DPA case 10076481 – Complaint Upheld (Italy, 2024)

The father of the data subject, a child who is below 14, shared a picture of them on Facebook. The aim of this post was to show how the data subject resembled to their step-sibling, who was also in the picture. The mother of the data subject, who is divorced from the father, formally requested the father to remove the picture from Facebook, believing that this processing was unlawful. Since this did not happen, the mother filed a complaint with the Italian DPA (Garante per la protezione dei dati personali). The father argued that he had the right to publish that picture online, since the custody of the data subject is shared between the two parents. Moreover, he pointed out that the child is smiling with his eyes closed, and therefore there is no data protection violation. The mother argued that, according to consistent national case law, the online publication of minors' pictures is an act that goes beyond the "normal administration". Therefore, pursuant to [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:codice.civile:1942-03-16;262 Article 320(1) of the Italian civil code] (Codice civile - c.c.), the consent of both parents was needed. First, the DPA noted that, implementing Article 8(1) GDPR, [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=2018-11-04~art2quinquies Article 2-quinquies(1) of the Italian Data Protection Code] (D.lgs. 196/2003) has set the age for autonomous consent of a child at 14 years old. However, the DPA noted that the data subject at hand was not 14 yet. Therefore, the DPA considered that, given that the child was younger than 14 years old, the consent of both parents was needed for posting that picture. Secondly, the DPA agreed with the mother's argument and pointed out that consistent case law of Italian courts states that the consent of both parents is needed in order to lawfully share pictures of children online. For the purpose of sharing pictures of the child, it is irrelevant the p