Azienda Sanitaria Provinciale di Enna – €8,000 Fine (Italy, 2024)

The Health Agency of Enna, the controller, held a public selection procedure for external lawyers. The applicants, among which the data subject, consented to the processing of their personal data for the purposes of the selection procedure. The results of the selection were published online on a non-indexed web page. The page listed the names of 20 lawyers whose applications were rejected and the reason for the rejection. The data subject contacted the data controller and claimed that his personal data were published without a legal basis. In this context, he also requested the erasure of the data. The controller did not respond to the request. The data subject later filed a complaint with the DPA. The controller erased the data after the data subject filed said complaint. First, the DPA held that the controller violated Article 5 GDPR, Article 6 GDPR, and [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig~art2 Article 2-ter of the Italian Privacy Code (Codice in materia di protezione dei dati personali)] by publishing the names of the rejected lawyers without a legal basis. In this regard, the DPA observed that the data subject’s consent was not freely given and that the publication of the data was not provided for by the law. Second, the DPA held that the data controller violated Article 17 GDPR by failing to respond to the data subject’s erasure request. The DPA fined the data controller €8,000. The DPA noted that public entities should not process personal data on the legal basis of consent due to the power imbalance with the data subjects. Public entities should rely on Article 6(1)(e) GDPR instead (task in the public interest or exercise of official authority).