An Italian municipality was sanctioned for prematurely disclosing an employee's trade union membership to her future employer, with the authority ruling that the future finalization of the employee's transfer did not justify such early disclosure in the absence of a specific legal basis.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) today published a sanction decision against the municipality of San Genesio ed Uniti (including a fine of €2,000) for breaches related to the unlawful communication of data concerning an employee's trade union membership to her future employer.

The case originated from a complaint by a former employee of the municipality, who contested the communication of her trade union membership and other personal data to another public body as part of a voluntary mobility procedure.

Reasons for the decision

• Obligation of lawfulness, fairness and transparency of processing (Article 5(1)(a) of the GDPR), to have an appropriate legal basis (Article 6 of the GDPR) and to respect the prohibition on processing special categories of data (Article 9 of the GDPR): The municipality sent a note to the destination body of its employee, who was undergoing a mobility procedure. This note, which responded to a request from the employee and her trade union representative, was copied to this destination body. It revealed not only the employee's personal data but also her trade union membership as well as the identification data of the trade union representative. The authority recalled that the processing of data relating to trade union membership is in principle prohibited by Article 9(1) of the GDPR. In the context of labour law, an exception is possible under Article 9(2)(b) of the GDPR if the processing is necessary to exercise rights and fulfil specific obligations in the field of labour law and social security. However, the communication to the destination body did not fall within this scope. The authority rejected the municipality's argument that it acted in good faith, believing that the destination body was already informed. It emphasized that at the time of the communication, the mobility procedure was not finalized, the two employment relationships were distinct, and the employee could theoretically have changed her trade union affiliation before her effective transfer. The communication was therefore without legal basis and violated the fundamental principles of the GDPR.

Decision of the authority

Consequently, the authority imposed a fine of €2,000 on the municipality of San Genesio ed Uniti.

Furthermore, the authority ordered the publication of the decision on its website, due to the processing of special categories of data without a legal basis.

Lessons learned

This decision confirms / specifies / recalls that:

• The future and legitimate communication of information to a third party does not justify its early disclosure if the legal conditions for such sharing are not yet met.

• The processing of data relating to trade union membership must be strictly limited to the purposes provided by law, such as the management of wage deductions or trade union rights, and cannot be extended to other communications without a specific legal basis.

• Good faith or the mistaken belief that a recipient already possesses information does not constitute a valid legal basis for the communication of personal data, especially sensitive data.

• In the context of an employee's mobility, the employment relationships with the original and destination employers remain distinct as long as the transfer is not effective, which requires a strict separation of data processing.

• Data controllers, including small public entities, must pay particular attention to the list of recipients of their communications to ensure that each transmission is justified in light of the principles of minimisation and lawfulness.