An Italian broadcasting company (controller) disseminated an episode about the murder of a woman

[Web Doc. No. 10273026] Decision of July 3, 2026 Register of Decisions No. 490 of July 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino, Member; and Attorney Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Personal Data Protection Code, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the “Code of Ethics Regarding the Processing of Personal Data in the Exercise of Journalistic Activities” referred to in Art. 139 of the Code and its Annex 1 (hereinafter “Code of Ethics”); HAVING REGARD TO the complaints filed by Messrs.

XX and XX on April 14, 2025, and July 14, 2025, pursuant to Article 77 of the Regulation, alleging a violation of the rules governing data protection for personal data by RTI S.p.A.; HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations made by the Secretary General pursuant to Article 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Pasquale Stanzione; 1. FACTS AND COURSE OF THE INVESTIGATION The Data Protection Authority received two complaints from the parents of Chiara Poggi, who was murdered in Garlasco in 2007, regarding the dissemination by the same data controller—RTI S.p.A.—of images of the body. 1.1 Complaint of April 14, 2025 In the complaint filed pursuant to Article 77 of EU Regulation 2016/679 on April 14, 2025, Mr. and Mrs. XX —represented by their attorney—alleged a violation of current data protection regulations regarding the dissemination—during the episode of “XX” on XX (the website lists the date as XX) titled “XX”– of images depicting the interior of their home and, in particular, the area where the body of their daughter Chiara was found “covered in copious bloodstains” and the legs of their daughter’s corpse “lying face down on the stairs with her head turned toward the lower steps.”

The complainants, in particular, considered that such processing constituted a violation of the victim’s dignity and of their own dignity as parents, as well as a violation of the principle of the essential nature of information, as referred to in Articles 1 and 137 of the Code. 1.1.1 Actions Taken In a letter dated May 29, 2025, the Data Protection Authority requested that RTI S.p.A. (hereinafter also referred to simply as “the Company”) to provide comments regarding the allegations made in the complaint of April 14, 2025, concerning the “XX” segment, noting the presence of additional images depicting the same content that was the subject of the complaint (bloodstains and parts of the corpse). In a letter dated June 17, 2025, the Company, while making the video of the episode in question available, responded by objecting to the complainants’ lack of standing; regarding the content itself, it stated that: - the portions of the video expressly indicated by the complainants (“from approximately minute XX to minute XX”) constitute the preview (“Excerpt”) of the episode, which “could not help but include some images of the so-called ‘crime scene,’ also in order to provide viewers with a complete reconstruction of the events leading up to the current reopening of the legal case, which is being covered by all news outlets and media”; - the Authority extended its request for comments to other “similar images” beyond those indicated by the complainants without specifying which ones; however, since the complaint was clearly limited to only the excerpt specifically indicated therein, the Company “cannot provide any comments regarding images other than those that are the subject of the complainants’ grievances”; - the Company proceeded with the erasure of the Excerpt indicated by the complainants “as a gesture of respect on the part of the Company toward Mr. and Mrs. Poggi and the memory of the victim.”

In a letter dated June 24, 2025, the complainants—through their attorney—in response to the Company’s arguments, objected that: - regarding the lack of standing, the Regulation left it to the discretion of Member States to extend its application to deceased persons: the Data Protection Authority, on the other hand, has always recognized such protection, and Art 2-terdecies of the Code “while preserving the protection already recognized for deceased persons, sought to extend to them as well the new rights provided for in articles 15 through 22 of the European Regulation,” intending to add further protections rather than exclude those already recognized; - With regard to the essential nature of the information, the complaints specifically refer to the fact that “the images of poor Chiara’s body and the blood-stained stairs of the home were not blurred”; these images were deemed irrelevant to the subject matter of the report; - The removal of the excerpt confirms an acknowledgment of accountability regarding the alleged violations. 1.2 Complaint of July 14, 2025 On July 14, 2025, Mr. and Mrs. XX —represented by their attorney—filed a new complaint regarding the broadcast—during the episode of “XX” on XX—of images showing the leg of their daughter Chiara’s body, which displayed a wound and bruises, accompanied by detailed descriptions of the possible lawsuits.

In a letter dated October 15, 2025, the complainants—through their attorney—responded to the Company’s arguments, reaffirming their standing to file the complaint, and further objected that: - with regard to the essential nature of the information, RTI S.p.A. does not, in fact, provide any arguments to support the claim that “simply by looking at a photo, it would have been possible—contrary to what was asserted by all the experts who testified during the very lengthy legal proceedings leading to the conviction of Chiara Poggi’s murderer—to reconstruct the assault in the manner described by the two experts interviewed”; - The standard of seriousness was invoked “to argue that a journalist cannot hide behind blatantly unsound theories in order to feel free to publish information and/or images that violate people’s dignity,” specifying in this regard that “the publication of sensitive information and/or images —which undoubtedly distressed the family members of the victim, Chiara Poggi, in this case—to be legitimate, it had to be justified by the need to report news characterized by at least a minimum of ‘seriousness’ and not news based on blatantly unsubstantiated theories and arguments”; - the removal of the images confirms an acknowledgment of accountability regarding the alleged violations. 2.

OF CORRECTIVE AND SANCTIONING MEASURES AND DEFENSES BY THE PARTY 2.1. Initiation of proceedings (Art. 166, paragraph 5) On January 28, 2026, the competent Department brought to the attention of the Data Protection Authority’s Board the overall situation concerning the processing of data and images related to the criminal proceedings regarding the murder of Chiara Poggi, highlighting the complexity of the investigative work involved in these cases and expressing its intention to initiate the appropriate sanctioning proceedings aimed at adopting any necessary corrective and sanctioning measures. Based on an examination of the evidence gathered during the activities described above and the verification of the alleged violations, the Data Protection Authority notified the Company on February 27, 2026, of the initiation of proceedings, pursuant to Article 166, paragraph 5, of the Code in connection with the violation of Article 5, para 1, and Article 85 of the Regulation, Articles 136 et seq., and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 of the Code and, consequently, Article 2-quater of the Code, which provides that compliance with the Code of Ethics constitutes “an essential condition for the lawfulness and fairness of processing.” 2.2.

Defenses of the Party (Art 166, paragraph 6, of the Code) On March 28 and April 1, 2026, the Company submitted its written defense pursuant to Art. 18 of Law No. 689/1981, which sets forth the following arguments: - As a preliminary matter, the complainants lack standing, a fact that was, moreover, omitted from the Authority’s notice pursuant to Art. 166, paragraph 5 of the Authority’s notice, a circumstance that would not allow “for an analysis of the legal grounds that led to the administration’s decision to initiate this proceeding following the findings of the preliminary investigation conducted by the Data Protection Authority, thereby limiting the right to defense.” This lack of standing stems from the fact that Recital 27 provides that the Regulation does not apply to the personal data of deceased persons and that the Member States’ authority to establish rules for the processing of such data constitutes “an exception—not a natural extension of the system”— and, therefore, should be “interpreted restrictively (CJEU, Huber v. Germany, C-524/06, para. 52; the principle of strict interpretation of exceptions to fundamental rights protection rules, so as to avoid creating different levels of protection within the European Union and to prevent concrete situations of inequality among the various Member States).”

Moreover, it would not be “legally permissible for a national provision to be in open conflict with a European Regulation.” In this regard, there appears to be a conflict between the provision set forth in Article 2-terdecies of the Code and those set forth in Article 77 of the GDPR and Articles 140-bis and 141 of the Privacy Code, “insofar as they provide for the right to lodge a complaint withAuthority—a right to be understood, of course, as distinct from the aforementioned rights under Articles 15–22 of the GDPR—limit this possibility to the data subject whose data is being processed, as no “extension” in favor of third parties is found in the cited sources in the event of the data subject’s death.” Furthermore, “the provision set forth in the second paragraph of Article 142 of the Privacy Code” would apply in a similar manner, where it is stipulated that ‘The complaint must be signed by the data subject or, with the data subject’s representation, by a third-sector organization … that is active in the field of protecting the data subject rights and freedoms …,’ since, in the present case, these requirements are entirely absent, since the complainants could not “assume the status of data subjects, with the further and obvious consequence that—even if, for the sake of argument, they were able to exercise the rights set forth in Articles 15–22 of the Regulation—they certainly cannot file any complaint under the aforementioned legislation. 2 See Art 2-terdecies of the Privacy Code, first paragraph”; - furthermore, Articles 136 and 137 of the Code would not be applicable to the cases at hand, as they derive “their legitimacy from Article 85 of the GDPR, and thus from a specific article of a European Regulation that does not apply to data relating to deceased persons,” a circumstance that “is provided for in the Privacy Code only in Article 2-terdecies, certainly not in Title XII, entitled ‘Journalism, Freedom of Information, and Freedom of Expression,’ which includes Articles 136–139”; this would also apply with regard to the Code of Ethics.

The Data Protection Authority would therefore have “attributed to a deceased person the status of ‘data subject’ within the meaning of the GDPR and, consequently, of the Privacy Code, thereby deeming applicable to the case at hand a series of provisions intended to regulate the processing of personal data for informational purposes which, on the contrary, given the current regulatory framework, cannot apply to information relating to deceased individuals.” This would imply the absence of “grounds to justify the imposition of any sanctions by the Authority against RTI”; - in any case, even if the aforementioned provisions were applicable, since the so-called Garlasco case represents “a news story of renewed and widespread significance, not least due to recent developments that have led to the reopening of the investigation and have once again drawn public attention to an event of particular interest,” the principle of data minimization should be applied “in such a way as not to hinder the proper exercise of the right to report news (and the right to critique news events).”

