Federpol – Court Ruling (Italy, 2026)

Federpol (the controller) is an association of private investigators. In 2021, the DPA fined the controller for distributing a newsletter to all members containing the minutes of a meeting with its executive board. The minutes concerned a case against a member who had sent a defamatory letter. The member was identified by name. The DPA found a violation of Articles 5(1)(a) and (c), and 6(1) GDPR as the controller did not have a legal basis to process the data (including the name of the member in the newsletter). The DPA fined the controller €5,000. In 2022, the controller appealed the decision to the court of Rome. The controller argued that the processing was lawful under legitimate interest, and in any case, contractual obligation. The court dismissed the appeal and ordered the controller to pay the fine. The court considered that the controller could have informed members without naming the data subject. The controller filed an appeal to the Supreme Court. The court dismissed the appeal and upheld the reasoning of the lower court. The court followed the reasoning of the lower court, and stated that the controller could have informed its members of the case without including the data subject’s name. The court considered this processing to be disproportionate in relation to the goal. The court dismissed the controller’s argument that there was a difference between disseminating the information and communicating it to members. The court stated that, while the data subject’s name did not fall under the scope of Article 9 GDPR, the controller needed the consent of the data subject to process their data. Therefore, a resolution adopted by a general meeting or generic consent for statutory purposes did not meet the requirements of consent. The court also dismissed the controller’s argument that the fine was disproportionate. The court held that the DPA had correctly applied and justified the fine in accordance with Article 83(2) GDPR.