DPA case 10201426 – Violation Found (Italy, 2025)

A researcher linked to the University of Turin carried out a survey for the purpose of scientific research. The survey was aimed at the residents of a real estate cooperative and was to be compiled on a voluntary basis. Among other questions, residents were asked whether they were blood donors and how they voted in both local and national elections. About ten residents (the data subjects) filled the survey. The data subjects did not provide their name even though the survey asked them to. The data subjects were not provided with a privacy notice. The survey was administered via a Google Form on the researcher's personal Google account. Therefore, the data were available to her alone and were outside the control of the University. An association later filed a report with the DPA, claiming that the data were collected without a legal basis and without providing sufficient information about the processing. At the request of the University, the researcher later erased all the data. On controllership The DPA first examined the roles of the University and the researcher. The researcher who created the form was the recipient of a research grant from the University of Turin and was carrying out her research under the supervision of one of the University’s professors. The University believed that the survey, and the research project as a whole, would not collect personal data. Therefore, the University did not instruct the researcher or the professor on how to process the data. The DPA held that the survey processed personal data, including sensitive data. In the context of this processing, the DPA held that the University was the controller and that both the professor and researcher processed data under the controller’s authority (Article 29 GDPR). The violations The DPA found that the controller did not provide the data subjects with a privacy notice. In particular, the controller did not clarify to the data subjects which legal basis it relied upon for processin