Azienda Ospedaliera Complesso Ospedaliero San Giovanni – Addolorata – Complaint Upheld (Italy, 2024)

The data subject is a doctor working for the controller, a hospital. The data subject sent an email to her manager containing personal data about her health in order to justify her absence from work. After that, the manager replied to her and added as a recipient the director general of the hospital. The data subject filed a complaint with the DPA. She argued that forwarding the email to the director general was unlawful under the GDPR. The controller argued that the data subject herself sent an email to her manager containing health data; moreover, it stressed that this data was never disclosed to a third party, but only to a person who was the head of the organisational structure of the controller and needed to know that information to arrange a replacement for the data subject. Furthermore, the controller argued that the email did not contain any data relating to health, since the data subject only stated her symptoms and not an official diagnosis. First, the DPA recalled that, according to Article 6(1)(c) and 6(1)(e) GDPR, public authorities can process personal data if it is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Moreover, the DPA pointed out that an employer can process sensitive data if the processing is necessary for the management of the employment relationship and to fulfill specific obligations or tasks arising from the applicable law, pursuant to Article 9(2)(b) GDPR. Secondly, the DPA held that the information contained in the email was data relating the data subject’s health and, therefore, fell into the scope of Article 9(1) GDPR. The DPA recalled that – according to consistent case law of the CJEU (see C-184/20, Vyriausioji tarnybinės etikos komisija, para. 125; [https://curia.europa.eu/juris/document/document.jsf?text=&docid=48382&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=7541263 C-101/01, Lindqvist], paras. 13 and 50) – a broad definition of sensitive data must be adopted, since processing of this type of data is liable to constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data (see C-667/21, Krankenversicherung Nordrhein, para. 41). Moreover, the DPA highlighted that, also according to national case law, even the mere information that an employee is on sick leave is personal data concerning health. Thirdly, the DPA recalled that according to national labour law ([https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2001-05-09&atto.codiceRedazionale=001G0219&atto.articolo.numero=55&atto.articolo.sottoArticolo=7&atto.articolo.sottoArticolo1=0&qId=&tabID=0.3660795968523297&title=lbl.dettaglioAtto Article 55-septies(2) d.lgs. 165/2001]), when an employee is on sick leave, an employer should manage the sick leave certificates only through the platform provided by the social security institute. This platform ensures that the diagnoses is redacted in the version of the certificate provided to the employer. Moreover, it held that if the employee sends to their employer the certificate containing the diagnosis, the employer should not further process that information. In the present case, even though the data subject herself sent this information, the controller should not have further processed and sent the information to other people. More in general, the DPA pointed out that if there is not an exception set by national law implementing Article 9(2)(b) GDPR, an employer cannot collect, neither from the data subject nor from other sources, data concerning its employees’ health. Fourthly, the DPA held that forwarding the whole email to the director general was not necessary for the purpose of finding a replacement for the data subject’s shift, since this purpose could have been reached also by simply circulating the information that the data subject was sick, without including the specific symptoms. Therefore, the DPA found a violation of Article 5(1)(a), 6 and 9(1) GDPR and [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=2&atto.articolo.sottoArticolo=3&atto.articolo.sottoArticolo1=0&qId=&tabID=0.3660795968523297&title=lbl.dettaglioAtto Article 2-ter of the Italian Data Protection Code] and issued a reprimand to the controller.