This is because “even Art 6 of the aforementioned Code of Ethics permits reporting, including ‘detailed’ reporting, when indispensable for describing the ‘specific circumstances’ in which the ‘event’ occurred,” and “the very principle of data minimisation, which requires that data be ‘adequate, relevant, and limited to what is necessary,’ certainly does not operate as an absolute criterion in the context of processing for journalistic purposes.” In fact, since “Article 85 of the GDPR, as is well known, constitutes lex specialis with respect to Article 5(1)(c4): in Member States that have adopted exceptions for journalistic purposes (such as Italy with Articles 136–139 of the Privacy Code, which will be discussed below),” the principle of data minimisation would yield “to the contextualized essentiality test, which requires not the absence of any data exceeding the absolute minimum, but proportionality with respect to the specific informational purpose pursued.”

Therefore, the Data Protection Authority would have applied “the principle of data minimization in a vacuum, without performing the necessary balancing against the freedom of information required by Art. 85 of the GDPR and Art. 10 of the ECHR,” contrary to the ruling of the European Court of Human Rights in Axel Springer AG v. Germany (Grand Chamber, February 7, 2012, paras. 83 and 84), “where it is stated that national authorities cannot mechanically apply principles that restrict freedom of the press without carrying out a genuine balancing of interests with the interest in information”; with specific reference to the report by XX, even though the complaint was aimed at challenging the use of only the “excerpt,” the Data Protection Authority instead “unilaterally expanded the objection beyond the Excerpt initially subject to the complaint,” failing to “specify the additional Excerpts” to the extent that “neither is the duration of each segment specified, nor is the content of the images described in detail (they are defined in entirely general terms as ‘images depicting the area where Chiara Poggi’s body was found, some of which highlight the blood and parts of the victim’s corpse’)”.

Therefore, by publishing the excerpts, the Company would have “taken into account matters of strict public interest, in the exercise of its right to report the news—within the limits of the aforementioned principles—and to present an overall picture of a body of evidence that has proven particularly complex, even years later.” These excerpts, in fact, were “intended to piece together the picture documented in the episode and to illustrate—among other things—any inconsistencies between what was found at the crime scene immediately following the murder and the new evidence that led to the reopening of the investigation.” In other words, the Excerpts—far from intending to undermine the dignity of the victim and that of the parents—aimed to satisfy the public’s interest in learning about the new details that had emerged, in full exercise of the right to report the news, and to retrace the reconstruction of a criminal incident that particularly affected and shocked the entire community.”

In this regard, the Company also noted that “Article 137, paragraph 3, under consideration does not create an absolute prohibition on the dissemination of forensic images: it establishes a necessary balancing test, requiring verification of whether the image is essential to understanding the incident” and that “the framework derived from the Code of Ethics is also consistent with this,” which “does not establish an absolute prohibition on published images, but rather provides for a contextualized test of essentiality and proportionality identical to that set forth in Art 137, paragraph 3, of the Privacy Code”. It follows from this that “the Code of Ethics and Art 137, paragraph 3, of the Privacy Code do not impose an automatic prohibition on images of corpses or injuries: they require that their dissemination comply with the principle of essentiality.” In addition, the distinction is highlighted between “images displayed for emotional impact—those showing the body or injuries for the sole purpose of shocking the public’s sensibilities, without any connection to specific informational content”—and “contextualized forensic images: those included to support a technical explanation that could not be understood without the visual reference”; in particular, it is noted that the latter “may pass the test of essentiality when the functional connection is documented and specific.”

In this regard, it is observed that “in the case at hand, the clips served to illustrate—with specific references related to the condition of the scene and the location where the victim’s body was found—the arguments concerning the crime scene and the reconstruction of the crime that was the subject of the episode” and that “the verbal description of these circumstances—without visual support—would not have allowed the viewer to verify the plausibility of the arguments presented during the episode, thereby depriving the episode of its essential informative function”; - furthermore, “the processing of the data contained in the Images appears strictly necessary to provide viewers with a complete reconstruction of the events leading up to the current reopening of the legal case, to which all news outlets and media are devoting extensive coverage, pending the conclusion of the investigation and the potential initiation of new criminal proceedings”; to this, on the other hand, it should be added that “the Images contested by the Authority include: either re-airings of the same Clip, or images of the crime scene entirely devoid of any reference to the victim’s body, or, furthermore, a single image of the victim’s body that is completely out of focus”; - to this, in any case, it should be added that: “the contested images serve, as already highlighted, multiple essential informational functions: (a) a documentary function: the crime scene images constitute visual evidence of the dynamics of the crime, an aspect closely linked to the informative purpose—both news reporting and critical analysis—pursued by the episode, which, in fact, critically reconstructs the dynamics of the murder, including by questioning certain elements of the prosecution’s reconstruction.

The display of the images is entirely functional to this critical analysis, allowing viewers to assess the plausibility of the various proposed reconstructions; (b) contextualizing function: the footage allows the public to understand the spatial context in which the crime took place, an essential element for evaluating certain controversial procedural issues (e.g., the possibility that the assailant fled without leaving any blood traces, the compatibility of the timing of the events with the established timelines); (c) memorial and identity-forming function: the images also serve to preserve the collective memory of an event of historical and social significance, preventing oblivion from erasing the scope and gravity of the event. The Garlasco murder had a profound impact on the local and national community, becoming a paradigm for issues related to gender-based violence”; - with regard to the report by XX, it would not be possible to determine “what significance the removal of the report by the petitioner held for the Authority—an act which, it must be reiterated, was carried out without giving any consideration to the arguments put forward by the Complainants and reaffirming the absolute essentiality of the Images for the proper pursuit of the informational purpose sought by the report itself”; - still with reference to the images broadcast during the program XX, it was also noted that “the processing of the data contained in the Images is strictly necessary to enable viewers to understand the arguments of the experts interviewed, with the purpose of reconstructing the sequence of events surrounding the assault suffered by Chiara Poggi.

Otherwise, the interviewees would not have been able to explain the statements that were subsequently made in the report”; furthermore, “the Images are essential to the very content of the Report, which focuses on the manner in which the victim was attacked, from which it is reasonably possible to draw insights regarding the characteristics and peculiarities of the alleged perpetrator of the murder (as explained by the ballistics expert […]). By publishing the Images, RTI took into account matters of strict public interest, in the exercise of its right to report the news—within the limits of the aforementioned principles—and in providing an overall representation of a body of evidence that has proven particularly complex, even years later.” Furthermore, it is argued that the “claims of the Complainants” are unfounded, and in particular, the following argument: “for the purposes of understanding the news story being reported, there was no benefit whatsoever in broadcasting unedited footage of the leg of poor Chiara’s corpse, given that the average viewer certainly does not possess the technical knowledge of an expert capable of assessing whether the wound and bruises on the leg of Chiara’s corpse are consistent with the manner of the attack.”

Therefore, given that “the concept of ‘seriousness’ is not regulated in the relevant legislation but rather constitutes an entirely subjective and arbitrary requirement,” the Company clarified that “the individuals interviewed in the report are recognized as experts in their respective fields (as can be ascertained from a simple online search), certainly not individuals called upon to comment on the Images in a superficial and approximate manner […] without possessing the knowledge and professional qualifications required and necessary to express an opinion on such a heinous crime. Even the assertion that the individuals interviewed in the report never “participated in the murder investigation” is entirely irrelevant to the matter at hand; if the opposite were true, the processing of personal data relating to the victim by nearly all professionals who comment (on a daily basis) on images and information drawn from the news story in question would have to be prohibited.”

The images in question, therefore, should not be considered unlawful, “since they are intended to illustrate the assessments made by the interviewees, thereby concretely reflecting the principle of the essential nature of the information. Otherwise, as already reiterated, the interviewees would not have been able to illustrate the statements that were subsequently made in the report. In fact, it is not possible to maintain that there is an absolute and general prohibition on the publication of images; rather, a balance must be struck, on a case-by-case basis, that reconciles the right to confidentiality and respect for an individual’s privacy with the general right to news coverage and criticism, provided that this is done with a view to essentiality and for the purposes of completeness and fairness of the information provided, especially if it goes beyond merely satisfying the reader’s curiosity.”

In this regard, the Company has made the same observations as those made regarding the XX report concerning the fact that “the Code of Ethics and Art 137, paragraph 3, of the Privacy Code do not impose an absolute prohibition on images of corpses or injuries: they require that their dissemination comply with the principle of essentiality” and highlighted the distinction between “images displayed for emotional impact” and “contextualized forensic images,” reiterating that the latter “may pass the test of essentiality when the functional connection is documented and specific.” In this regard, it is noted that “the images of Chiara Poggi’s leg served to illustrate, with precise anatomical reference, the arguments of a ballistics expert and a martial arts expert regarding the location, morphology, and orientation of the injuries” and that “a verbal description of these characteristics, without visual support, would not have allowed the viewer to verify the plausibility of the experts’ arguments, thereby depriving the report of its essential informative function”; - with regard to the issue of reliability, the fact that the ballistics expert and the martial arts expert did not participate in the investigation does not preclude “the informational relevance of their analyses: the scientific and judicial debate is also nourished by alternative expert opinions and arguments contrary to those accepted in official forums.

