Istituto Statale "Duca degli Abruzzi" – Complaint Upheld (Italy, 2024)

The father of the data subject filed a complaint with the DPA against the school attended by his son (the controller). He complained that a teacher had unlawfully sent to the other students and their parents a certificate issued by the health authority stating that the data subject had been tested positive for Covid-19. The controller argued that it was not aware of this incident and that, after becoming aware, it had started a disciplinary procedure against the teacher. Moreover, it highlighted that this incident did not have any negative consequence on the data subject and that the certificate was only sent to a closed group of members of the school community. Finally, it pointed out that the teacher was undergoing a really stressful time due to the spreading of Covid-19. First of all, the DPA noted that a public authority is allowed to process personal data under the legal bases provided for by Article 6(1)(c) and 6(1)(e) GDPR. Moreover, the national law implementing Article 6(2) GDPR, [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter(1)] and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter 2-ter(3) of the Italian Data Protection Code], states that public administration might “disseminate” or “communicate” personal data to third parties only when a piece of legislation authorises to do so. Secondly, the DPA noted that the definition of “communication” set by [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter(4)(a) of the Italian Data Protection Code] does not require that personal data is shared with an undetermined amount of people. On the contrary, just sharing the certificate with a closed group of students is enough to fall into the scope of this definition. Therefore, it found a violation of Article 5(1)(a) and 6 GDPR and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2ter Article 2-ter of the Italian Data Protection Code]. Thirdly, it pointed out that information relating to a Covid-19 diagnosis is data concerning health under Article 9 GDPR. It recalled that this kind of data can be processed only if an exception under Article 9(2) GDPR is applicable. In particular, Article 9(2)(g) GDPR allows processing of personal data for reasons of substantial public interest if it happens on the basis of EU or Member State law. However, the implementing national law, [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2sexies Article 2-sexies of the Italian Data Protection Code], does not allow such a “communication”. Therefore, it found a violation of Article 9 GDPR and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:::2003;196~art2sexies Article 2-sexies of the Italian Data Protection Code]. On these grounds, it issued a reprimand to the controller.