The online publication of administrative acts containing personal data related to a dispute, beyond legal deadlines and without masking, constitutes a violation of the data minimisation principle, even in the name of transparency.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) has today published a sanction decision against the Municipality of San Nicandro Garganico (including the imposition of a fine of XX €) for breaches related to the dissemination of personal data on its website and the communication of the contact details of its data protection officer.

The case originated from a complaint by an individual concerning the online publication of their personal data in administrative acts of the municipality.

Reasons for the decision

• Data minimisation obligation (Article 5(1)(c) of the GDPR): The authority found that the municipality had published online the complainant's name and information relating to a judicial procedure concerning them in a municipal council resolution and an administrative determination. This dissemination was deemed non-compliant with the minimisation principle, as the data were not limited to what was necessary. The authority recalled, referring to its Guidelines no. 243 of 15/5/2014, that the existence of a publication obligation does not exempt from the obligation to select data and mask irrelevant information, such as the names of parties in a dispute, with the case file number being sufficient.
• Lawfulness of processing obligation (Article 5(1)(a) and Article 6 of the GDPR): The retention of documents on the website beyond the legal publication period of fifteen days, provided by national legislation for the official notice board, was considered unlawful dissemination. The authority considered that in the absence of a legal basis justifying this online retention in a non-anonymised form after the expiry of this period, the processing was contrary to the lawfulness principles.
• Obligation to communicate the contact details of the data protection officer (Article 37(7) of the GDPR): The authority noted that the municipality had not communicated the updated contact details of its data protection officer (DPO) via the prescribed procedure. The argument of an internal error was dismissed, the authority recalling that the notification obligation lies with the controller under the accountability principle (Articles 5(2) and 24 of the GDPR), who must implement appropriate measures to ensure and demonstrate compliance.

Authority's decision

Consequently, the authority imposed a fine of XX € on the Municipality of San Nicandro Garganico.

Lessons learned

This decision reminds that:

• The transparency obligation imposed on public bodies does not automatically override the data minimisation principle. It is imperative to assess, on a case-by-case basis, the necessity of publishing personal data and to mask them if they are not essential to the transparency objective.
• The lawfulness of the dissemination of personal data online may be time-limited. Once the legal publication period has expired, maintaining free access to documents containing identifiable personal data without a specific legal basis constitutes unlawful processing.
• The communication of the DPO's contact details to the supervisory authority is a formal obligation of the controller. Relying on an internal organisational failure to justify a breach is ineffective in light of the accountability principle.