David S.r.l. – €8,000 Fine (Italy, 2024)

A data subject who was filmed during an aesthetic medicine procedure in the Dvora Aesthetic Center, the controller, filed a complaint with the Italian DPA claiming an unlawful dissemination of his personal data on the Instagram account of the controller. In response to the complaint, the controller presented evidence that the data subject provided a tacit consent for the processing and publication of their data and images on social networks. However, the data subject argued that he did not consent to filming of a video in which his face would be recognizable together with his enlarged pores which, he argues, relate to his health status. Article 9(2)(a) says that processing of special categories of personal data, also called sensitive data, may take place only is data subject has given explicit consent to the processing for specified purposes. In this case, the data subject claims that filming of his enlarged pores during the aesthetic procedure was unlawful since he has not provided required explicit consent under the above mentioned Article. Considering the findings, the Italian DPA clarified that the sensitive nature of a piece of information must also be assessed in relation to the context of reference. Even though there is no explicit reference made to the pathology possibly suffered by the data subject, the DPA considered recording the facial imperfections of the data subject as health data because the controller claimed to carry out a "non-surgical rhinoplasty", a procedure relating to a health status of a person. For this reason, the so-called "tacit" consent of the data subject cannot be considered validly given because the processing falls under the exceptions to the prohibition of the processing of sensitive categories of data under Article 9(2)(a) GDPR provided that they can be processed only on the basis of an explicit consent of the data subject. Therefore, even though the data subject was aware of filming of the health service they were undergoing, such circumstance does not amount to having acquired from the data subject an informed, specific and explicit consent as to how the data subjected to the same recording would be processed and, in the present case, even disseminated on a social channel. Additionally, the controller provided information to the data subject that was inadequate and lacked the essential elements referred to in Article 13 GDPR. For these reasons, the processing of personal data carried out by the controller is in violation of Articles 5(1)(a), Article 6, Article 9, Article 12 and Article 13 GDPR. The Italian DPA ordered the controller to bring processing operations into conformity with the provisions of GDPR and imposed a fine of €8,000 on the controller.