RTI allowed them to express their opinions as such, without claiming that they constituted official findings; nevertheless, both they and RTI clearly exercised the inalienable right to criticism, which, moreover, has even broader limits in judicial matters”; - with regard to the images broadcast by both television programs, there would therefore be a functional, specific, and verifiable connection. Furthermore, the Data Protection Authority failed to verify that, from the standpoint of suitability, “the means used (i.e., the Images) was suitable for the intended purpose (i.e., understanding the experts’ arguments)”; from the perspective of necessity, there “was no alternative means—equally effective in terms of information—that would have had a lesser impact on the victim’s dignity”; from the perspective of proportionality, the sacrifice of freedom of information was not proportionate to the benefit achieved in terms of protecting dignity.

In particular, it is disputed that the Data Protection Authority carried out these assessments at the outset of the sanctioning proceedings. This would appear to contradict the principles established by the European Court of Human Rights in the decisions Von Hannover v. Germany No. 2 (Grand Chamber, February 7, 2012, §§ 108–113) and Couderc and Hachette Filipacchi Associés v. France (Grand Chamber, November 10, 2015, §§ 90–939), since “the present case is clearly the subject of renewed public debate (reopening of the investigation) and the excerpts served to make the assessments regarding the reconstruction of the dynamics of the crime through the crime scene intelligible; without the Images, the content of the Episode would have been compromised.” In fact, it is noted that, from the perspective of contributing to a debate of public interest, without the Images, the Report would have been incomprehensible; from the perspective of the notoriety of the subject and object of the publication, “the ‘Poggi case’ is a legal news story of national significance”; from the perspective of the data subject’s prior conduct, this criterion would not apply to the deceased but is relevant for contextualizing the legitimate expectation of confidentiality; as regards the manner in which the Images were obtained, “the Images were derived from the records of the criminal proceedings, and the manner in which they were acquired was never contested by either the Complainants or the Authority”; as for the content, form, and consequences of the publication, “the images were presented within a structured analytical context and were not displayed for the sole purpose of creating an isolated emotional impact”; - furthermore, there is no reference to the principle of “editorial discretion” established by the European Court of Human Rights, according to which “journalists enjoy a margin of appreciation in editorial choices—including the decision to use striking visual material—provided that such choices are made in good faith and aimed at providing accurate information on matters of public interest (Jersild v. Denmark, § 3111; Bladet Tromsø and Stensaas v. Norway, Grand Chamber, May 20, 1999, § 65; see the Goodwin judgement, p. 500, § 39, and Fressoz and Roire, cit., § 5412)”; - finally, it would not be possible to rely on the April 24, 2008, [web doc. no. 1519915] issued by the Italian Data Protection Authority, due to a series of substantial differences between the present case and the precedent, including “a) the qualitative difference between the images: ‘gruesome’ vs. forensic […] b) The potentially unlawful acquisition of the images […] c) The absence of a functional link […] d) The time gap and the procedural context […] e) The changed regulatory framework […] f) The sanction imposed.”

Instead, it would be more appropriate to refer to the reasoning set forth in Decision No. 520 of October 8, 2015 [web doc. No. 4363110] of the Italian Data Protection Authority. 3. THE AUTHORITY’S ASSESSMENTS It should be noted at the outset that the Authority is called upon to rule on a case in which media attention has been—and continues to be—such that it goes well beyond the exercise of the right and duty to report the news, degenerating into a “continuous and morbid sensationalization,” contrary to the principle of essential reporting; this has been the case since the initial investigations and has resurfaced more recently with their reopening. This is a circumstance that the Authority has found itself compelled to condemn on multiple occasions, addressing the media in general and calling for due respect for the individual and their dignity—as both a safeguard and a guarantee for the victim, family members, suspects, and others involved in the legal proceedings in various capacities (Press Releases of December 14, 2007, August 24, 2007, January 30, and May 15, 2026 [web docs nos. 1469751, 1435264, 10215207, 10250954]).

It is within this context that certain specific processing operations involving personal data were brought to the Authority’s attention, and the Authority was formally asked to issue an opinion on them. In fact, following an examination of the statements made to the Authority during the proceedings, as well as the documentation obtained, it appears that during the episode of “XX” aired on XX (the website lists the date as XX), entitled “XX,” images were broadcast depicting the area where Chiara Poggi’s body was found, some of which specifically highlight the blood and parts of the victim’s corpse. These images appear in various parts of the report, one of which is the segment highlighted by the complainants (the opening segment, known as the “Excerpt,” approximately the first 30 seconds); other similar images were found in subsequent parts of the report (reference is made to the original version, as included in the case file, and to the sections corresponding approximately to minutes [OMISSIS], some of which are also accompanied by detailed descriptions of the events.

In addition, there are some images—albeit blurred—depicting the victim’s body (min. 01:36:24). In this regard, it should be noted that the Authority, based on the issues raised in the complaint, extended its investigation during the preliminary inquiry to other parts of the program that contained the same images already shown in the excerpt, along with others depicting the victim’s body with a similar impact. This was done within the scope of the Authority’s investigative powers. With regard to the episode of “XX” aired on XX (approximately “from minute XX to minute XX”), it also appears that images were broadcast showing the leg of Chiara Poggi’s corpse, which displayed a wound and bruises, accompanied by detailed reconstructions of the possible events that led to those injuries With regard to the foregoing, it should be noted that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, is liable under Art. 168 of the Code, “False Statements to the Data Protection Authority and Interference with the Performance of the Authority’s Duties or the Exercise of Its Powers.” 3.1.

Standing to File a Complaint With regard to the alleged lack of standing to file the complaint and the consequent inapplicability of Articles 136 and 137 of the Code, as well as the Rules of Professional Conduct, the following observations are made. Art 4(1) of the Regulation provides that “personal data” means “any information relating to an identified or identifiable natural person.” In this regard, Recital 27, while specifying that the Regulation “does not apply to the personal data of deceased persons,” also states that “Member States may lay down rules regarding the processing of personal data of deceased persons.” By virtue of this, the Italian legislature has provided that “the rights referred to in Articles 15 through 22 of the Regulation concerning personal data relating to deceased persons may be exercised by anyone who has a legitimate interest, or who acts to protect the data subject as their representative, or for family reasons worthy of protection”.

There is, therefore, no contradiction between national law and EU law. On the contrary, the European legislature has taken into account the specific characteristics of individual national legal systems, leaving Member States the discretion to regulate the processing of data of deceased persons independently. In this regard, it should be noted that Art. 2-terdecies of the Code, introduced by Legislative Decree No. 10 of August 10, 2018, No. 101, stands in historical continuity with the provision set forth in the now-repealed Art. 9, paragraph 3, of the Code, which has also been repeatedly cited in the Data Protection Authority’s rulings (Ruling of April 24, 2008, web doc. No. 1519915, Provision of July 15, 2006, web doc. No. 1310796, and November 29 and December 6, 2007, web doc. Nos. 1478059 and 1478083). There is, therefore, no doubt that the Italian legislature, within the scope of the exception referred to in Recital 27 of the Regulation, intended to enshrine the continuation of the rights set forth in Articles 15–22 of the Regulation even beyond the natural life of the natural person.

This provision has particular implications from a remedial perspective, as it allows “anyone who has an interest of their own, or who acts to protect the data subject as their representative, or for family reasons worthy of protection” to exercise the aforementioned rights with the controller on behalf of the deceased. It follows that even the “right to lodge a complaint with a supervisory authority” in the event of a violation of the provisions of the Regulation, as established by Art 77, cannot be interpreted restrictively, but, on the contrary, must be extended to include those who may exercise the rights set forth in Articles 15–22 of the Regulation, pursuant to the provision of Article 2-terdecies of the Code. This, moreover, is also confirmed by the relevant case law, which in several cases has upheld requests from individuals who, on the basis of Article 2-terdecies of the Code, exercised the rights set forth in Articles 15–22 of the Regulation with respect to personal data concerning deceased persons (Court of Milan, Order, February 9, 2021; Court of Bologna, Order, November 25, 2021; Court of Rome, Order, February 10, 2022).

Indeed, no lack of standing was found in the filing of a complaint seeking judicial protection by parties other than the data subject in the strict sense, based on Art. 2-terdecies. Similarly, since there is no reason precluding the filing of a judicial appeal, there is no basis for finding a lack of standing in the filing of an administrative complaint with the Data Protection Authority. On the other hand, it would be entirely unreasonable to assume that the legislature intended to provide for the possibility of exercising the rights set forth in Articles 15–22 of the Regulation by “those who have an interest of their own, or who act to protect the data subject as their representative, or for family reasons worthy of protection,” without ensuring the possibility of obtaining effective protection in cases of refusal by the controller. It must therefore be considered undisputed that the persons entitled to exercise the rights set forth in Articles 15–22 of the Regulation pursuant to the provision of Article 2-terdecies of the Code are also entitled to appeal to the Data Protection Authority, pursuant to Article 77 of the Regulation and Article 141 of the Code, and, consequently, to file a complaint pursuant to Article 142 of the Code.

