Garante per la protezione dei dati personali (Italy) - 491/2026

Summary

The Italian Data Protection Authority (Garante per la protezione dei dati personali) found 'Il Fatto Quotidiano' in violation of GDPR principles after a data subject complained about an article. The article contained detailed personal and health information, and the newspaper initially refused to remove it, citing public interest. While the newspaper later de-indexed the article, the DPA ruled that the publication violated lawfulness, fairness, and data minimization principles.

Full text

Help Garante per la protezione dei dati personali (Italy) - 491/2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 10:54, 25 August 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators17 edits Tag: Decisions [1.0] (No difference) Latest revision as of 10:54, 25 August 2026 Garante per la protezione dei dati personali - 491/2026 Authority: Garante per la protezione dei dati personali (Italy) Jurisdiction: Italy Relevant Law: Article 5(1)(a) GDPR Article 5(1)(c) GDPR Type: Complaint Outcome: n/a Started: Decided: Published: Fine: n/a Parties: 'XX' 'Il Fatto Quotidiano' National Case Number/Name: 491/2026 European Case Law Identifier: n/a Appeal: n/a Original Language(s): Italian Original Source: Garante per la protezione dei dati personali (in IT) Initial Contributor: sf The DPA found the controller in violation of the principles of lawfulness, fairness an data minimisation after a data subject complained about an article published about her which entailed detailed statements revealing her personal data and health status. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 4 January 2024, the newspaper “Il Fatto Quotidiano” (‘the controller’) published an article pertaining to the cable car accident of Mrs. XX’s (‘the data subject’). The data subject sent a preliminary request on 29 January 2024 to the controller, requesting them to erase her personal data from the article, remove the article from the website and de-index it. On 1 February 2024 the controller refused to do so on the basis that it was a matter of public interest, produced within the legitimate exercise of the right to report the news and that the reference to the data subject was relevant as her name appears numerous times in the investigation. The DPA received a complaint from the data subject’s legal representative on 29 February 2024 concerning the publication on 4 January 2024 of the article. According to the data subject, the article identifies the data subject and where she works, contains a “misleading, sensationalist, and at time untruthful” narrative of the accident, and reports on her hospitalisation days after the incident. Furthermore, the article addresses the possible pressure imposed by the data subject’s employer regarding information that she had and could have disclosed to investigators. This was likely to lead readers to inaccurately believe that the data subject was involved in the criminal proceedings, which was not the case. The controller was subsequently asked to provide information about the complaint and claimed that their processing was lawful as the disclosure of the data subject’s personal data was indispensable to provide adequate and complete information. The controller also highlighted the fact that the data subject was an important individual as a result of her romantic involvement with one of the suspects, namely the manager of the company she worked for. The controller, in light of accommodating the data subject’s request but without admitting accountability, de-indexed the article. The data controller’s representative subsequently emphasised that they were unable to remove the editorial content from the filing system, and that the de-indexing was best option when balancing the storage of historical memory with the data subject’s request. The data subject correspondingly requested that if the DPA does not consider it proportionate to remove the article completely, for the erasure of her personal data and the de-indexing from all search engines and publishing platforms affiliated with the controller. Holding The DPA held therefore that the editorial content of the article was in violation of the principle of lawfulness and fairness, and data minimisation. The information about the data subject and description of her hospitalisation was not deemed indispensable, relevant nor proportional. The DPA held that the detailed statements and sensationalised portrayal of the data subjects mental and physical health was not strictly necessary for the purpose of informing the public. Therefore the DPA held that the dissemination of information pertaining to a particularly sensitive personal and health related matter goes beyond what is necessary for informing the public interest. The DPA, acknowledging the fact that the article central to the dispute has been removed, found the processing operations of the controller to have been in violation of the principles of lawfulness, fairness and data minimisation pursuant to Article 5(1)(a) and (c) GDPR and correspondingly imposed a €23,750 fine on them. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details. [Web Doc. No. 10273039] Decision of July 3, 2026 Register of Decisions No. 491 of July 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “Regulation”); HAVING REGARD TO the Code on the Protection of Personal Data (Legislative Decree No. 196 of June 30, 2003) (hereinafter the “Code”); HAVING REGARD TO the Code of Ethics concerning the processing of personal data in the exercise of journalistic activities, as set forth in Annex 1 of the Code (hereinafter “Code of Ethics”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation No. 1/2019 of the Data Protection Authority”); HAVING REGARD TO the documentation on file; HAVING REGARD TO the observations submitted by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the Office of the Data Protection Authority, adopted by resolution of June 28, 2000 (web doc. No. 1098801); RAPPORTEUR: Prof. Ginevra Cerrina Feroni; 1. FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1. Origin of the preliminary investigation In a complaint received by this Authority on February 29, 2024, Ms. XX (hereinafter the “complainant” or “the affected party”), through her legal representative, Attorney XX, complained of the harm resulting from the continued online availability—in association with her name—of an article published on January 4, 2024, by the newspaper “Il Fatto Quotidiano” —published by Società Editoriale Il Fatto S.p.A. (hereinafter also “the publisher” or “the Company”)—regarding the tragic XX cable car accident that occurred on May 23, 2021. The article in question—titled “XX” (accessible at the link https://...)—according to the data subject, presents a “misleading, sensationalist, and at times untruthful” account of the facts described therein. In particular, the article includes the complainant’s identifying information—who, at the time of the events, was an employee of the company “Ferrovie del XX” — and reports that she was admitted to the XX ward of XX Hospital in the days immediately following the aforementioned incident. According to the journalist’s account, the complainant allegedly fac

Entities