Agenzia delle Entrate – €40,000 Fine (Italy, 2024)

The data subject filed a complaint before the DPA against the Italian tax authority, Agenzia delle Entrate, the controller. The controller notified two third parties, two private individuals, about the seizure of the data subject's property. These third parties entered, several years prior, a rent contract with the data subject, which was then terminated. The data subject alleged that, when the controller notified the third party of the two seizures, there was no existing legal relationship between the data subject and the third parties, as their renting contract had previously terminated. Thus, the data subject claimed that such notice of the two seizures constituted unlawful disclosure of personal data to third parties. The DPA considered that, under Article 5(1)(a) and (d) GDPR, the principles of lawfulness and storage limitation require that all personal data processing needs to be correct and up to date. The DPA established that the controller processes such data for tax collection purposes indicates that the relevant legal basis is Article 6(1)(a) GDPR, namely the necessity for the performance of a task carried out in the public interest. Moreover, as per [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig Article 2-ter, para 4, of the] [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig Italian Privacy Code], clarifies that the term “communication” means that “one or more third party shares knowledge about the data subject’s personal data”. Such communication, to fall within the scope of Article 6 GDPR, shall be provided by law or regulation or general administrative acts. In light of this, to be able to ensure lawfulness and transparency of the processing, the controller shall have to put into place technical and organizational measures, as per Article 24 GDPR. The DPA found that the controller unlawfully communicated to the third parties personal data of the data subject