Therefore, in the present case, since the complainants are acting “to protect the data subject for family reasons deserving of protection” pursuant to Article 2-terdecies, there is no lack of standing in the filing of the complaint with the Data Protection Authority. 3.2 Applicability of Articles 136 and 137 of the Code and the Code of Ethics In order to clarify the issues concerning the applicability of Articles 136 and 137 of the Code, the following considerations must be made. Article 85 of the Regulation establishes that Member States’ laws must balance data protection with the right to freedom of expression and information, “including processing for journalistic purposes or for the purposes of academic, artistic, or literary expression.” In particular, with regard to processing carried out for such purposes, the same article provides that Member States shall establish “exemptions or derogations from Chapters II (principles), III (data subject rights), IV (controller and processor), V (data transfers of personal data to third countries or international organisations), VI (independent supervisory authorities), VII (cooperation and consistency), and IX (specific data processing situations), where such exemptions or derogations are necessary to reconcile the right to data protection with the freedom of expression and information.”

Accordingly, Article 136 of the Code provides that processing carried out “in the exercise of the profession of journalism and for the sole pursuit of related purposes” or “by individuals listed in the register of journalists or in the register of trainees” or intended “exclusively for the publication or occasional dissemination of articles, essays, and other expressions of thought, including in academic, artistic, and literary contexts,” special provisions apply pursuant to Article 85 of the Regulation With regard to the dissemination of data for the purposes mentioned above, Article 137, paragraph 3, specifically provides that “the limits on the right to report news to protect the rights referred to in Article 1, paragraph 2, of the Regulation and in Article 1 of the […] Code and, in particular, that of the essential nature of the information regarding matters of public interest.” Furthermore, it should also be noted that, by Resolution No. 491 of the Data Protection Authority dated November 29, 2018, published in the Official Gazette No. 3 of January 4, 2019, the Code of Ethics for Journalistic Activities, Annex A.1 to the Code, were adopted.

Art 6 of the Code of Ethics establishes that the disclosure “of news of significant public or social interest does not conflict with respect for privacy when the information, even if detailed, is indispensable due to the originality of the event or the description of the specific circumstances in which it occurred, as well as the characterization of the key figures.” Furthermore, Art 8 of the Code of Ethics provides that, subject to the essential nature of the information, journalists shall not report news or publish images or photographs of individuals involved in news events that are detrimental to human dignity, nor shall they dwell on “details of violence, unless they recognize the social relevance of the news or the image.” Now, in light of what has been noted thus far, the combined provisions of Article 85 of the Regulation, Articles 136 et seq. of the Code, and the Code of Ethics establish the conditions for the lawfulness of personal data processing carried out for journalistic purposes.

In fact, if the processing is not covered by the specific exception provided for the journalistic field, and in the absence of another valid legal basis, it must be considered unlawful. In this regard, it should be noted that Art. 17(1)(d) provides that if personal data are processed unlawfully, “the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase the personal data without undue delay.” That said, a review of the video footage obtained and the official records reveals that the dissemination of images depicting the interior of the complainants’ home—and, in particular, the area where Chiara Poggi’s body was found “covered in copious bloodstains” and of the legs of her corpse “lying face down on the stairs with her head turned toward the lower steps” (aired during the XX broadcast on XX) as well as the images—depicting the leg of her daughter Chiara’s corpse, which showed a wound and bruises (broadcast as part of the XX program on XX) —cannot be justified on the grounds of the “essential nature of the information regarding matters of public interest,” and that such dissemination constituted a serious violation of the dignity of the victim and her family.

Therefore, with regard to these images, the family members have the right to request their erasure, and the publisher is obligated to carry out the erasure, as they were published without a valid basis of lawfulness and, therefore, unlawfully. Given the lack of essentiality of the information and the absence of social relevance in the images broadcast, it must be considered unlawful that the episode of XX aired on XX focused on details of violence, such as the area where Chiara Poggi’s blood-stained body was found and the legs of the corpse lying face down on the stairs. A similar assessment applies to the episode of XX on XX and the images depicting the leg of Chiara Poggi’s corpse, which showed a wound and bruises. Moreover, these aspects are independent of whether or not a deceased person is classified as a “data subject,” nor do they affect the continued existence of the rights set forth in Articles 15–22 of the Regulation held by family members who wish to preserve the deceased’s dignity. 3.3.

On the Violation of the Principle of Essentiality and the Principle of Minimization Having clarified the preliminary issues regarding the complainants’ standing and the applicability of the special provisions set forth in Articles 136 et seq. of the Code, as well as the Code of Ethics for Journalists, the following observations are made regarding the objections raised on the merits. As previously noted, the Regulation and the Code have established special provisions aimed at balancing the right to personal data protection with the freedom of expression and information. However, exemptions and derogations from the general rules on the processing of personal data do not exempt those who process data in the exercise of freedom of expression and information from respecting the rights, fundamental freedoms, and dignity of the individuals to whom the processed data relate (Articles 1(2) and 85 of the Regulation; Articles 1, 136–139 of the Code) and require them to comply with certain principles, including that of the “essentiality of the information regarding matters of public interest” (Article 137, paragraph 3 of the Code).

This principle—an elaboration of the more general principle of data minimisation (Article 5(c) of the Regulation)—is specified in the Code of Ethics, compliance with which constitutes “an essential condition for the lawfulness and fairness of processing” (Article 2-quater of the Code). The Code of Ethics, on the other hand, expressly places a limit on the disclosure of details of violence or images or photographs of individuals involved in news events that could prove harmful to a person’s dignity (Art 8). As repeatedly emphasized by the Data Protection Authority, these safeguards do not cease upon the death of the individual and may also be invoked by family members to protect the memory and dignity of the deceased (Art. 2-terdecies of the Code and, among others, Provision No. 701 of October 23, 2025, web doc. No. 10218967). Turning to the specific case addressed in this ruling, as also noted by the Company, the so-called Garlasco case represents “a news story that has gained renewed and widespread attention, not least due to recent developments that led to the reopening of the investigation and have once again drawn public attention to an incident of particular interest.”

Nevertheless, it should be noted that the dissemination of images depicting the location where Chiara Poggi’s blood-stained body was found, as well as partial shots of the body lying on the stairs (XX) or the images showing the leg of Chiara Poggi’s body, which displayed a wound and bruises (XX), adds nothing to the news coverage of the case, nor is it essential to describing the specific circumstances in which the events unfolded or to characterizing the individuals involved. On the contrary, the broadcast of the aforementioned images during a television program must be considered an unjustified display of violence given the social significance of the image and the news story it was intended to support. After all, these are facts and circumstances that have been known for some time, and there is no need to add further depictions to clarify their description. In particular, while noting that the processing in question takes place within a context of intense attention and debate surrounding the investigative activities conducted following Chiara Poggi’s death, the network’s stated purpose of shedding light on certain additional aspects of the crime must nonetheless be considered disproportionate in relation to the prejudicial effects it has on the right to respect for the victim’s dignity and memory—a right that her parents are also entitled to protect.

Therefore, as already noted in the previous point, the publication of images showing the family home splattered with blood and parts of the corpse cannot be justified on the grounds that the information is essential. Consequently, since the information conveyed by the images in question during the episode cannot be considered essential for the purposes of recounting the story, they should not have been published pursuant to Art. 8 of the Code of Ethics. Furthermore, it should be noted that the broadcast of images depicting the area where Chiara Poggi’s body was found—with particular emphasis on the blood—as well as images depicting the victim’s corpse or, in any case, parts of it, constitutes a violation of the principle of data minimisation set forth in Article 5, paragraph 1, subparagraph c), according to which data must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed,” of which the essential nature of the information, as already noted, is an expression.

Indeed, the Data Protection Authority, in balancing the right to confidentiality with the right to freedom of expression—from which both the right to inform and the right to be informed derive—concluded that the images of the bloodstains and the legs of Chiara Poggi’s body, as well as those specifically showing the wound and bruises, are unjustifiably harmful to the personal dignity of the victim and her family without adding anything to the account of the facts and events related to the legal case that journalists intend to report. In fact, no additional information can be gleaned from viewing these images, neither for the benefit of those contributing to the public account of the incident nor for citizens seeking to learn about the facts and circumstances of the crime. Furthermore, the images in question do not even serve to lend an element of originality to the news reported in the story, as they do not present any “new” details beyond what has already been extensively reported previously.

It appears, in fact, that the legitimate exercise of the right and duty to report on a matter of undoubted public interest has led the publisher in this case (though this is clearly a widespread trend) to assign the user (viewer or reader) the role of an “expert” to whom the evaluation of “scientific” data emerging from judicial investigations is entrusted: the so-called “forensic images,” to quote the publisher’s arguments. This approach, however, falls outside the scope of journalistic activity and inevitably ends up shifting the boundaries and legal justifications for such action. The publication of images of the victim’s blood and corpse, or parts thereof, therefore fails to meet the proportionality test, as the sacrifice of dignity and confidentiality required is not justified in light of the informational benefits that the broadcast of such images has brought to the public debate and to citizens.

It is precisely this circumstance that should have led journalists, within the so-called margin of editorial discretion, to choose not to broadcast such images as part of their television reports. Consequently, it must be concluded that the broadcast of the images of the victim’s corpse violated Article 5, para 1, subparagraphs (a) and (c), and Article 85 of the Regulations; Articles 136 et seq. and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 of the Code and, consequently, Article 2-quater of the Code. For the reasons set forth above, the Authority considers that the statements, documentation, and explanations provided by the controller during the investigation do not address the findings notified by the Office in the notice initiating the proceedings and are therefore insufficient to allow for thedismissal of this proceeding, as none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply.

