Italian DPA Fines Il Fatto Quotidiano for Publishing Sensitive Health Data in Violation of GDPR
Written by AI from the linked story. Not reviewed by an editor. How this works
The newspaper Il Fatto Quotidiano published an article containing sensitive personal and health data of an individual involved in a cable car accident, violating GDPR principles of lawfulness, fairness, and data minimisation. The core failure was a lack of editorial controls and data protection awareness, leading to the disproportionate disclosure of health information that was neither necessary nor proportionate to the journalistic purpose. Even after the article was de-indexed, the DPA determined the initial dissemination had already caused harm, resulting in a €23,750 fine. This case underscores that media organisations are not exempt from GDPR obligations and must carefully evaluate the necessity and proportionality of publishing sensitive personal data. The reputational and legal consequences of such violations highlight why robust data handling policies are essential even in editorial environments.
Tactical Insight
Immediate actions
- Establish a pre-publication review checklist to assess whether sensitive personal or health data is necessary and proportionate to the journalistic purpose.
- Train all editorial staff on GDPR obligations, including the special categories of sensitive data under Article 9, before publishing articles involving individuals.
- Implement a rapid takedown procedure so that articles containing unlawfully published personal data can be removed and de-indexed within hours of identification.
Long-term improvements
- Appoint or designate a Data Protection Officer (DPO) with editorial oversight responsibilities to review high-risk content prior to publication.
- Develop and enforce a formal Editorial Data Protection Policy that maps journalistic activities to GDPR lawful bases and data minimisation requirements.
- Conduct annual GDPR compliance audits covering editorial workflows, data retention practices, and third-party data sources.
Detection & Response measures
- Create a structured process for receiving and responding to subject access requests and complaints from individuals featured in published articles.
- Monitor regulatory guidance from national DPAs on journalism and data protection to stay ahead of evolving enforcement priorities.
- Maintain an incident log for all data protection complaints related to published content to identify recurring editorial risk patterns.