DPA case 9873031 – Violation Found (Italy, 2023)

The Italian DPA opened a procedure concerning a newspaper publishing photographs of data subjects involved in police investigations. More specifically, these pictures were originally taken within police offices and for police purposes. The controller immediately removed the contents from its website and stated that it was not aware of the true nature of the images. The controller also claimed to have processed those data for journalistic purposes. The DPA stated that journalists can disseminate personal data to the public without data subjects’ consent, provided that the principle of essentiality of information is respected. These considerations apply also to criminal proceedings. However, personal data processed by the controller in the present case were mugshots, namely pictures taken exclusively for police purposes. The DPA claimed that the spread of such images by police officers was unlawful in itself. As a consequence, processing of these personal data by a newspaper could not be considered in compliance with the GDPR. The DPA also held that the mere lack of identification numbers on the pictures did not reduce the potential risks for data subjects’ rights, as the pictures were published contextually to the data subjects’ arrest. In light of the above, the DPA found a violation of Article 5(1)(a) GDPR and adopted a ban on further processing operations pursuant to Article 58(2)(f) GDPR. However, the DPA held that the adoption of a fine was not necessary and only issued a reprimand to the controller (Article 58(2)(b) GDPR).