The processing carried out by the company is, in fact, unlawful, under the terms set forth above, in relation to Articles 5(1)(a) and (c) and 85 of the Regulation, Articles 136 et seq. and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 of the Code and, consequently, Article 2-quater of the Code. 5. CORRECTIVE MEASURES While acknowledging the removal of certain parts of the episode aired on XX at XX, we note the persistent display of certain images (the copious presence of blood on the stairs and the victim’s body, approximately at [OMITTED] seconds and [OMITTED] of the current version of the episode available online) that constitute excessive content in light of the protective considerations set forth above. In light of this, it is deemed appropriate to order, pursuant to Art. 58, para 2, letter f), a prohibition on the processing of these images, similar to those already removed.

Therefore, pursuant to Art. 58, para 2, subparagraph f) of the Regulation, we hereby prohibit the further dissemination of images of bloodstains and body parts of the victim as indicated in the notice of violation, as well as the dissemination of the images referred to at [OMISSIS] seconds and [OMISSIS] minutes of the current version of the episode available online. Furthermore, taking note of the removal of the images broadcast during the episode of “XX” on XX (approximately “from minute XX to minute XX”) depicting the leg of Chiara Poggi’s corpse, which showed a wound and bruises, pursuant to Article 58, para 2, subparagraph f of the Regulation, we hereby prohibit the further dissemination of the aforementioned images as specified in the notice of violation It is further noted that the conditions set forth in Article 17 of Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at the performance of the tasks and the exercise of the powers entrusted to the Data Protection Authority, are met. [OMITTED] FOR THESE REASONS Pursuant to Articles 57 and 83 of the Regulation, the processing carried out by RTI S.p.A., with registered office in Rome, Largo del Nazareno, No. 8, Tax ID No. 03976881007, pursuant to Article 143 of the Code, for violating Articles 5(1)(a) and (c) and 85 of the Regulation, Articles 136 et seq. and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 of the Code and, consequently, Article 2-quater of the Code; pursuant to Article 58, para 2, subparagraph f of the Regulation, a prohibition is imposed on the further dissemination of the images a) relating to bloodstains and body parts of the victim as indicated in the statement of charges, as well as a prohibition on the dissemination of the images referred to at the [OMISSIS] seconds and [OMISSIS] minutes of the current version of the episode of “XX” from XX available online; b) depicting the leg of Chiara Poggi’s corpse, which showed a wound and bruises, as broadcast during the episode of “XX” on XX; [OMISSIS] IT IS HEREBY ORDERED - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this order be published on the Data Protection Authority’s website; - pursuant to Art. 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation in the Authority’s internal register provided for by Article 57, para 1, letter u), of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts by submitting a petition to the ordinary court of the location specified in the aforementioned Art 10, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori [Web Doc. No. 10273026] Order of July 3, 2026 Register of Orders No. 490 of July 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino, Member; and Attorney Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, the “Regulation”); HAVING REGARD TO the Code on Data Protection, containing provisions for the adaptation of national law to Regulation (EU) 2016/679 (Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, hereinafter the “Code”); HAVING REGARD TO the “Code of Ethics Regarding the Processing of Personal Data in the Exercise of Journalistic Activities” referred to in Art. 139 of the Code and its Annex 1 (hereinafter “Code of Ethics”); HAVING REGARD TO the complaints filed by Messrs.

XX and XX on April 14, 2025, and July 14, 2025, pursuant to Art. 77 of the Regulation, alleging a violation of the regulations governing data protection by RTI S.p.A. HAVING EXAMINED the documentation on file; HAVING CONSIDERED the observations made by the Secretary General pursuant to Article 15 of the Data Protection Authority’s Regulation No. 1/2000; RAPPORTEUR: Prof. Pasquale Stanzione; 1. FACTS AND COURSE OF THE INVESTIGATION The Data Protection Authority received two complaints from the parents of Chiara Poggi, who was murdered in Garlasco in 2007, regarding the dissemination by the same data controller—RTI S.p.A.—of images of the body. 1.1 Complaint of April 14, 2025 In the complaint filed pursuant to Article 77 of EU Regulation 2016/679 on April 14, 2025, Mr. and Mrs. XX —represented by their attorney—alleged a violation of current data protection regulations regarding the dissemination—during the episode of “XX” on XX (the website lists the date as XX) titled “XX”– of images depicting the interior of their home and, in particular, the area where the body of their daughter Chiara was found “covered in copious bloodstains” and the legs of their daughter’s corpse “lying face down on the stairs with her head turned toward the lower steps.”

The complainants, in particular, contended that such processing constituted a violation of the victim’s dignity and their own dignity as parents, as well as a violation of the principle of essentiality of information, as referred to in Articles 1 and 137 of the Code. 1.1.1 Action Taken In a letter dated May 29, 2025, the Data Protection Authority requested that RTI S.p.A. (hereinafter also referred to simply as “the Company”) to provide comments regarding the allegations made in the complaint dated April 14, 2025, concerning the program “XX,” noting the presence of additional images depicting the same content that was the subject of the complaint (bloodstains and parts of the corpse). In a letter dated June 17, 2025, the Company, while providing the video of the episode in question, responded by objecting to the complainants’ lack of standing; regarding the content itself, it stated that: - the portions of the video expressly indicated by the complainants (“from approximately minute XX to minute XX”) constitute the preview (“Excerpt”) of the episode, which “could not help but include some images of the so-called ‘crime scene,’ also in order to provide viewers with a complete reconstruction of the events leading up to the current reopening of the legal case, which is being covered by all news outlets and media”; - the Authority extended its request for comments to other “similar images” beyond those indicated by the complainants without specifying which ones; however, since the complaint was clearly limited to only the excerpt specifically indicated therein, the Company “cannot provide any comments regarding images other than those that are the subject of the complainants’ grievances”; - the Company proceeded with the erasure of the Excerpt indicated by the complainants “as a gesture of respect on the part of the Company toward Mr. and Mrs. Poggi and the memory of the victim.”

In a letter dated June 24, 2025, the complainants—through their attorney—in response to the Company’s arguments, objected that: - regarding the lack of standing, the Regulation left it to the discretion of Member States to extend its application to deceased persons: the Data Protection Authority, on the other hand, has always recognized such protection, and Art 2-terdecies of the Code “while preserving the protection already recognized for deceased persons, sought to extend to them the new rights provided for in Articles 15 through 22 of the European Regulation,” intending to add further protections rather than exclude those already recognized; - With regard to the essential nature of the information, the complaints specifically refer to the fact that “the images of poor Chiara’s body and the blood-stained stairs of the home were not blurred”; these images were deemed irrelevant to the subject matter of the report; - The removal of the excerpt confirms an acknowledgment of accountability regarding the alleged violations. 1.2 Complaint of July 14, 2025 On July 14, 2025, Mr. and Mrs. XX —represented by their attorney—filed a new complaint regarding the broadcast—during the episode of “XX” on XX—of images showing the leg of their daughter Chiara’s body, which displayed a wound and bruises, accompanied by detailed descriptions of the possible causes.

In a letter dated October 15, 2025, the complainants—through their attorney—responded to the Company’s arguments, reaffirming their standing to file the complaint, and further objected that: - with regard to the essential nature of the information, RTI S.p.A. does not in fact provide any arguments to support the claim that “simply by looking at a photo, it would have been possible—contrary to what was asserted by all the experts who testified during the very lengthy legal proceedings leading to the conviction of Chiara Poggi’s murderer—to reconstruct the assault in the manner described by the two experts interviewed”; - The standard of seriousness was invoked “to argue that a journalist cannot hide behind blatantly unsound theories in order to feel free to publish information and/or images that violate people’s dignity,” specifying in this regard that “the publication of sensitive information and/or images —which undoubtedly distressed the family members of the victim, Chiara Poggi, in this case—to be legitimate, it had to be justified by the need to report news characterized by at least a minimum of ‘seriousness’ and not news based on blatantly unsubstantiated theories and arguments”; - the removal of the images confirms an acknowledgment of accountability with regard to the alleged violations. 2.

OF CORRECTIVE AND SANCTIONING MEASURES AND DEFENSES BY THE PARTY 2.1. Initiation of proceedings (Art. 166, paragraph 5) On January 28, 2026, the competent Department brought to the attention of the Data Protection Authority’s Board the overall situation concerning the processing of data and images related to the criminal proceedings regarding the murder of Chiara Poggi, highlighting the complexity of the investigative work involved in these cases and expressing its intention to initiate the appropriate sanctioning proceedings aimed at adopting any necessary corrective and sanctioning measures. Based on an examination of the evidence gathered during the activities described above and the verification of the alleged violations, the Data Protection Authority notified the Company on February 27, 2026, of the initiation of proceedings, pursuant to Article 166, paragraph 5, of the Code in relation to the violation of Article 5, para 1, and Article 85 of the Regulation, Articles 136 et seq., and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 of the Code and, consequently, Article 2-quater of the Code, which provides that compliance with the Code of Ethics constitutes “an essential condition for the lawfulness and fairness of processing.” 2.2.

Defenses of the Party (Art 166, paragraph 6, of the Code) On March 28 and April 1, 2026, the Company submitted its written defense pursuant to Art. 18 of Law No. 689/1981, which sets forth the following arguments: - As a preliminary matter, the complainants lack standing, a fact that was, moreover, omitted from the Authority’s notice pursuant to Art. 166, paragraph 5 of the Authority’s notice, a circumstance that would not allow “for an analysis of the legal grounds that led to the administration’s decision to initiate this proceeding following the findings of the preliminary investigation conducted by the Data Protection Authority, thereby limiting the right to defense.” This lack of standing stems from the fact that Recital 27 provides that the Regulation does not apply to the personal data of deceased persons and that the Member States’ authority to establish rules for the processing of such data constitutes “an exception—not a natural extension of the system”— and, therefore, should be “interpreted restrictively (CJEU, Huber v. Germany, C-524/06, para. 52; the principle of strict interpretation of exceptions to fundamental rights protection rules, so as to avoid creating different levels of protection within the European Union and to prevent concrete situations of inequality among the various Member States).”

