DPA case 9855545 – Complaint Upheld (Italy, 2022)

In this case the data subject, an Italian doctor, made critical statements regarding certain obligations of the covid-19 vaccine laws. The Rome Provincial Order of Surgeons and Dentists (the Order) notified him of a summons to obtain preliminary information against him, with a possible view to opening disciplinary procedures. Thereafter, the President of the Order, during a TV appearance, publicly disclosed details of the actions being taken against the data subject. Furthermore, the Order published a press release on its website, also disclosing the action being taken against the doctor. The data subject filed a complaint with the Italian data protection authority, arguing that his data had been unlawfully processed and the disclosure of the information in this way violated his rights under the GDPR. In submissions responding to the complaint, the Order sought to emphasise extensively the dangerous and unscientific nature of the comments made by the complainant. The controller made two arguments in its defence, firstly, that the subject had already made the information public himself, including a reference to the summons he received. Therefore, he had already, by his own volition, given direct and unconditional consent to the disclosure of the personal data being processed. Secondly, the communication of the information by the Order was a necessary action for the protection of public health, threatened by the serious, dangerous, and unscientific positions of the complainant. Issuing its decision, the Italian DPA addressed the two arguments put forward by the controller. Concerning the first argument (the data subject had already made the information public), without prejudice to any disclosure or statements made by the data subject, public entities such as the order may only disclose personal data where permitted by the legal framework of reference. In this regard, Italian law provides only for the processing, by means of an entry into the register, of the exist