Gennaro Sangiuliano – €150,000 Fine (Italy, 2025)

= In the summer of 2024 Italian media caught wind of a romantic affair between the Minister of Culture and an entrepreneur who was engaged by the Ministry as an external consultant. The case erupted into a political scandal that led to the Minister’s resignation amidst allegations of conflicts of interest. Among others, the scandal was covered by Report, a well-known TV show dedicated to investigative journalism. The show was broadcasted by RAI (Italy’s public broadcaster and the controller for the case). In December 2024 an episode of Report examined rumors that before his resignation, the Minister terminated the consultant’s contracts under undue pressure. As proof of these allegations, the show broadcasted excerpts of a phone conversation between the Minister and his wife. In the conversation, the Minister's wife demanded that her husband terminates all of the consultant’s contracts with the Ministry and warned him that if he had not done so, she would have brought the matter to the attention of the Ministry’s Head of Cabinet. According to other evidence presented by the show, the Minister terminated one of the consultant’s contracts on that very day. = The former Minister and his wife filed separate complaints against the broadcaster, claiming that their private conversation was published illegally. In its defense, the controller claimed that the broadcasting of the recording was lawful and constituted an exercise of the freedom of expression in the context of investigative journalism. In this regard, the controller claimed that Report needed to broadcast the conversation in order to substantiate the rumors that the Minister might have acted under pressure. The controller also claimed that the subject matter of the investigation was of public interest, as it was possible that Minister exercised his powers of Minister under pressure from his wife. During the investigation the DPA found that the conversation between the former Minister and his wife had not been intercepted. Rather, the consultant pressured the former Minister into recording the full conversation and sharing it with her. Eventually an unnamed source provided the recording to the Report staff. The DPA first clarified that Article 137 of the Italian “Privacy Code” is the main point of reference for balancing the protection of personal data against journalistic freedom. Under the Article, the publishing of personal data for journalistic purposes is only allowed under two conditions. First, the subject matter must be of public interest. Second, the processing of personal data must be essential to inform the audience about the matter. In light of applicable professional rulesThe decision references the Code of conduct for processing personal data in the context of a journalistic activity. The Code was officially approved by the DPA and can be found [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9067692 here]., the DPA further clarified that this requirement of essentiality must be interpreted strictly: the processing is only essential to a journalistic activity when it is indispensable to that activity. In the case at hand, the DPA held that the controller failed to demonstrate that broadcasting the recording was essential to the coverage of the subject matter. In this regard, the DPA pointed out that a specific passage from the controller’s submission described the broadcasting as “functional” to the coverage of the scandal. In the DPA’s view, this wording constituted an implicit admission that the broadcasting was not essential to the controller’s journalistic activity. On these grounds, the DPA concluded that the controller processed personal data unlawfully. The DPA also held that because broadcasting the recording was not essential to the journalistic activity, the controller violated the data minimisation principle. Overall, the DPA held that the controller violated Article 5(1)(c) GDPR as well as Articles 2 and 137 of the “Privacy Code”. The DPA issued a €150,000 fine and forbade the controller from further processing the data. In determining the amount, the DPA noted that the controller already committed a violation related to journalistic activitiesGarante, Provv. 10138907 (available [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10138907 here]). Due to the redaction of the decision, it is not known whether the violations were related to Report or to a different show..