Moreover, it would not be “legally permissible for a national provision to be in open conflict with a European Regulation.” In this regard, there appears to be a conflict between the provision set forth in Article 2-terdecies of the Code and those set forth in Article 77 of the GDPR and Articles 140-bis and 141 of the Privacy Code, “insofar as they provide for the right to lodge a complaint with the Authority—a right to be understood, of course, as distinct from the aforementioned rights under Articles Articles 15–22 of the GDPR—limit this possibility to the data subject whose data is being processed, as the cited sources do not provide for any “extension” in favor of third parties in the event of the data subject’s death.” Furthermore, “the provision set forth in the second paragraph of Article 142 of the Privacy Code” would apply in a similar manner, which stipulates that ‘The complaint must be signed by the data subject or, with the data subject’s representation, by a third-sector entity … that is active in the field of protecting the data subject rights and freedoms …,’ since, in the present case, these requirements are entirely absent, since the complainants could not “assume the status of data subjects, with the further and obvious consequence that—even if, for the sake of argument, they were able to exercise the rights set forth in Articles 15–22 of the Regulation—they certainly cannot file any complaint under the aforementioned legislation. 2 See Article 2-terdecies of the Privacy Code, first paragraph”; - furthermore, Articles 136 and 137 of the Code would not be applicable to the cases at hand, as they derive “their legal basis from Article 85 of the GDPR, and thus from a specific article of a European Regulation that does not apply to data relating to deceased persons,” a circumstance that “is provided for in the Privacy Code only in Article 2-terdecies, certainly not in Title XII, entitled ‘Journalism, Freedom of Information, and Freedom of Expression,’ which includes Articles 136–139”; this would also apply with regard to the Code of Ethics.

The Data Protection Authority would therefore have “attributed to a deceased person the status of ‘data subject’ within the meaning of the GDPR and, consequently, of the Privacy Code, thereby therefore, that a series of provisions aimed at regulating the processing of personal data for informational purposes were applicable to the case at hand—provisions which, on the contrary, given the current regulatory framework, cannot apply to information relating to deceased individuals.” This would imply the absence of “grounds to justify the imposition of any sanctions by the Authority against RTI”; - in any case, even if the aforementioned provisions were applicable, since the so-called Garlasco case represents “a news story of renewed and widespread significance, not least due to recent developments that led to the reopening of the investigation and have once again drawn public attention to an event of particular interest,” the principle of data minimization should be applied “in such a way as not to hinder the proper exercise of the right to report news (and the right to critique news events).”

This is because “even Art 6 of the aforementioned Code of Ethics permits reporting, including ‘detailed’ reporting, when indispensable for describing the ‘specific circumstances’ in which the ‘event’ occurred,” and “the very principle of data minimisation, which requires that data be ‘adequate, relevant, and limited to what is necessary,’ certainly does not operate as an absolute criterion in the context of processing for journalistic purposes.” In fact, since “Article 85 of the GDPR, as is well known, constitutes lex specialis with respect to Article 5(1)(c4): in Member States that have adopted exceptions for journalistic purposes (such as Italy with Articles 136–139 of the Privacy Code, which will be discussed below),” the principle of data minimisation would yield “to the contextualized essentiality test, which requires not the absence of any data exceeding the absolute minimum, but proportionality with respect to the specific informational purpose pursued.”

Therefore, the Data Protection Authority would have applied “the principle of data minimization in a vacuum, without performing the necessary balancing against the freedom of information required by Article 85 of the GDPR and Article 10 of the ECHR,” contrary to the ruling of the European Court of Human Rights in Axel Springer AG v. Germany (Grand Chamber, February 7, 2012, paras. 83 and 84), “where it is stated that national authorities cannot mechanically apply principles that restrict freedom of the press without carrying out a genuine balancing of interests with the interest in information”; with specific reference to the report by XX, even though the complaint was aimed at challenging the use of only the “excerpt,” the Data Protection Authority instead “unilaterally expanded the objection beyond the Excerpt that was initially the subject of the complaint,” failing to “specify the additional Excerpts” to the extent that “neither is the duration of each segment specified, nor is the content of the images described in detail (they are defined in entirely general terms as ‘images depicting the area where Chiara Poggi’s body was found, some of which highlight the blood and parts of the victim’s corpse’)”.

The notification pursuant to Article 166, paragraph 5, of the Code would also appear to be “lacking any specification regarding the narrative context in which the images are embedded and the informational function they serve,” and, moreover, fails to make “make any qualitative distinction between images that depict only the crime scene (for example, the staircase) and images that depict (albeit in a very limited and partial manner) the victim’s body” and failing to explain “in any way why these additional images were not included in the request for information dated May 29, 2025, having been introduced only in the Communication itself.” This would, moreover, have prevented the Company from properly mounting its defense, since “RTI was unable to make specific comments on the excerpts identified independently by the Authority, as these had not been identified in the preliminary request,” since it would not have been able to refute each specific allegation; furthermore, the Authority exercised “an ex officio power which, even if deemed admissible, would in any case have required a separate hearing or, at the very least, the specification of the images deemed relevant during the preliminary investigation, prior to the initiation of the present proceedings”; - furthermore, still with reference to the episode of XX, it also notes that “the images clearly appear to be instrumental in illustrating the details of the crime scene, which are closely related to the subsequent legal proceedings and, a fortiori, to the current reopening of the case, with the primary objective of reconstructing the actual sequence of events and identifying possible inconsistencies between what was established in the previous instances of adjudication and the elements that have recently come to light” and that these aspects would be “useful in allowing viewers a clearer examination of the overall body of evidence, taking due account of the fact that the events have taken on new and undisputed significance, not least because of the details that have unofficially emerged regarding the brutality of the crime and the potential involvement of multiple individuals in the criminal act”.

Therefore, by publishing the excerpts, the Company would have “taken into consideration matters of strict public interest, in the exercise of its right to report the news—within the limits of the aforementioned principles—and to present an overall picture of a body of evidence that has proven particularly complex, even years later.” These excerpts, in fact, were “intended to complete the picture documented in the episode and to illustrate—among other things—any inconsistencies between what was found at the crime scene immediately following the murder and the new evidence that led to the reopening of the investigation.” In other words, the excerpts—far from intending to undermine the dignity of the victim and that of the parents—aimed to satisfy the public’s interest in learning about the new details that had emerged, in full exercise of the right to report the news, and to retrace the reconstruction of a criminal act that particularly affected and shocked the entire community.”

In this regard, the Company also noted that “Article 137, paragraph 3, under consideration does not create an absolute prohibition on the dissemination of forensic images: it establishes a necessary balancing test, requiring verification of whether the image is essential to understanding the incident” and that “the framework derived from the Code of Ethics is also consistent with this,” which “does not establish an absolute prohibition on published images, but rather provides for a contextualized test of essentiality and proportionality identical to that set forth in Art 137, paragraph 3, of the Privacy Code”. It follows from this that “the Code of Ethics and Art 137, paragraph 3, of the Privacy Code do not impose an automatic prohibition on images of corpses or injuries: they require that their dissemination comply with the principle of essentiality.” In addition, the distinction is highlighted between “images displayed for emotional impact—those showing the body or injuries for the sole purpose of shocking the public, without any connection to specific informational content”—and “contextualized forensic images: those included to support a technical explanation that could not be understood without the visual reference”; in particular, it is noted that the latter “may pass the test of essentiality when the functional connection is documented and specific.”

In this regard, it is observed that “in the case at hand, the clips served to illustrate—with specific references related to the condition of the scene and the location where the victim’s body was found—the arguments concerning the crime scene and the reconstruction of the crime that was the subject of the episode” and that “the verbal description of these circumstances—without visual support—would not have allowed the viewer to verify the plausibility of the theories presented during the episode, thereby depriving the episode of its essential informative function”; - furthermore, “the processing of the data contained in the Images appears strictly necessary to provide viewers with a complete reconstruction of the events leading up to the current reopening of the legal case, to which all news outlets and media are devoting extensive coverage, pending the conclusion of the investigation and the potential initiation of new criminal proceedings”; to this, on the other hand, it should be added that “the Images contested by the Authority include: either re-airings of the same Clip, or images of the crime scene entirely devoid of any reference to the victim’s body, or, furthermore, a single image of the victim’s body that is completely out of focus”; - to this, in any case, it should be added that: “the contested images, as already highlighted, serve multiple essential informational functions: (a) a documentary function: the images of the crime scene constitute visual evidence of the dynamics of the crime, an aspect closely linked to the informative purpose—both news reporting and critical analysis—pursued by the episode, which, in fact, critically reconstructs the dynamics of the murder, including by questioning certain elements of the prosecution’s reconstruction.

