Sanction RGPD Italian Data Protection Authority (Garante) — Conservatorio di Musica S. Cecilia di Roma : 6 k€ (2022)
- Autorité de contrôle
- Italian Data Protection Authority (Garante)
- Pays
- Italie
- Entreprise / secteur
- Conservatorio di Musica S. Cecilia di Roma
- Montant de l'amende
- 6 k€
- Date de la décision
- 10 novembre 2022
- Fondement juridique
- Art. 5, Art. 6, Art. 38, Art. 2-ter Codice della privacy
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Italian DPA has imposed a fine of EUR 6,000 on 'Conservatorio di Musica S. Cecilia di Roma'. A student of the educational institution had filed a complaint with the DPA for having received a disciplinary sanction for a statement made during a student assembly. Although it was not supposed to be, the assembly was recorded and the institution used the recordings to base the disciplinary action on it. During its investigation, the DPA determined that the controller did not have a valid legal basis to use the assembly recordings and, therefore, the processing of the student's personal data was unlawful. Also, the DPA found that the educational institution's data protection officer was also the institution's director. The DPA considered this to be an unlawful conflict of interest.