Istituto Statale "Duca degli Abruzzi" – Complaint Upheld (Italy, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Istituto Statale 'Duca degli Abruzzi' faced a complaint for sharing a health certificate without proper authorization. This is important because it shows that organizations must handle personal health information carefully. Schools and similar institutions should be vigilant about privacy when dealing with sensitive data.
What happened
The school unlawfully shared a health certificate without proper authorization.
Who was affected
Students whose health information was shared without consent were affected.
What the authority found
The Garante upheld the complaint, highlighting the need for lawful processing of health data under GDPR.
Why this matters
This ruling serves as a warning to educational institutions about the importance of protecting personal health information. It underscores the need for clear policies on data sharing.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The father of the data subject filed a complaint with the DPA against the school attended by his son (the controller). He complained that a teacher had unlawfully sent to the other students and their parents a certificate issued by the health authority stating that the data subject had been tested positive for Covid-19. The controller argued that it was not aware of this incident and that, after becoming aware, it had started a disciplinary procedure against the teacher. Moreover, it highlighted that this incident did not have any negative consequence on the data subject and that the certificate was only sent to a closed group of members of the school community. Finally, it pointed out that the teacher was undergoing a really stressful time due to the spreading of Covid-19. First of all, the DPA noted that a public authority is allowed to process personal data under the legal bases provided for by Article 6(1)(c) and 6(1)(e) GDPR. Moreover, the national law implementing Article 6(2) GDPR, [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter(1)] and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter 2-ter(3) of the Italian Data Protection Code], states that public administration might “disseminate” or “communicate” personal data to third parties only when a piece of legislation authorises to do so. Secondly, the DPA noted that the definition of “communication” set by [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter(4)(a) of the Italian Data Protection Code] does not require that personal data is shared with an undetermined amount of people. On the contrary, just sharing the certificate with a closed group of students is enough to fall into the scope of this definition. Therefore, it found a violation of Article 5(1)(a) and 6 GDPR and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter of the Italian Data Protection Code]. Thirdly, it pointed out that informatio
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Istituto Statale "Duca degli Abruzzi" in IT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Istituto Statale "Duca degli Abruzzi" - Italy (2024). Retrieved from cookiefines.eu
Last updated: