DPA case 9582723 – Violation Found (Italy, 2021)

A committee, made up of families, school professionals and students active in civil society, has submitted requests for generalised civic access - pursuant to art. 5, paragraph 2, of Legislative Decree n. 33/2013 - to several schools in the province of Modena aimed at obtaining data about COVID-19 report that are sent weekly by the schools to the Health Surveillance System. ls of the Province of Modena to the Health Surveillance system (e.g. number of cases of quarantine, number of cases with positive or negative results, number of classes in preventive quarantine). Many schools rejected the request, claiming that although no identity data are required, such information is likely to lead to the identification of the students and their health status. Therefore, the committee asked the Officer of transparency and corruption prevention of Emilia-Romagna for assessing the claim. Then, the Officer asked for the advisory opinion of the Italian DPA. The Italian DPA agrees with the considerations of the schools. In fact, the display of all the information requested, even if deprived of the directly identifiable data of the data subject, when combined with verbal information that can be easily acquired, especially in small schools, may enable the identification of the data subjects. According to the DPA, combining the requested data with other information got by third parties might allow the indirect identification of the minor pupils at stake, with disclosure to the general public of his state of health or other sensitive data concerning their possible state of quarantine/isolation. Furthermore, definitive data is processed by the health monitoring bodies and not by schools. Consequently, the requested information may be incomplete or inaccurate; and the relative communication or dissemination could be in contrast with the principle of data accuracy, enshrined in art. 5(1)(d) of the GDPR.