Italy

Conservatorio di Musica S. Cecilia di Roma

6,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2022-11-10.

Rank · Sector

#213

of 357 in Public Sector and Education

Rank · Italy

#334

of 543

Rank · All fines

#1,634

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2022-11-10
Controller / Processor: Conservatorio di Musica S. Cecilia di Roma
Sector: Public Sector and Education
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 38 GDPR, Art. 2-ter Codice della privacy
Type of violation: Insufficient legal basis for data processing

Summary

The Italian DPA has imposed a fine of EUR 6,000 on "Conservatorio di Musica S. Cecilia di Roma". A student of the educational institution had filed a complaint with the DPA for having received a disciplinary sanction for a statement made during a student assembly. Although it was not supposed to be, the assembly was recorded and the institution used the recordings to base the disciplinary action on it. During its investigation, the DPA determined that the controller did not have a valid legal basis to use the assembly recordings and, therefore, the processing of the student's personal data was unlawful. Also, the DPA found that the educational institution's data protection officer was also the institution's director. The DPA considered this to be an unlawful conflict of interest.

Open original source Links to the regulator's original publication or another source.