Azienda Unità Sanitaria Locale della Romagna – €24,000 Fine (Italy, 2024)

The data subject submitted an application to the local health authority in order to acquire the status of a disabled person as she is HIV positive. After acquiring this status, according to Italian national law, a family member of the person is entitled to take some days off from their job to take care of the disabled person. Therefore, the son-in-law of the data subject, who worked for the Ministry of Justice in a jail, applied for these days off to his employer. After that, the employer directly contacted the health authority (controller) in order to confirm that the data subject had obtained the status of a disabled person. The controller sent the Ministry of Justice the whole certificate regarding the disabled status of the data subject, including the part containing the HIV-diagnosis. The data subject filed a complaint with the DPA, arguing that transferring the whole certificate to her son-in-law’s employer was unlawful. The controller argued that this transfer happened due to human error during a time in which a lot of employees were not working due to a Covid infection. First of all, the DPA noted that, according to Article 9(1) GDPR, processing personal data concerning health is in principle forbidden. The DPA noted that Article 9(2)(h) GDPR introduces an exception to this prohibition when processing is necessary to provide healthcare. However, [https://www.normattiva.it/atto/caricaDettaglioAtto?atto.dataPubblicazioneGazzetta=2003-07-29&atto.codiceRedazionale=003G0218&atto.articolo.numero=75&atto.articolo.sottoArticolo=1&atto.articolo.sottoArticolo1=0&qId=&tabID=0.6057766027491261&title=lbl.dettaglioAtto Article 75 of the Italian Data Protection Code] sets further conditions with regard to the processing of data concerning health in accordance with Article 9(4) GDPR which gives the member state such an option. These further conditions can be contained in sectorial legislation, such as [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1990-06-05;135 Law 135/1990], which imposes that information relating to a HIV diagnosis can be revealed only to the data subject. Secondly, the DPA pointed out that according to national law, employers who are public administrations have a duty to verify if the declarations made by their employees correspond to truth. However, the DPA held that this duty must be interpreted in light of the general principles set by Article 5 GDPR and, more specifically, of the principles of data minimisation and of integrity and security. As for the principle of data minimisation, it recalled that, in the case at hand, it was not necessary to disclose the HIV diagnosis to the Ministry of Justice, as just knowing that the certificate had been issued could have been sufficient to ensure the truthfulness of the declaration. Therefore, it found a violation of Article 5(1)(c) GDPR. The DPA also held that the controller did not implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk since it should have provided its employees with more specific instructions on how to act when dealing with HIV data. Therefore, it found a violation of Article 5(1)(f) and 32(1) GDPR. On these grounds, the DPA issued a fine of €24,000.