Istituto nazionale della previdenza sociale – €20,000 Fine (Italy, 2024)

The National Social Security Institute of Italy (Istituto Nazionale della Previdenza Sociale – INPS) intended to hire public servants through a public competition. For the purposes of this competition, it published on its website the rankings of the candidates, both the one that successfully passed the competition and also the excluded one. This ranking showed the name and surname of more than 5000 candidates and their score. Moreover, also other documents were published online, such as the schedule of the oral test. One of the participants filed a complaint with the DPA. He argued that the controller had published his personal data on the website without an adequate legal basis. Following the DPA’s request, the controller removed those documents from its website. The controller presented several arguments to support the lawfulness of its processing. Firstly, it pointed out that the publication of the list of the candidates who had been successfully admitted to the oral stage of the competition was a legal obligation, as the call for competition provided for it. Secondly, it highlighted the fact that the applicants had given their consent for the processing of personal data while filling in the application form. Moreover, the controller stressed the fact that, according to [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=2&atto.articolo.sottoArticolo=3&atto.articolo.sottoArticolo1=0&qId=&tabID=0.767966568760458&title=lbl.dettaglioAtto Article 2-ter of the Italian Data Protection Code], the legal basis for the processing can be found not only on a legislative act, but also on an administrative act of general applicability, such as a call for competition. Additionally, it argued that it had a legitimate interest in this processing as per Article 6(1)(f) GDPR. Firstly, the DPA observed that the relevant legal basis for the processing of personal data by a public authority are the ones provided for by Article 6(1)(c) and 6(1)(e) GDPR. The DPA points out that, in these cases, the public authority must comply with Article 6(3) GDPR: the processing must be based on EU or Member State law. This piece of legislation shall meet an objective of public interest and be proportionate to the legitimate aim pursued. Moreover, the processing shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Secondly, the DPA observed that the Italian law only provides for the publication of the final ranking. Therefore, only the publication of the names of the candidates who win the competition can be seen as a legal obligation. On the other hand, it does not prescribe the publication of other documents, such as the list of the non-admitted applicants. The DPA points out that, generally speaking, a provision contained in a call for competition can constitute a “legal obligation” under Article 6(1)(c) GDPR, as provided for by [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=2&atto.articolo.sottoArticolo=3&atto.articolo.sottoArticolo1=0&qId=&tabID=0.767966568760458&title=lbl.dettaglioAtto Article 2-ter of the Italian Data Protection Code]. However, the DPA clarified that an administrative act has to comply the law, as the latter is hierarchically superior than the former. For this reason, the DPA found that the call for competition could not broaden the list of documents subject to a publishing obligation, as it had already been set by the law (for example, by [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2013-04-05&atto.codiceRedazionale=13G00076&atto.articolo.numero=19&atto.articolo.sottoArticolo=1&atto.articolo.sottoArticolo1=0&qId=&tabID=0.5274929723695413&title=lbl.dettaglioAtto Article 19 of the legislative decree 33/2013]). Therefore, it was not able to provide a lawful legal basis as per Article 6(1)(c) GDPR. Thirdly, the DPA stated that the controller’s reference to consent as a legal basis was irrelevant. It pointed out that, in this case, consent cannot be used as a legal basis because the relationship between the data subject and the controller is strongly unbalanced. Moreover, the DPA pointed out that the controller cannot rely on the legitimate interest as a legal basis, as Article 6(1) GDPR explicitly states that Article 6(1)(f) GDPR does not apply to the processing carried out by public authorities in the performance of their tasks. On these grounds, the DPA held that the controller had violated Article 5 and 6 GDPR and [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=2&atto.articolo.sottoArticolo=3&atto.articolo.sottoArticolo1=0&qId=&tabID=0.767966568760458&title=lbl.dettaglioAtto Article 2-ter of the Italian Data Protection Code] and imposed a fine of €20,000.