Garante per la protezione dei dati personali (Italy) - 10273026

Summary

The Italian Data Protection Authority (Garante per la protezione dei dati personali) ruled that a broadcasting company violated GDPR and national law by disseminating graphic images of a murder victim and crime scene. The parents of the deceased were permitted to lodge a complaint on behalf of their daughter under Italian law, which allows family members to exercise data subject rights for deceased individuals. The DPA found the dissemination breached data minimization principles and the dignity of the deceased and family, prohibiting further dissemination.

Full text

Help Garante per la protezione dei dati personali (Italy) - 10273026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 11:13, 13 August 2026 view sourceLh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators6 edits Tag: Decisions [1.0] Latest revision as of 15:48, 18 August 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators6 editsTag: Visual edit Line 108: Line 108: }}}} The DPA held that the dissemination of images of a body and the crime scene as part of the reporting on a murder case violated [[Article 5 GDPR|Article 5(1)(c) GDPR]] and the parents of the deceased were able to lodge a complaint on behalf of the deceased.The DPA held that the dissemination of images of a body and the crime scene as part of the reporting on a murder case violated the principle of data minimisation and the parents of the deceased, in accordance with national law, were able to lodge a complaint on behalf of the deceased. == English Summary ==== English Summary == Line 114: Line 114: === Facts ====== Facts === An Italian broadcasting company (controller) disseminated an episode about the murder of a woman. The murder case dates back several years but gained new attention after the investigation into the murder case was re-opened. In the dissemination, the interior of the home of the deceased and her parents was shown, as this was the place where the body was found. In particular, the dissemination depicted the exact location where the body was found, covered in bloodstains, and the corpse lying face down on the stairs with her head facing the lower steps, showing bruises and a wound on the legs.An Italian broadcasting company (controller) disseminated an episode about the murder of a woman. The murder case dates back several years but gained new attention after the investigation into the murder case was re-opened. In the dissemination, the interior of the home of the deceased and her parents was shown, as this was the place where the body was found. In particular, the dissemination depicted the exact location where the body was found, covered in bloodstains, and the corpse lying face down on the stairs with her head facing the lower steps, showing bruises and a wound on the legs. In reaction to the dissemination, the parents of the deceased lodged a complaint, claiming a violation of their daughter’s dignity and their own dignity as parents of the victim as well as a violation of the principle of the essential nature of information under national law.In reaction to the dissemination, the parents of the deceased lodged a complaint, claiming a violation of their daughter’s dignity and their own dignity as parents of the victim as well as a violation of the principle of the essential nature of information under national law. === Holding ====== Holding === The DPA held that the parents were able to lodge a complaint on behalf of their deceased daughter under Italian law. Recital 27 GDPR provides that the GDPR “does not apply to the personal data of deceased persons,” but also states that “Member States may lay down rules regarding the processing of personal data of deceased persons.” Italian law allows anyone who acts to protect the data subject for family reasons to exercise the data subject rights (Article 15 - 22 GDPR) on behalf of the deceased. According to the DPA, this legitimation must be interpreted broadly as including the right to lodge a complaint pursuant to [[Article 77 GDPR|Article 77 GDPR]].The DPA held that the parents were able to lodge a complaint on behalf of their deceased daughter under Italian law. Recital 27 GDPR provides that the GDPR “does not apply to the personal data of deceased persons,” but also states that “Member States may lay down rules regarding the processing of personal data of deceased persons.” Italian law allows anyone who acts to protect the data subject for family reasons to exercise the data subject rights (Article 15 - 22 GDPR) on behalf of the deceased. According to the DPA, this legitimation must be interpreted broadly as including the right to lodge a complaint pursuant to [[Article 77 GDPR]]. Moreover, the DPA held that the dissemination by the controller violated the GDPR as well as national law regarding data processing for journalistic purposes adopted according to [[Article 85 GDPR|Article 85 GDPR]] which allows for the Member States to establish a legal regime for the protection of personal data for journalistic purposes. Article 136 and 137 of the Italian Code on Data Protection as well as the Code of Ethics are part of that legal regime. Moreover, the DPA held that the dissemination by the controller violated the GDPR as well as national law regarding data processing for journalistic purposes adopted according to [[Article 85 GDPR]] which allows for the Member States to establish a legal regime for the protection of personal data for journalistic purposes. Article 136 and 137 of the Italian Code on Data Protection as well as the Code of Ethics are part of that legal regime. The dissemination by the controller violated the national legal regime in two regards: The depiction of the family home and the body of the deceased violated the dignity of the deceased and the family because of its focus on violence in the absence of social relevance of the news or image, violating the Code of Ethics. According to the DPA, these findings were irrespective of whether the deceased qualified as a data subject.The dissemination by the controller violated the national legal regime in two regards: The depiction of the family home and the body of the deceased violated the dignity of the deceased and the family because of its focus on violence in the absence of social relevance of the news or image, violating the Code of Ethics. According to the DPA, these findings were irrespective of whether the deceased qualified as a data subject. Additionally, the dissemination violates the principle of essentiality in journalistic reporting as provided for under national law. This principle specifies the principle of data minimisation pursuant to [[Article 5 GDPR|Article 5(1)(c) GDPR]] and stipulates that the disclosure of details of violence or images that could be detrimental to a person’s dignity are only lawful where it is essential. The pictures shown were not essential because the public could not derive any new information about the murder case from viewing these images in addition to what was already known from previous reporting on the case in the past.Additionally, the dissemination violates the principle of essentiality in journalistic reporting as provided for under national law. This principle specifies the principle of data minimisation pursuant to [[Article 5 GDPR|Article 5(1)(c) GDPR]] and stipulates that the disclosure of details of violence or images that could be detrimental to a person’s dignity are only lawful where it is essential. The pictures shown were not essential because the public could not derive any new information about the murder case from viewing these images in addition to what was already known from previous reporting on the case in the past. The DPA found a breach of Articles 5(1)(a), (c) and 85 GDPR as well as national law on journalistic reporting, and prohibited the controller from further disseminating the images. No fine was imposed.The DPA found a breach of Articles 5(1)(a), (c) and 85 GDPR as well as national law on journalistic reporting, and prohibited the controller from further disseminating the images. No fine was imposed. Latest revision as of 15:48, 18 August 2026 Garante per la protezione dei dati personali - 10273026 Authority: Garante per la protezione dei dati personali (Italy) Jurisdiction: Italy Relevant Law: Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 85(1) GDPR Article 77 GDPR Article 136 Codice PrivacyArticle 137 Codice PrivacyArticle

Entities