Comune di Verona – €10,000 Fine (Italy, 2024)

The data subject is an employee of the Municipality of Verona (the controller). Via email, the data subject requested the controller to provide him with a new FFP2 mask and mentioned his health conditions in this message. When a municipal officer replied to the email, they cc'd the email account of the controller's warehouse. This email address was shared among 6 other employees. In this response, the officer mentioned the fact that the data subject suffered from certain illnesses and referenced to the Italian law regulating disability benefits ([https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1992-02-05;104 Law 104/1992 - Legge 104/1992]), implying that the data subject was entitled to them. Believing that sharing this data with other employees of the controller was unlawful, the data subject filed a complaint with the DPA. The controller argued that it had referenced to the Law 104 only in a generic way, not specifically stating that it applied to the data subject. Moreover, it pointed out that after realizing the mistake, its officer sent subsequent communications only to the data subject. First, the DPA pointed out that referring to the Italian Law 104/1992, notoriously known in Italy for entitling to disability benefits, combined with the reference to the fact that data subject was suffering from "illnesses", is enough affirm that the email contained health data as defined by Article 4(15) GDPR. Secondly, the DPA noted that, pursuant to [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=2018-11-04~art2ter Article 2-ter of the Italian Data Protection Code], a public administration can disclose personal data only if a specific piece of legislation authorises it to do so. On this point, the DPA held that, even though the recipients of the email were employees of the controller, this rule however applies. Pursuant to the data minimisation principle, the controller should share personal data among its emplo