DPA case 10021491 – Complaint Upheld (Italy, 2024)

An employee (the data subject) of the Ministry of Justice (the controller) offered paid sex on a dating website. His colleagues found his ads, which included pictures, contact information, and a pseudonym. They informed their superiors who, in turn, informed the Ministry. The Ministry carried out a disciplinary investigation and found that the worker committed no disciplinary infringement. The worker filed a complaint with the Italian DPA and claimed that the Ministry unlawfully processed data concerning his sex life and sexual orientation during the investigation. The Ministry claimed that the processing was lawful under Italian labor law and that it was based on a legal obligation[https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2001;165~art55septies Article 55-sexies d.lgs. 165/2001] for public administrations to investigate potential disciplinary infractions. The Ministry also observed that the data were made publicly available on the Internet by the worker himself. Under Italian labor lawUnder Article 88 GDPR, Member States can provide for more specific rules on the processing of employees' personal data in the context of employment. The authority held that [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1970-05-20;300!vig= Article 8 l. 300/1970] and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003;276 Article 10 d.lgs. 276/2003] were relevant to the case at hand. an employer may only investigate an employee's personal life if the information is relevant to the job. The authority held that the Ministry violated the law because the data subject's sex life was not relevant to his tasks as an employee. The authority also rejected the other arguments from the Ministry. The authority considered it irrelevant that the data were made publicly available on the Internet by the data subject himself and held that the Ministry still needed a legal basis to process them. The authority also observed that the