Garante per la protezione dei dati personali (Italy) - 491/2026

Summary

Italy's Garante per la protezione dei dati personali (DPA) has fined the newspaper 'Il Fatto Quotidiano' €23,750 for violating GDPR principles of lawfulness, fairness, and data minimisation. The newspaper published an article containing sensitive personal and health data of an individual involved in a cable car accident, leading to inaccurate assumptions about their involvement in criminal proceedings. Despite the article being de-indexed, the DPA found the dissemination of such sensitive information unnecessary and disproportionate.

Full text

Help Garante per la protezione dei dati personali (Italy) - 491/2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 10:54, 25 August 2026 view sourceSf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators21 edits Tag: Decisions [1.0] Latest revision as of 09:19, 26 August 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators21 editsmTag: Visual edit Line 41: Line 41: |GDPR_Article_3=|GDPR_Article_3=Article 83 |GDPR_Article_Link_3=|GDPR_Article_Link_3= Line 92: Line 92: }}}} The DPA found the controller in violation of the principles of lawfulness, fairness an data minimisation after a data subject complained about an article published about her which entailed detailed statements revealing her personal data and health status. The DPA held that a newspaper unlawfully published an article containing personal data of a person involved in a cable car accident. According to the DPA, this led to the inaccurate assumption that the data subject was involved in respective criminal procedures. == English Summary ==== English Summary == === Facts ====== Facts === On 4 January 2024, the newspaper “Il Fatto Quotidiano” (‘the controller’) published an article pertaining to the cable car accident of Mrs. XX’s (‘the data subject’).On 4 January 2024, the newspaper “Il Fatto Quotidiano” (‘the controller’) published an article pertaining to the cable car accident of the data subject. The data subject sent a preliminary request on 29 January 2024 to the controller, requesting them to erase her personal data from the article, remove the article from the website and de-index it. On 1 February 2024 the controller refused to do so on the basis that it was a matter of public interest, produced within the legitimate exercise of the right to report the news and that the reference to the data subject was relevant as her name appears numerous times in the investigation.The data subject sent a request on 29 January 2024 to the controller, requesting them to erase her personal data from the article, remove the article from the website, and de-index it. On 1 February 2024 the controller refused to do so on the basis that it was a matter of public interest, produced within the legitimate exercise of the right to report the news and that the reference to the data subject was relevant as her name appears numerous times in the investigation. The DPA received a complaint from the data subject’s legal representative on 29 February 2024 concerning the publication on 4 January 2024 of the article.The DPA received a complaint from the data subject’s legal representative on 29 February 2024 concerning the publication on 4 January 2024 of the article. Line 108: Line 108: The controller, in light of accommodating the data subject’s request but without admitting accountability, de-indexed the article. The data controller’s representative subsequently emphasised that they were unable to remove the editorial content from the filing system, and that the de-indexing was best option when balancing the storage of historical memory with the data subject’s request. The controller, in light of accommodating the data subject’s request but without admitting accountability, de-indexed the article. The data controller’s representative subsequently emphasised that they were unable to remove the editorial content from the filing system, and that the de-indexing was best option when balancing the storage of historical memory with the data subject’s request. === Holding === The DPA held that the editorial content of the article was in violation of the principle of lawfulness and fairness, and data minimisation pursuant to [[Article 5 GDPR|Article 5(1)(a)]] and [[Article 5 GDPR|Article 5(1)(c) GDPR]] respectively. The data subject correspondingly requested that if the DPA does not consider it proportionate to remove the article completely, for the erasure of her personal data and the de-indexing from all search engines and publishing platforms affiliated with the controller. The DPA held that the information about the data subject and description of her hospitalisation was not deemed indispensable, relevant nor proportional. The DPA held that the detailed statements and sensationalised portrayal of the data subjects mental and physical health was not strictly necessary for the purpose of informing the public. Therefore, the DPA held that the dissemination of information pertaining to a particularly sensitive personal and health related matter goes beyond what is necessary for informing the public interest. === Holding === The DPA held therefore that the editorial content of the article was in violation of the principle of lawfulness and fairness, and data minimisation. The information about the data subject and description of her hospitalisation was not deemed indispensable, relevant nor proportional. The DPA held that the detailed statements and sensationalised portrayal of the data subjects mental and physical health was not strictly necessary for the purpose of informing the public. Therefore the DPA held that the dissemination of information pertaining to a particularly sensitive personal and health related matter goes beyond what is necessary for informing the public interest. The DPA, acknowledging the fact that the article central to the dispute has been removed, found the processing operations of the controller to have been in violation of the principles of lawfulness, fairness and data minimisation pursuant to Article 5(1)(a) and (c) GDPR and correspondingly imposed a €23,750 fine on them.The DPA, acknowledging the fact that the article has been removed, found the processing operations of the controller to have been in violation of the principles of lawfulness, fairness and data minimisation pursuant to [[Article 5 GDPR|Article 5(1)(a)]] and [[Article 5 GDPR|Article 5(1)(c) GDPR]] and correspondingly imposed a €23,750 fine on them pursuant to [[Article 83 GDPR]]. == Comment ==== Comment == Latest revision as of 09:19, 26 August 2026 Garante per la protezione dei dati personali - 491/2026 Authority: Garante per la protezione dei dati personali (Italy) Jurisdiction: Italy Relevant Law: Article 5(1)(a) GDPR Article 5(1)(c) GDPR Type: Complaint Outcome: n/a Started: Decided: Published: Fine: n/a Parties: 'XX' 'Il Fatto Quotidiano' National Case Number/Name: 491/2026 European Case Law Identifier: n/a Appeal: n/a Original Language(s): Italian Original Source: Garante per la protezione dei dati personali (in IT) Initial Contributor: sf The DPA held that a newspaper unlawfully published an article containing personal data of a person involved in a cable car accident. According to the DPA, this led to the inaccurate assumption that the data subject was involved in respective criminal procedures. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 4 January 2024, the newspaper “Il Fatto Quotidiano” (‘the controller’) published an article pertaining to the cable car accident of the data subject. The data subject sent a request on 29 January 2024 to the controller, requesting them to erase her personal data from the article, remove the article from the website, and de-index it. On 1 February 2024 the controller refused to do so on the basis that it was a matter of public interest, produced within the legitimate exercise of the right to report the news and that the reference to the data subject was relevant as her name appears numerous times in the investigation. The DPA received a complaint from the data subject’s legal representative on 29 February 2024 concerning the publication on 4 January 2024 of the article. According to the data subject, the article identifies the data subject and where she works, contains a “misleading, sensationalist, and at time untruthful” n

Entities