The unauthorized dissemination of private conversations of a public figure for gossip purposes, without connection to a legitimate public interest, constitutes a violation of the fundamental principles of the GDPR, notably those of lawfulness, fairness, and data minimization.

Facts and context

The Italian data protection authority (Garante) has today published a sanction decision against Fabrizio Corona, including the imposition of a fine of €4,950, for breaches related to the unauthorized dissemination of private conversations of the actor Raoul Bova.

This case originates from the publication by this individual, on social networks and digital platforms, of an audio file and excerpts of a private conversation between the actor and another person.

Reasons for the decision

• Obligation to respect the principles of lawfulness, fairness, and data minimization (Article 5 of the GDPR): The authority found that the dissemination of excerpts of intimate and affective conversations exceeded the principle of data minimization. It emphasized that the notoriety of a person does not legitimize the disclosure of information relating to their private sphere when such information does not present an actual public interest. In this case, the publication had the sole purpose of sensationalism and fueling gossip, causing significant harm to the reputation and private life of the actor, a violation aggravated by amplification due to the use of digital platforms.

Decision of the authority

Consequently, the authority imposed a fine of €4,950 on the individual concerned. The authority specified that the amount of the sanction took into account the absence of tax-declared income by the individual for the reference year, despite the seriousness of the violation and the sensitive nature of the data disseminated.

Lessons learned

This decision reminds that:

• The notoriety of a person does not deprive them of their right to privacy; the dissemination of their personal data is only legitimate if it responds to a real public interest and not a mere gossip objective.
• The processing of data for journalistic or expressive purposes must respect the principle of data minimization, which excludes the publication of intimate or affective details that are not strictly necessary for informing the public.
• The dissemination of personal data via social networks constitutes an aggravating factor due to the amplification of the scope and effects of the violation on the data subject.