[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWQ9CLsmboyJMtqVMKZBKw1Kf7dd3dE_vZZBmZxPmpjk":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"47077edb-ab57-43f9-a01b-d43e3db6ad74","Garante per la protezione dei dati personali (Italy) - 491\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-491-2026-5b8d15","← Older revision Revision as of 09:19, 26 August 2026 Line 41: Line 41: |GDPR_Article_3= |GDPR_Article_3=Article 83 |GDPR_Article_Link_3= |GDPR_Article_Link_3= Line 92: Line 92: }} }} The DPA found the controller in violation of the principles of lawfulness, fairness an data minimisation after a data subject complained about an article published about her which entailed detailed statements revealing her personal data and health status. The DPA held that a newspaper unlawfully published an article containing personal data of a person involved in a cable car accident. According to the DPA, this led to the inaccurate assumption that the data subject was involved in respective criminal procedures. == English Summary == == English Summary == === Facts === === Facts === On 4 January 2024, the newspaper “Il Fatto Quotidiano” (‘the controller’) published an article pertaining to the cable car accident of Mrs. XX’s (‘the data subject’). On 4 January 2024, the newspaper “Il Fatto Quotidiano” (‘the controller’) published an article pertaining to the cable car accident of the data subject. The data subject sent a preliminary request on 29 January 2024 to the controller, requesting them to erase her personal data from the article, remove the article from the website and de-index it. On 1 February 2024 the controller refused to do so on the basis that it was a matter of public interest, produced within the legitimate exercise of the right to report the news and that the reference to the data subject was relevant as her name appears numerous times in the investigation. The data subject sent a request on 29 January 2024 to the controller, requesting them to erase her personal data from the article, remove the article from the website, and de-index it. On 1 February 2024 the controller refused to do so on the basis that it was a matter of public interest, produced within the legitimate exercise of the right to report the news and that the reference to the data subject was relevant as her name appears numerous times in the investigation. The DPA received a complaint from the data subject’s legal representative on 29 February 2024 concerning the publication on 4 January 2024 of the article. The DPA received a complaint from the data subject’s legal representative on 29 February 2024 concerning the publication on 4 January 2024 of the article. Line 108: Line 108: The controller, in light of accommodating the data subject’s request but without admitting accountability, de-indexed the article. The data controller’s representative subsequently emphasised that they were unable to remove the editorial content from the filing system, and that the de-indexing was best option when balancing the storage of historical memory with the data subject’s request. The controller, in light of accommodating the data subject’s request but without admitting accountability, de-indexed the article. The data controller’s representative subsequently emphasised that they were unable to remove the editorial content from the filing system, and that the de-indexing was best option when balancing the storage of historical memory with the data subject’s request. === Holding === The DPA held that the editorial content of the article was in violation of the principle of lawfulness and fairness, and data minimisation pursuant to [[Article 5 GDPR|Article 5(1)(a)]] and [[Article 5 GDPR|Article 5(1)(c) GDPR]] respectively. The data subject correspondingly requested that if the DPA does not consider it proportionate to remove the article completely, for the erasure of her personal data and the de-indexing from all search engines and publishing platforms affiliated with the controller. The DPA held that the information about the data subject and description of her hospitalisation was not deemed indispensable, relevant nor proportional. The DPA held that the detailed statements and sensationalised portrayal of the data subjects mental and physical health was not strictly necessary for the purpose of informing the public. Therefore, the DPA held that the dissemination of information pertaining to a particularly sensitive personal and health related matter goes beyond what is necessary for informing the public interest. === Holding === The DPA held therefore that the editorial content of the article was in violation of the principle of lawfulness and fairness, and data minimisation. The information about the data subject and description of her hospitalisation was not deemed indispensable, relevant nor proportional. The DPA held that the detailed statements and sensationalised portrayal of the data subjects mental and physical health was not strictly necessary for the purpose of informing the public. Therefore the DPA held that the dissemination of information pertaining to a particularly sensitive personal and health related matter goes beyond what is necessary for informing the public interest. The DPA, acknowledging the fact that the article central to the dispute has been removed, found the processing operations of the controller to have been in violation of the principles of lawfulness, fairness and data minimisation pursuant to Article 5(1)(a) and (c) GDPR and correspondingly imposed a €23,750 fine on them. The DPA, acknowledging the fact that the article has been removed, found the processing operations of the controller to have been in violation of the principles of lawfulness, fairness and data minimisation pursuant to [[Article 5 GDPR|Article 5(1)(a)]] and [[Article 5 GDPR|Article 5(1)(c) GDPR]] and correspondingly imposed a €23,750 fine on them pursuant to [[Article 83 GDPR]]. == Comment == == Comment ==","Italy's Garante per la protezione dei dati personali (DPA) has fined the newspaper 'Il Fatto Quotidiano' €23,750 for violating GDPR principles of lawfulness, fairness, and data minimisation. The newspaper published an article containing sensitive personal and health data of an individual involved in a cable car accident, leading to inaccurate assumptions about their involvement in criminal proceedings. Despite the article being de-indexed, the DPA found the dissemination of such sensitive information unnecessary and disproportionate.","Italian DPA fines newspaper €23,750 for unlawful publication of personal health data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_491\u002F2026&diff=52796&oldid=52776","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-08-26T09:19:49+00:00","2026-08-26T10:00:23.171286+00:00",7,[17],{"name":18,"type":19},"Il Fatto Quotidiano","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":22,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":66},"italian-dpa-fines-il-fatto-quotidiano-for-publishing-sensitive-health-data-in-violation-of-gdpr","Italian DPA Fines Il Fatto Quotidiano for Publishing Sensitive Health Data in Violation of GDPR","The newspaper Il Fatto Quotidiano published an article containing sensitive personal and health data of an individual involved in a cable car accident, violating GDPR principles of lawfulness, fairness, and data minimisation. The core failure was a lack of editorial controls and data protection awareness, leading to the disproportionate disclosure of health information that was neither necessary nor proportionate to the journalistic purpose. Even after the article was de-indexed, the DPA determined the initial dissemination had already caused harm, resulting in a €23,750 fine. This case underscores that media organisations are not exempt from GDPR obligations and must carefully evaluate the necessity and proportionality of publishing sensitive personal data. The reputational and legal consequences of such violations highlight why robust data handling policies are essential even in editorial environments.",[56,57,58,59,60,61,62,63,64,65],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 85 – Processing and freedom of expression and information (journalism exemption limits)","GDPR Article 83(5) – Administrative fines for infringements","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","NIST SP 800-53 PT-3 (Personally Identifiable Information Processing Purposes)","CIS Control 3 – Data Protection","ISO\u002FIEC 27001 Annex A.5.33 – Privacy and protection of PII","ITIL Service Value Chain – Continual Improvement (policy and training review)",{}]