The House of Data Imperiali bulletins are extracts from the articles of the Legal Information Service (SIG) edited by Mr. Rosario Imperiali d’Afflitto.

The SIG is available by subscription only.

For further information, please email:

Italian Data Protection Authority’s decisions on Local Health Authorities

The January 24, 2024, newsletter of the Italian data protection authority reports the news of three decisions with related fine orders against three Local Health Authorities in the Friuli-Venezia Giulia region.

The merits of the disputes are identical and concern a statistical stratification treatment of a set of patients for the identification of indices of high risk of complications for Covid-19 infections, to be submitted to initiative medicine plans.

The project was the subject of a resolution of the Friuli-Venezia Giulia Regional Council as well as an agreement between the Region itself and the Healthcare Professionals’ unions.

Italian DPA’s decisions against the Local Health Authority

The corrective and sanctioning decisions of the supervisory authority against the Friuli Local Health Authorities were all issued on December 15, 2022, specifically:

Appellate decisions of the ordinary court

All three of these decisions have become topical again as, in the appeal proceedings brought before the ordinary court:

  • two of them (No. 415 and No. 416) were annulled, respectively by the Court of Pordenone and the Court of Udine, because the grounds of appeal were considered well-founded
  • both decisions also required the Italian’s DPA to publish the court order on the authority’s institutional website (hence, the prominence in the January 2024 newsletter)
  • the authority’s third decision (No. 417) is awaiting a decision by the Court of Trieste, but the same court has ordered as a precautionary measure the suspension of the measure’s enforceability.

Appeals against decisions of the Authority

Article 152 of the Italian Privacy Code, which regulates judicial protection for personal data protection issues, has remained essentially unchanged following the post-GDPR reform.

The current version implements the right of any person “to seek an effective judicial remedy against a legally binding decision of the supervisory authority concerning him or her,” enshrined in Article 78 of the GDPR.

The appeal “shall be lodged, on pain of inadmissibility, within thirty days from the date of communication of the decision or within sixty days if the appellant resides abroad” (Art. 10.3, GDPR).

Publication and rectification

Article 10 of Legislative Decree No. 150/2011 – which regulates disputes before the ordinary judicial authority regarding the protection of personal data pursuant to Article 152 of the Privacy Code – aside from establishing that the procedure to be applied is the labor one and that the judge’s decision is unappealable, it also provides that the same judgment may also prescribe compensation for damages.

Under the aforementioned provision, for both disputes that had reached a decision, the plaintiffs had requested as a form of specific compensation that the Italian’s DPA be ordered to “publish the judgment in full (operative part and grounds), (at the care and expense of the authority), by means of communication on its institutional website.”

The two Courts having granted the request and in compliance with the operative part, the Italian’s DPA proceeded both by giving notice in the authority’s newsletter and by making an annotation on the header of the two orders published on its institutional website, with links to the copy of the relevant judgments.

Precautionary measures

In the three cases referred to, the plaintiffs had previously requested the adoption of an interlocutory order suspending the enforceability of the appealed order.

The request had different outcomes in the three cases:

  • the Pordenone court – with regard to Order No. 415 – rejected it
  • the Court of Udine – with regard to Order No. 416 – granted it, suspending its enforceability with its own decree
  • the Court of Trieste granted it with respect to Order No. 417 (see annotation reported in web doc. no. 9845312).