DPA case 9347280 – Violation Found (Italy, 2020)

The Council of State requested, pursuant to art. 4 of Decree-Law no. 28/2020, the opinion of the DPA on a draft presidential decree containing the technical-operational rules to manage oral discussion in the context of administrative proceedings through an online system (i.e. Microsoft Teams) from May 30 to July 31, 2020. However, the DPA is concerned about using a private platform that can be subject to the US CLOUD Act requirements. Notwithstanding that the Council of State clarified that in the absence of the recording of the hearings and the exchange of messages on internal chat (which are not included in the decree scheme), the videoconferencing provider would not acquire any personal data outside the "metadata" of the videoconference. Furthermore, Annex 1 of the draft decree covers how to access to the electronic file and consultation of data identifying outstanding cases. The Italian DPA gave a favourable opinion on the measures provided by the draft decree. Notwithstanding that the Council of State clarified that the third-party provider would not acquire any personal data outside the videoconference metadata if the hearing and the messages on internal chat (which are not allowed in the draft decree) are not recorded, the DPA has strongly recommended to use an IT infrastructure that is managed by the public administration at a national level, once the emergency is over.