Processing of sensitive data relating disability

In the first case, the Italian Data Protection Authority pointed out that the reference “104” is just enough to violate privacy regulations. Therefore, the Authority – with its decision no. 290 dated 1 September 2022 - has imposed a sanction equal to 4,000.00 Euro on a public high school that had (by mistake) published on its website an internal communication (that should have remained within the internal portal - and relevant digital billboard - accessible to all employees) containing a list of staff members who had been granted with permits pursuant to law no. 104/1992 (“Framework law for the assistance of disabled persons”). 

Specifically, such disclosure was considered by the Italian Data Protection Authority as an improper dissemination and processing of the concerned persons’ sensitive data. With specific reference to the nature of the disclosed data, the Authority outlined that the fact that "the reason that led an employee to be granted with the benefits under law no. 104/92 was not revealed and so that there was no publication of actual health data but only of an index from which to deduce a certain invalidity of a person”, could not be considered relevant. 

This, also in the light of the consolidated orientation of the same Authority according to which the reference to law no. 104, which famously regulates benefits and guarantees for assistance, social and labour integration of disabled persons or their family members, allows to obtain information on a person's state of health.

In the second case, the Italian Data Protection Authority had imposed (in 2014) a sanction equal to Euro 20,000.00 on the Abruzzo Region for having made public on its website the names and surnames of those candidates admitted and excluded in a selection procedure reserved for the disabled persons. 

Specifically, the Italian Data Protection Authority pointed out how the association of the names of the concerned persons with Law no. 68/1999 (concerning “Rules for the right of disabled persons to work”) undoubtedly reveals sensitive data relating to the health of the candidates. 

The Region had, in fact, claimed to have published the results of the competition on its institutional website, in the belief that it had fulfilled an obligation imposed by the law on administrative transparency. The Court of first instance had already emphasized the possibility for the Region to process personal data anonymously "or, in any case, in such a way as to avoid the disclosure of the state of health of the participants in the public selection, so as to reconcile the needs of publicity of the relevant procedure with the needs of confidentiality of the candidates".

The Supreme Court, called upon to judge in this case, on 3 February 2022 (judgement published on 6 October 2022) has definitively rejected the Abruzzo Region's petition against the decision entailing the recalled administrative sanction imposed by the Italian Data Protection Authority outlining that the element of “good faith” on the part of the applicant and the excusable element of “ignorance” could not be acknowledged.