DPA case 9592011 – Complaint Upheld (Italy, 2021)

Movimento 5 Stelle (M5S) is a populist political group. Because it is not recognized as a political party under Italian law, it organized its almost 200,000 certified members on the M5S digital platform. The digital platform, owned by Associazione Rousseau, is designed to enable participatory democracy. M5S members used the site to vote on budgetary and leadership decisions, for example. After a political fallout between the leaders of Movimento 5 Stelle (M5S) and the Associazione Rousseau, M5S decided to stop using the Rousseau platform. Thereafter, two members of M5S asked Associazione Rousseau to delete their data, but Associazione Rousseau refused to do so. M5S objected and submitted a complaint to the Italian DPA. M5S claimed that it is the data controller of the M5S digital platform, and that Associazione Rousseau, as the data processor, must comply with Article 28 GDPR by returning all personal data to the data controller. MS5 requested that Associazione Rousseau comply by making the domains of the 'movimento5stelle.it' and 'tirendiconto.it' websites available to M5S and by refraining from any form of processing that is not necessary for the fulfilment of their legal obligations. M5S further demanded that that Associazione Rousseau return the personal data of all M5S members, explain the methods and security requirements it had for collecting and storing data on M5S members, and explain the precise technical procedures it will use for transferring the data in question. The DPA ascertained, based on the documentation provided by M5S, that the Associazione Rousseau does indeed fulfil the role of data processor - even if in certain situations it is an autonomous data processor - and that M5S is the data controller for all purposes. Pursuant to Article 58(2)(d) of the GDPR, the DPA ordered Associazione Rousseau to comply with the provisions of Article 28(3)(g) of the GDPR by ensuring that all the personal data of the M5S members are given to Movimento 5 St