The Italian authority sanctions a press publisher for disseminating health data and the identity of a mere witness in a judicial case, ruling that this information was not essential to public information and violated the principles of lawfulness and data minimization.

Facts and context

The Italian data protection authority (Garant for the protection of personal data - GPDP) issued a sanction decision against Società Editoriale Il Fatto S.p.A. (including a fine of €23,750) for breaches related to the publication of personal data, including health data, in a press article.

The case originated from a complaint by a person whose personal data, including information about their health status, were published in an article in the newspaper "Il Fatto Quotidiano" concerning a tragic accident.

Reasons for the decision

The authority found the following breaches against the company:

• Obligation of lawfulness and fairness of processing (Article 5(1)(a) of the GDPR): The authority deemed the processing unlawful because the publication of the complainant's data, notably health-related data, did not respect the principle of "essentiality of information" provided by Italian law for journalistic activity. Although the case was of public interest, the dissemination of the identity and health data of a person who was only a witness ("person informed of the facts") was not justified. The GPDP emphasized that the informative purpose could have been achieved without making the person identifiable, and that the publication of health data required increased caution, in accordance with Articles 5 and 10 of the Italian journalistic ethical rules.
• Obligation of data minimization (Article 5(1)(c) of the GDPR): The authority considered that the nominative identification of the complainant was information not essential to the public's understanding of the facts. The narration of events, the person's role, and their statements could have been done anonymously. Furthermore, the detailed and "spectacular" description of the circumstances of their hospitalization and psychological state was deemed excessive, exceeding the limits of relevance and non-excess, and infringing on the dignity and privacy of the person concerned.

Authority's decision

Consequently, the authority imposed a fine of €23,750 on Società Editoriale Il Fatto S.p.A.

Additionally, the authority ordered the publication of its decision on its website.

Lessons learned

This decision reminds that:

• The public interest of a news story does not automatically justify publishing the identity and personal data of all individuals involved, especially if they are only witnesses or peripheral figures in the case.
• The principle of data minimization fully applies to journalistic activity and requires assessing whether the informational objective can be achieved by less intrusive means, such as anonymization.
• The dissemination of health-related data in a journalistic context must be strictly limited to what is essential for information, avoiding any sensationalist or overly detailed description that would harm the dignity of the person.
• The persistence and wide dissemination of information online, through indexing by search engines, are aggravating factors that amplify the harm suffered by the person concerned.
• The existence of prior sanctions for similar breaches constitutes an important aggravating circumstance in determining the amount of the fine, as it indicates a non-compliant and repeated practice.