Otherwise, the interviewees would not have been able to explain the statements that were subsequently made in the report”; furthermore, “the Images are essential to the very content of the Report, which focuses on the manner in which the victim was attacked, from which it is reasonably possible to draw insights regarding the characteristics and peculiarities of the alleged perpetrator of the murder (as explained by the ballistics expert […]). By publishing the Images, RTI took into account matters of strict public interest, in the exercise of its right to report the news—within the limits of the aforementioned principles—and in providing an overall representation of a body of evidence that has proven particularly complex, even years later.” Furthermore, it is argued that the “claims of the Complainants” are unfounded, and in particular, the following argument: “for the purposes of understanding the news story being reported, there was no benefit whatsoever in broadcasting unedited footage of the leg of poor Chiara’s corpse, given that the average viewer certainly does not possess the technical knowledge of an expert capable of assessing whether the wound and bruises on the leg of Chiara’s corpse are consistent with the manner of the attack.”

Therefore, given that “the concept of ‘seriousness’ is not regulated in the relevant legislation but rather constitutes an entirely subjective and arbitrary requirement,” the Company clarified that “the individuals interviewed in the report are recognized as experts in their respective fields (as can be ascertained from a simple online search), certainly not individuals called upon to comment on the footage in a cursory and approximate manner […] without possessing the knowledge and professional qualifications required and necessary to express an opinion on such a heinous crime. Even the assertion that the individuals interviewed in the report never “participated in the murder investigation” is entirely irrelevant to the matter at hand; if the opposite were true, the processing of personal data relating to the victim by nearly all professionals who comment (on a daily basis) on images and information drawn from the news story in question would have to be prohibited.”

The images in question, therefore, should not be considered unlawful, “since they are intended to illustrate the assessments made by the interviewees, thereby concretely reflecting the principle of the essential nature of the information. Otherwise, as already reiterated, the interviewees would not have been able to illustrate the statements that were subsequently made in the report. In fact, it is not possible to maintain that there is an absolute and general prohibition on the publication of images; rather, a balance must be struck, on a case-by-case basis, that reconciles the right to confidentiality and respect for an individual’s privacy with the general right to news coverage and criticism, provided that this is done with a view to essentiality and for the purposes of completeness and fairness of the information provided, especially if it goes beyond merely satisfying the reader’s curiosity.”

RTI allowed them to express their opinions as such, without claiming that they constituted an official finding; nevertheless, both they and RTI clearly exercised the inalienable right to criticism, which, moreover, has even broader limits in judicial matters”; - with regard to the images broadcast by both television programs, there would therefore be a functional, specific, and verifiable connection. Furthermore, the Data Protection Authority failed to verify that, in terms of suitability, “the means used (i.e., the images) was suitable for the intended purpose (i.e., understanding the experts’ arguments)”; from the perspective of necessity, there “was no alternative means—equally effective in terms of information—that would have had a lesser impact on the victim’s dignity”; from the perspective of proportionality, the sacrifice of freedom of information was not proportionate to the benefit achieved in terms of protecting dignity.

In particular, it is disputed that the Data Protection Authority carried out these assessments at the outset of the sanctioning proceedings. This would appear to contradict the principles established by the European Court of Human Rights in the decisions Von Hannover v. Germany No. 2 (Grand Chamber, February 7, 2012, §§ 108–113) and Couderc and Hachette Filipacchi Associés v. France (Grand Chamber, November 10, 2015, §§ 90–939), since “the present case is clearly the subject of renewed public debate (reopening of the investigation) and the excerpts served to clarify the assessments regarding the reconstruction of the dynamics of the crime through the crime scene; without the Images, the content of the Episode would have been compromised.” In fact, it is noted that, from the perspective of contributing to a debate of public interest, without the Images, the Report would have been incomprehensible; from the perspective of the notoriety of the subject and the subject matter of the publication, “the ‘Poggi case’ is a legal news story of national significance”; from the perspective of the data subject’s prior conduct, this criterion would not apply to the deceased but is relevant for contextualizing the legitimate expectation of confidentiality; as regards the manner in which the Images were obtained, “the Images were derived from the records of the criminal proceedings, and the manner in which they were acquired was never contested by either the Complainants or the Authority”; as for the content, form, and consequences of the publication, “the images were presented within a structured analytical context and were not displayed for the sole purpose of creating an isolated emotional impact”; - furthermore, there is no reference to the principle of “editorial discretion” established by the European Court of Human Rights, according to which “journalists enjoy a margin of appreciation in editorial choices—including the decision to use striking visual material—provided that such choices are made in good faith and aimed at providing accurate information on matters of public interest (Jersild v. Denmark, § 3111; Bladet Tromsø and Stensaas v. Norway, Grand Chamber, May 20, 1999, § 65; see the Goodwin judgement, p. 500, § 39, and Fressoz and Roire, cit., § 5412)”; - finally, it would not be possible to rely on the April 24, 2008, [web doc. no. 1519915] issued by the Italian Data Protection Authority, due to a series of substantial differences between the present case and the precedent, including “a) the qualitative difference between the images: ‘gruesome’ vs. forensic […] b) The potentially unlawful acquisition of the images […] c) The absence of a functional link […] d) The time gap and the procedural context […] e) The changed regulatory framework […] f) The sanction imposed.”

Instead, it would be more appropriate to refer to the reasoning set forth in Decision No. 520 of October 8, 2015 [web doc. No. 4363110] of the Italian Data Protection Authority. 3. THE AUTHORITY’S ASSESSMENTS It should be noted at the outset that the Authority is called upon to rule on a case in which media attention has been—and continues to be—such that it goes well beyond the exercise of the right and duty to report the news, degenerating into a “continuous and morbid sensationalization,” contrary to the principle of essential reporting; this has been the case since the initial investigations and has resurfaced more recently with their reopening. This is a circumstance that the Authority has found itself compelled to condemn on multiple occasions, addressing the media in general and calling for due respect for the individual and their dignity—as both a safeguard and a guarantee for the victim, family members, suspects, and others involved in the legal proceedings in various capacities (Press Releases of December 14, 2007, August 24, 2007, January 30, and May 15, 2026 [web docs nos. 1469751, 1435264, 10215207, 10250954]).

It is within this context that certain specific instances of personal data processing were brought to the Authority’s attention, on which the Authority was formally asked to issue an opinion. In fact, following an examination of the statements made to the Authority during the proceedings, as well as the documentation obtained, it appears that during the episode of “XX” aired on XX (the website lists the date as XX), entitled “XX,” images were broadcast depicting the area where Chiara Poggi’s body was found, some of which specifically highlight blood and parts of the victim’s corpse. These images appear in various parts of the report, one of which is the segment highlighted by the complainants (the opening segment, known as the “Excerpt,” approximately the first 30 seconds); other similar images were found in subsequent parts of the report (reference is made to the original version, as included in the case file, and to the sections corresponding approximately to minutes [OMISSIS], some of which are also accompanied by detailed descriptions of the events.

In addition, there are some images—albeit blurred—depicting the victim’s body (min. 01:36:24). In this regard, it should be noted that the Authority, based on the issues raised in the complaint, extended its investigation during the preliminary inquiry to other parts of the program that contained the same images already shown in the excerpt, along with others depicting the victim’s body with a similar impact. This was done within the scope of the Authority’s investigative powers. With regard to the episode of “XX” aired on XX (approximately “from minute XX to minute XX”), it also appears that images were broadcast showing the leg of Chiara Poggi’s corpse, which displayed a wound and bruises, accompanied by detailed reconstructions of the possible events that led to those injuries With regard to the foregoing, it should be noted that, unless the act constitutes a more serious offense, anyone who, in proceedings before the Data Protection Authority, falsely declares or attests to facts or circumstances, or produces false documents or records, is liable under Art. 168 of the Code, “False Statements to the Data Protection Authority and Interference with the Performance of the Authority’s Duties or the Exercise of Its Powers.” 3.1.

Standing to File a Complaint With regard to the alleged lack of standing to file the complaint and the consequent inapplicability of Articles 136 and 137 of the Code, as well as the Rules of Professional Conduct, the following is noted. Art 4(1) of the Regulation provides that “personal data” means “any information relating to an identified or identifiable natural person.” In this regard, Recital 27, while specifying that the Regulation “does not apply to the personal data of deceased persons,” also states that “Member States may lay down rules regarding the processing of personal data of deceased persons.” By virtue of this, the Italian legislature has provided that “the rights referred to in Articles 15 through 22 of the Regulation concerning personal data relating to deceased persons may be exercised by anyone who has a legitimate interest, or who acts to protect the data subject as their representative, or for family reasons worthy of protection”.

There is, therefore, no contradiction between national law and EU law. On the contrary, the European legislature has taken into account the specific characteristics of individual national legal systems, leaving Member States the discretion to regulate the processing of data of deceased persons independently. In this regard, it should be noted that Art. 2-terdecies of the Code, introduced by Legislative Decree No. 10 of August 10, 2018, No. 101, stands in historical continuity with the provision set forth in the now-repealed Art. 9, paragraph 3, of the Code, which has also been repeatedly cited in the Data Protection Authority’s rulings (Ruling of April 24, 2008, web doc. No. 1519915, Provision of July 15, 2006, web doc. No. 1310796, and November 29 and December 6, 2007, web doc. Nos. 1478059 and 1478083). There is, therefore, no doubt that the Italian legislature, within the scope of the exception referred to in Recital 27 of the Regulation, intended to enshrine the continued existence of the rights set forth in Articles 15–22 of the Regulation even beyond the natural life of the natural person.

