TV show called "Striscia la notizia" that repeatedly aired a video featuring explicit jokes between the data subject and then-Prime Minister Silvio Berlusconi during a 2013 public event. The data subject initiated a request for the deletion of her personal data to R.T.I. Reti Televisive Italiane S.p.a. (R.T.I. S.p.a.) and Mediaset S.p.a. on 17 May 2021. The request, based on the right to erasure of Article 17 GDPR, aimed to address the persistence of the video online. The video, however, continued to be accessible online, prompting the complainant's further interventions. On 29 July 2022, R.T.I. S.p.a. (the controller) sent a note pointing out that other media outlets had disseminated the content in line with journalistic processing provisions under [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Articles 136-139 of the Italian Codice Privacy] and that the complainant's failure to receive a response was due to her sending the request to the wrong office. Moreover, it confirmed it eventually blocked the video and to have deleted from its databases the image of the data subject. The DPA considered the journalistic context and deemed the publication in question compatible with the provisions on data processing in the context of journalistic activity. However, taking into account the explicit content of the video and the temporal distance from the events, it examined the case under Article 17 GDPR. Referring by analogy [https://edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf par. 52-55 and par. 57 of the Guidelines on the right of access by the EDPB], the DPA addressed the fact raised by the controller; that the complainant sent her request to the wrong office. The DPA noted that the Guidelines state that no particular requirement is needed in choosing the communication channel for data subject requests. On the basis of the facts of the proceedings, the DPA stated that even though the complainant did not submit her request via the communication channel mentioned in the privacy notice, she had still submitted her request via a lawful and active channel, namely the official email address of the controller. Therefore, the complainant's request met the requirements of an application made pursuant to Article 17 GDPR, and the controller should have given a response, in line with Article 12 GDPR. The DPA acknowledged the controller's removal measures in response to the complainant's requests. However, the DPA issued a warning to the controller regarding the necessity to ensure the exercise of data subject rights under Articles 15-22 GDPR, emphasising the importance of responding within the specified timeframe, as outlined in Article 12 GDPR, also to communication channels different from those mentioned in the privacy notice, as provided by Article 13 GDPR.