An Italian public agency is sanctioned for the unlawful dissemination of personal data related to a labor dispute, kept online for several years on its public notice board due to a technical error.

Facts and context

The Italian data protection authority, the Guarantor for the Protection of Personal Data (GPDP), has today published a sanction decision against the Regional Agency of Secretaries of Local Entities of the Aosta Valley (including the imposition of a €10,000 fine) for breaches related to the unlawful dissemination of personal data on its website.

The case originated from a complaint by an individual concerning the online publication of several resolutions containing their personal data in the context of a professional dispute with the agency.

Reasons for the decision

The authority found the following breaches:

• Absence of legal basis for the dissemination of data (Article 6 of the GDPR and Article 2-ter of the Italian Data Protection Code): The agency disseminated on its online public notice board resolutions containing detailed information about a labor dispute with the complainant. The authority recalls that the dissemination of personal data by a public body is lawful only if provided for by a specific legal or regulatory provision. The agency could not identify any valid legal basis, merely invoking general obligations of legal publicity and transparency, deemed insufficient by the GPDP to justify the publication of such detailed data.
• Violation of the principles of lawfulness and data minimization (Article 5 of the GDPR): In the absence of a legal basis, the processing was unlawful by nature, thus violating the principle of "lawfulness, fairness and transparency." Furthermore, the minimization principle was breached, as the published documents contained unnecessary and excessive information, including the name of the data subject directly in the subject of the resolutions. The GPDP emphasized that the fact that the dispute was public knowledge at the time did not exempt the agency from its obligations, notably to disseminate only strictly necessary data.

Authority's decision

Consequently, the authority imposed a fine of €10,000 on the Regional Agency of Secretaries of Local Entities of the Aosta Valley.

Furthermore, the authority ordered the publication of the decision on its website.

Lessons learned

This decision reminds that:

• The general transparency obligation imposed on public administrations does not constitute a sufficient legal basis to justify the online dissemination of all personal data contained in their documents; a specific legal or regulatory provision is essential.
• The fact that information is already in the public domain does not exempt a controller, especially a public authority, from the obligation to have a valid legal basis for its own processing operations, such as online dissemination.
• A "technical error" resulting in prolonged retention of data online does not exempt the controller from its responsibility, which must implement technical and organizational measures to ensure data protection by design and by default, including periodic reviews of published content.