Comune di Forlì – €15,000 Fine (Italy, 2024)

The controller is an Italian municipality which decided to implement a mobile application. This application was made available on app stores between December 2020 and January 2021. It allowed citizens to send notifications to the Local Police about unsafe areas. After getting this notification, the Police could use the video surveillance system to monitor the area. Therefore, personal data of both the person who made the report and the people recorded by the camera were collected. The software collected the phone number of the reporting person and the location data. The former was then stored for 7 days, allowing the Police to contact the person to get more details about the incident. After 7 days, only location data was kept in an anonymised way. The controller decided not to manage this app on itself, but to outsource the development and the management of both the app and the video surveillance system to a company which is owned by the municipality. The application was temporarily deactivated from April to June 2022. On 11 July 2022 it was permanently deactivated, after the DPA started an investigation on the matter. Firstly, the DPA pointed out that the controller made the application available on app stores even though it was still in a beta version and, therefore, had not been completely tested yet. Moreover, the controller kept using the app even though the DPO had warned it about the data protection pitfalls of this processing. In addition, the DPA highlighted that, in the first release of the app, users could freely make a report, without the situations that could potentially be the subject of a report being predetermined. In the second release, the controller added a predefined list of categories to classify the report. However, users were still able to send a report of an “undefined” type. The DPA noted that this could lead to the collection of non-necessary data or data falling under Articles 9 or 10 GDPR. Moreover, it was also possible to make a report about domestic violence or bullying incidents, matters that exceeded the controller's law enforcement competences under national law. Therefore, the DPA found a violation of Articles 5(2) and 25 GDPR, as the controller did not, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate measures to ensure that the GDPR was complied with. Secondly, the DPA noted that the controller published on its website a privacy policy about this specific processing only on 22 April 2022, while in the period between that day and December 2022 no privacy policy was available. The DPA did not uphold the argument of the controller about the fact that a shorter privacy notice had been available on the app itself since April 2022. According to the DPA, this notice was however not compliant with Article 13(2)(a) GDPR as it contained wrong information about the data storage period. Therefore, the DPA found a violation of Articles 5(1)(a), 12(1) and 13 GDPR. Thirdly, the DPA focused on the relationship between the controller and the processor. The DPA noted that the two entities had never signed a written binding agreement, even though the latter was carrying out several processing activities, including the one at stake, on behalf of the controller. Therefore, the DPA found a violation of Article 28(3) and (9) GDPR. Fourthly, the DPA stated that in this case the controller would have needed to carry out a DPIA, since this processing was likely to result in a high risk to the rights and freedoms of natural persons. In particular, the DPA stressed that the processing was a “large scale” processing and involved location data and potentially data relating to criminal convictions under Article 10 GDPR. However, the controller did not carry out such an assessment and, therefore, violated Article 35(1) GDPR. Finally, the DPA noted that the Local Police staff could access the database with a generic password provided by the processor, and not with login credentials linked to a specific person. According to the DPA, this meant that, on the one hand, the controller was unable to identify the specific person who had accessed to data. On the other hand, if the controller had set up different user accounts with varying levels of access, it could have restricted access to only what each user needed for their job. Therefore, the DPA found a violation of Articles 5(1)(f) and 32 GDPR. On these grounds, the DPA issued a fine of €15,000.