Thomas Fero – €10,000 Fine (Italy, 2025)

A medical doctor (the data controller) sent an email to his patients during the municipal elections of June 8-9, 2024. In this email, the controller informed patients about his candidacy as town councillor and asked for their support and votes. The DPA became aware of the controller's actions through a report and news articles and questioned the controller. He stated that he had collected the email addresses directly from patients who had contacted him for medical information or assistance. He also claimed the emails were sent based on explicit consent obtained through an information notice that included "Promotional Activities, Information via Telematic Means, and Newsletter" among the processing purposes. The controller also argued that many email addresses were pseudonyms or fantasy names and, therefore, could not be referred to specific individuals. The controller confirmed that approximately 500 patients received the email. First, the DPA established that patients' email addresseses qualify as personal data and, specifically, health data, since they are contact details of directly or indirectly identifiable patients. The DPA referred to case law, including a recent Court of Justice of the European Union decisionCJEU - C‑21/23 - Lindenapotheke (available here)., confirming that information that can reveal a connection between a person and healthcare services constitutes health data under the GDPR. Second, the DPA determined that the controller lacked a valid legal basis for processing these data for electoral purposes. The consent obtained from patients was not valid for electoral propaganda because this specific purpose was not explicitly mentioned in the information notice provided to patients. The DPA also rejected the controller's claim that electoral messages could be considered equivalent to "newsletters" or "promotional activities" mentioned in the consent form and noted that, according to the Medical Code of Ethics, medical advertising can only concern