Editoriale Argo S.r.l. – Complaint Upheld (Italy, 2023)

A data subject lodged a complaint with the Italian DPA against Editoriale Argo S.r.l. (the controller), the publisher of the newspaper "CronacaQui." The complaint pertained to the publication of an article reporting a robbery at the data subject's residence. The newspaper, in both its print and online versions, disclosed extensive personal details about the data subject, including her name, photograph, street address, and information about her family. Despite the data subject's opposition and request to remove the identifying details, the online version was only partially modified, and the data subject was still indirectly identifiable. Thus, the data subject contacted the controller requesting the remaining details to also be deleted, which the controller refused. In light of this, the data subject claimed to the DPA that the disclosure violated, in particular, the principles of lawfulness of processing enshrined in Article 5(1)(a) GDPR and of data minimisation, as outlined in Article 5(1)(c) GDPR. Considering the facts of the case, the Italian DPA noted that data processing carried out for journalistic purposes can be considered lawful, also when carried out without the consent of the data subject, provided that it complies with the rights, fundamental freedoms and dignity of the data subject, pursuant to [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Articles 136 and 102(2)(a) of the Italian Privacy Code.] The articles, indeed, mandate that also in situations of journalistic purposes the rules of fairness and non-discrimination should be observed when communicating or disseminating personal data. Specifically, the DPA acknowledged, as mentioned by the controller, that [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9042678 Article 137 of the Italian Privacy Code], which pertains to the processing of data for journalistic purposes, applied, as the information had public importance due to frequent thefts in the area. However, the DPA observed that the published information was not only excessive for understanding the news but also increased the risks to the data subject and her family, including the daughter, who was a minor. As it is reflected also in [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9067692 Article 6 of the Ethics Rules for Journalistic Conduct], the DPA emphasised that journalistic processing, while allowed, should adhere to the principles of essentiality and respect for the dignity of individuals, especially victims of crimes. The DPA also emphasised that according to [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9067692 Article 7 of the Ethics Rules for Journalistic Conduct], victims, especially minors, should be granted specific protection, and the data controller's actions created unwarranted risks for the data subject and her family. Lastly, considering the present was the controller's first violation, the DPA reprimanded the controller and banned further processing of the personal data in question online under Article 58(2)(f) GDPR.