Nomodidattica S.r.l. (owner of the Moltocomuni website) – €10,000 Fine (Italy, 2024)

On February 13, 2023, Nomodidattica S.r.l., a company managing the Moltocomuni website, published an article linking to a court judgment from the Tribunal of Vicenza. This judgment, accessible via the link, contained sensitive, unredacted information about minors involved in a legal dispute between two municipalities regarding social assistance costs. The judgment included identifiable information, such as minors' names, places of residence, the care facilities they were placed in, and details of their stays. On June 27, 2023, The Regional Ombudsman for Veneto (an independent public office within the Veneto region of Italy that serves to protect the rights and interests of individuals), reported the publication to Garante, highlighting that the judgment’s full content was available online without any anonymization, violating GDPR and the Italian Data Protection Code, especially considering the minors’ information. On November 9, 2023, Garante contacted the controller to address the issue and they immediately removed the article and the court judgment. The controller argued that the article aligned with journalistic standards, aiming to inform public administration employees on relevant cases. However, they admitted an error in assuming the judgment had already been anonymized by the court. On April 15, 2024, Garante formally notified the controller of potential data protection violations and opened a formal inquiry. The controller provided a formal response, explaining the free-access nature of the website, focused on public sector issues. They reiterated that they intended to inform without directly identifying the minors, but they acknowledged failing to anonymize the linked judgment. Garante ruled that Nomodidattica’s handling of minors’ data was unlawful, breaching principles of lawfulness, fairness, data minimization, and essential anonymization, violating Article 5 GDPR. For this reason, the DPA issued a fine of €10,000 imposed on Nomodidattica S.r.l. under Article 83 GDPR. In its decision, Garante highlighted the violation of several Articles of the [https://www.privacy.it/archivio/privacycode-en.html Italian Data Protection Code], such as Article 50, that prohibits the publication of information that could identify a minor involved in any judicial proceeding, not limited to criminal cases; Article 52(5) determining that when judicial rulings or other legal documents are published, all identifying information regarding minors and certain sensitive parties must be removed; and Article 137(3), requiring that personal data used for journalistic purposes must be limited to what is necessary and must follow the principle of essenzialità dell’informazione (the “essentiality of information” principle). Consequently, the Garante ordered the immediate prohibition of further data processing related to the children, except for preservation for potential judicial use.