Paolo Meloni – €2,000 Fine (Italy, 2023)

On 5 August 2021, a condominium manager, acting as the controller, sent an email to all condominium members to let them know that a family of residents, the data subjects, had tested positive for Covid-19 and therefore sanitary measures were being taken. On 10 September 2021, the data subjects filed a complaint with the Italian DPA, claiming that the controller violated their right to data protection. In defense, the controller claimed to have learned about the family's health status from the person who cleans the condominium who, in turn, learned from other residents. He argued that the exception to the general prohibition to the processing of health data under Article 9(2)(e) GDPR was applicable as the information had been manifestly made public. In the controller's view, it was the data subjects themselves who disclosed the information to the person who worked inside the building. Therefore, the controller considered that a valid consent was given to the further processing of the data subjects' personal data. In addition, the controller stated that the purpose of the email was to prevent contagion between neighbors, which is a legitimate interest. First, the DPA acknowledged that the controller had processed a special category of personal data by disclosing the data subjects' health status to the condominuim members. According to the DPA, the derogation provided for by Article 9 (2) GDPR was not affected by the emergency legislation related to the Covid-19 pandemic. Therefore, the general prohibition to disclose health data remained intact. Second, as for the claim that the data had already been made public, it stated that the fact that the data subjects have decided to confide their state of health to third parties (a circumstance only declared, but not demonstrated), does not amount to making the data public or consenting to its further processing. Third, the DPA emphasized that, according to the principle of data minimization, the purpose of preventing