The online publication of documents related to union elections, including identity documents, constitutes an unlawful disclosure of personal data in the absence of a specific legal basis provided by a legislative norm, a collective agreement not being sufficient to create one.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) published a sanction decision against the Istituto di Istruzione Superiore Della Corte Vanvitelli for breaches related to the online disclosure of personal data of candidates in union elections.

The case began with a complaint from two individuals concerning the publication on the institution's website, in the union notice board section, of their candidacy forms and identity documents, thus making their union membership public.

Grounds for the decision

The authority found a single infringement encompassing several GDPR violations.

• Lawfulness of processing obligation (Articles 5(1)(a), 6 and 9 of the GDPR): The authority found that the institution had published on its website documents related to the election of the unitary union representation, accessible to all. These documents contained the name, place and date of birth, residential address, signature, as well as copies of the candidates' identity documents, thereby revealing their union membership. The Garante recalled that data processing by a public body must be based on a legal obligation or the performance of a task carried out in the public interest, pursuant to Articles 6(1)(c) and (e) of the GDPR. Disclosure of data, in particular, requires a specific legal basis in national law (Article 2-ter of the Italian Data Protection Code). However, no legal provision authorizes the online publication, accessible to an undifferentiated public, of such documents. The authority rejected the argument that a collective agreement could constitute a sufficient legal basis, recalling that, pursuant to Recital 41 of the GDPR and its consistent case law, such an agreement cannot introduce a new processing not provided for by law. The institution's responsibility was upheld, although the publication was due to a "material error" by an employee, the controller remaining responsible for supervising persons acting under its authority.

Authority's decision

Consequently, the authority imposed a sanction against the Istituto di Istruzione Superiore Della Corte Vanvitelli.

Lessons learned

This decision reminds that:

• The disclosure of personal data by a public entity, especially when it concerns sensitive data such as union membership, must imperatively be based on a clear and specific legal basis stemming from a legislative or regulatory norm.
• A collective labor agreement cannot constitute an autonomous legal basis to justify data processing, including its disclosure, if it is not provided for by a higher-ranking legal provision.
• The controller is held responsible for violations committed by its employees, even in cases of error or individual initiative exceeding given instructions, which underlines the importance of supervision and training of authorized personnel.