Comune di Brescia – €10,000 Fine (Italy, 2024)

The DPA started an ex officio investigation, after a large journalist investigation was published, against a municipality, the controller. The investigation concerned the practice of the municipal cemetery of burying “fetuses” and “stillborn children”. Each of the tombstones contains the same first name (which is a name traditionally assigned to stillborn children in Italian Catholic tradition), and different surnames, which correspond to the surname of the data subjects, who are the women who interrupted their pregnancy and the men who these women conceived the fetus with. The DPA found that, in the vast majority of cases, these data subjects did not know about the burial site and of the use of their surnames. Additionally, the preliminary investigation of the DPA revealed that, in the online portal of the cemetery, it was possible to find the precise location of each tombstone by typing in the name and surname thereon written. The data available through this online research was name, surname, date of birth and death, as well as the specification of their status of “fetuses” or “stillborn child”. Applicability of the GDPR and Violation of Article 6 GDPR and Article 9 GDPR The DPA starts by considering that, in respect to the burial of fetuses, Article 7 of the Mortuary Police Regulation differentiates three different cases: * “stillborn children”, who must be buried; * “products of interrupted pregnancies”, aged 20-28 weeks, who must be buried either at their parents’ request, or the health facility’s request; * “products of conception”, aged less than 20 weeks, who can be buried only at their parents’ request. The DPA considered that the subject of the investigation concerned the personal data disclosures that related to the products of interrupted pregnancies and products of conception, for which the relatives did not request burial nor indicated to put their data on the gravestone. The DPA found that the indication of the data subjects’ surnames, together with the data of birth and death of the products of interrupted pregnancies and products of conception allows the identification of the data subjects, as defined in Article 4(1) GDPR. The risk of identification in this case is high, considering that the data reported on burials and made available on the online consultation service, can be compared or cross-referenced with other sources, or with contextual information held by third parties in the community or family context. Consequently, the data processed is personal data. The controller did not have a lawful legal basis for such processing. This unlawful processing is of particular gravity if considered that the processing concerned health data, as defined in Article 4(15) GDPR. Thus the DPA found a violation of Article 6 GDPR and Article 9 GDPR. Controllership Once it has been determined that the GDPR is applicable and that unlawful processing happened, the DPA considered that, since the activities of cemetery services are among the tasks of public interest specifically attributed to the municipality by law, the latter plays the role of data controller in relation to the processing of personal data connected with the performance of those tasks. Violation of Article 5(a), (b), (C), (d) and (2) GDPR Consequently, the controller is subject to the principle of accountability, as per Article 5(2) GDPR, and of privacy by design and by default, as per Article 24 GDPR. Thus, the DPA considered that, when the municipality receives documentation with personal data from the health company, it is required to process the data in compliance with the aforementioned principles. Additionally, the controller is subject to the principles of lawfulness, correctness and transparency, purpose limitation, data minimisation and accuracy, as per Article 5(1)(a), (b), (c) and (d) GDPR. In relation to each of the mentioned principles, the DPA found the following: The principle of accountability, as per Article 5(2) GDPR and of privacy by design and by default, as per Article 24 GDPR were breached as the municipality is not exempted from the need to carry out its own assessment on the data it receives from health authorities and facilities. The principle of lawfulness, correctness and transparency, as per Article 5(1)(a) GDPR was breached due to the lack of legal basis for the processing. The principle of purpose limitation, as per Article 5(1)(b) GDPR was breached as there is no specific and legitimate purpose to the data processing. The principle of data minimisation, as per Article 5(1)(c) GDPR was breached as less-intrusive measures, as marking the burials with a simple code, are available. The principle of accuracy, as per Article 5(1)(d) GDPR was breached as the data subjects’ surnames are not data related to the deceased. Thus the DPA found a violation of Article 5(a), (b), (C), (d) and (2) GDPR. Conclusion and Fine Thus the DPA found a violation of Article 5 GDPR, Article 6 GDPR and Article 9 GDPR. The DPA deemed it appropriate to fine the controller €10,000.