This provision has particular implications from a remedial perspective, as it allows “anyone who has an interest of their own, or who acts to protect the data subject as their representative, or for family reasons worthy of protection” to exercise the aforementioned rights with the controller on behalf of the deceased. It follows that even the “right to lodge a complaint with a supervisory authority” in the event of a violation of the provisions of the Regulation, as established by Art 77, cannot be interpreted restrictively, but, on the contrary, must be extended to include those who may exercise the rights set forth in Articles 15–22 of the Regulation, pursuant to the provision of Article 2-terdecies of the Code. This, moreover, is also confirmed by the relevant case law, which in several cases has upheld requests from individuals who, on the basis of Article 2-terdecies of the Code, exercised the rights set forth in Articles 15–22 of the Regulation with respect to personal data concerning deceased persons (Court of Milan, Order, February 9, 2021; Court of Bologna, Order, November 25, 2021; Court of Rome, Order, February 10, 2022).

Indeed, no lack of standing was found in the filing of a complaint seeking judicial protection by parties other than the data subject in the strict sense, based on Article 2-terdecies. Similarly, since there is no reason precluding the filing of a judicial appeal, there is no basis for finding a lack of standing in the filing of an administrative complaint with the Data Protection Authority. On the other hand, it would be entirely unreasonable to assume that the legislature intended to provide for the possibility of exercising the rights set forth in Articles 15–22 of the Regulation for “those who have an interest of their own, or who act to protect the data subject as their representative, or for family reasons worthy of protection,” without guaranteeing the possibility of obtaining effective protection in cases of refusal by the controller. It must therefore be considered undisputed that the persons entitled to exercise the rights set forth in Articles 15–22 of the Regulation pursuant to the provision of Article 2-terdecies of the Code are also entitled to appeal to the Data Protection Authority, pursuant to Article 77 of the Regulation and Article 141 of the Code, and, consequently, to file a complaint pursuant to Article 142 of the Code.

Therefore, in the present case, since the complainants are acting “to protect the data subject for family reasons deserving of protection” pursuant to Article 2-terdecies, there is no lack of standing in the filing of the complaint with the Data Protection Authority. 3.2 Applicability of Articles 136 and 137 of the Code and the Code of Ethics In order to clarify the issues concerning the applicability of Articles 136 and 137 of the Code, the following considerations must be made. Article 85 of the Regulation establishes that the laws of Member States must balance data protection with the right to freedom of expression and information, “including processing for journalistic purposes or for academic, artistic, or literary expression.” In particular, with regard to processing carried out for such purposes, the same article provides that Member States shall establish “exemptions or derogations from Chapters II (principles), III (data subject rights), IV (controller and processor), V (data transfers to third countries or international organisations), VI (independent supervisory authorities), VII (cooperation and consistency), and IX (specific data processing situations), where such exemptions or derogations are necessary to reconcile the right to data protection with the freedom of expression and information.”

Accordingly, Article 136 of the Code provides that processing carried out “in the exercise of the profession of journalism and for the sole purpose of pursuing the related purposes” or “by individuals listed in the register of journalists or in the register of trainees” or intended “exclusively for the publication or occasional dissemination of articles, essays, and other expressions of thought, including in academic, artistic, and literary contexts,” special rules apply pursuant to Article 85 of the Regulation With regard to the dissemination of data for the purposes mentioned above, Article 137, paragraph 3, specifically provides that “the limits on the right to report news to protect the rights referred to in Article 1, paragraph 2, of the Regulation and in Article 1 of the […] Code and, in particular, the requirement that the information be essential with regard to matters of public interest.”

Furthermore, it should also be noted that, by Resolution No. 491 of the Data Protection Authority dated November 29, 2018, published in the Official Gazette No. 3 of January 4, 2019, the Code of Ethics for Journalistic Activities, Annex A.1 to the Code, were adopted. Art 6 of the Code of Ethics establishes that the disclosure “of news of significant public or social interest does not conflict with respect for privacy when the information, even if detailed, is indispensable due to the originality of the event or the description of the specific circumstances in which it occurred, as well as the characterization of the key figures.” Furthermore, Art 8 of the Code of Ethics provides that, subject to the essential nature of the information, journalists shall not report news or publish images or photographs of individuals involved in news events that are detrimental to human dignity, nor shall they dwell on “details of violence, unless they recognize the social relevance of the news or the image.”

Now, in light of what has been noted thus far, the combined provisions of Article 85 of the Regulation, Articles 136 et seq. of the Code, and the Code of Ethics establish the conditions for the lawfulness of personal data processing carried out for journalistic purposes. In fact, if the processing does not fall under the specific exception provided for the journalistic field, and in the absence of another valid legal basis, it must be considered unlawful. In this regard, it should be noted that Art. 17(1)(d) provides that if personal data are processed unlawfully, “the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase the personal data without undue delay.” That said, a review of the video footage obtained and the official records reveals that the dissemination of images depicting the interior of the complainants’ home—and, in particular, the area where Chiara Poggi’s body was found “covered in copious bloodstains” and of the legs of her corpse “lying face down on the stairs with her head turned toward the lower steps” (aired during the XX broadcast on XX) as well as the images—depicting the leg of her daughter Chiara’s corpse, which showed a wound and bruises (broadcast as part of the XX program on XX) —cannot be justified on the grounds of the “essential nature of the information regarding matters of public interest,” and that such dissemination constituted a serious violation of the dignity of the victim and her family.

Therefore, with regard to these images, the family members have the right to request their erasure, and the publisher is obligated to erase them, as they were published without a valid basis of lawfulness and, therefore, unlawfully. Given the lack of essentiality of the information and the absence of social relevance in the images broadcast, it must be considered unlawful that the episode of XX aired on XX focused on details of violence, such as the area where Chiara Poggi’s blood-stained body was found and the legs of the corpse lying face down on the stairs. A similar assessment applies to the episode of XX aired on XX and to the images depicting the leg of Chiara Poggi’s corpse, which showed a wound and bruises. Moreover, these aspects are independent of whether or not a deceased person is classified as a “data subject,” nor do they affect the continued existence of the rights set forth in Articles 15–22 of the Regulation held by family members who wish to preserve the deceased’s dignity. 3.3.

On the Violation of the Principle of Essentiality and the Principle of Minimization Having clarified the preliminary issues regarding the complainants’ standing and the applicability of the special provisions set forth in Articles 136 et seq. of the Code, as well as the Code of Ethics for Journalists, the following observations are made regarding the objections raised on the merits. As previously noted, the Regulation and the Code have established special provisions aimed at balancing the right to data protection with the freedom of expression and information. However, exemptions and derogations from the general rules on the processing of personal data do not exempt those who process data in the exercise of freedom of expression and information from respecting the rights, fundamental freedoms, and dignity of the individuals to whom the processed data relate (Articles 1(2) and 85 of the Regulation; Articles 1, 136–139 of the Code) and require them to comply with certain principles, including that of the “essentiality of the information regarding matters of public interest” (Article 137, paragraph 3 of the Code).

This principle—an elaboration of the more general principle of data minimisation (Article 5(c) of the Regulation)—is specified in the Code of Ethics, compliance with which constitutes “an essential condition for the lawfulness and fairness of processing” (Article 2-quater of the Code). The Code of Ethics, on the other hand, expressly sets a limit on the disclosure of details of violence or images or photographs of individuals involved in news events that could prove harmful to a person’s dignity (Art 8). As repeatedly emphasized by the Data Protection Authority, these safeguards do not cease upon the death of the individual and may also be invoked by family members to protect the memory and dignity of the deceased (Art. 2-terdecies of the Code and, among others, Provision No. 701 of October 23, 2025, web doc. No. 10218967). Turning to the specific case addressed in this ruling, as also noted by the Company, the so-called Garlasco case represents “a news story that has gained renewed and widespread attention, in part due to recent developments that led to the reopening of the investigation and have once again drawn public attention to an incident of particular interest.”

Therefore, as already noted in the previous point, the publication of images showing the family home covered in blood and parts of the corpse cannot be justified on the grounds that the information is essential. Consequently, since the information conveyed by the images in question during the episode cannot be considered essential for the purposes of recounting the events, they should not have been published pursuant to Art. 8 of the Code of Ethics. Furthermore, it should be noted that the broadcast of images depicting the area where Chiara Poggi’s body was found—with particular emphasis on the blood—as well as images depicting the victim’s corpse or, in any case, parts of it, constitutes a violation of the principle of data minimisation set forth in Article 5, paragraph 1, subparagraph c), according to which data must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed,” of which the essential nature of the information, as already noted, is an elaboration.

Indeed, the Data Protection Authority, in balancing the right to confidentiality with the right to freedom of expression—from which both the right to inform and the right to be informed derive—has concluded that the images of the bloodstains and the legs of Chiara Poggi’s body, as well as those specifically showing the wound and bruises, are unjustifiably harmful to the personal dignity of the victim and her family without adding anything to the account of the facts and events related to the legal case that journalists intend to report. In fact, no additional information can be gleaned from viewing these images, neither for the benefit of those contributing to the public account of the incident nor for citizens seeking to learn about the facts and circumstances of the crime. Furthermore, the images in question do not even serve to lend an element of originality to the news reported in the story, as they do not present any “new” details beyond what has already been extensively reported previously.

It appears, in fact, that the legitimate exercise of the right and duty to report on a matter of undoubted public interest has led the publisher in this case (though this is clearly a widespread trend) to assign the user (viewer or reader) the role of an “expert” to whom the evaluation of “scientific” data emerging from judicial investigations is entrusted: the so-called “forensic images,” to quote the publisher’s arguments. This approach, however, falls outside the scope of journalistic practice and inevitably ends up shifting the boundaries and legal basis for its actions. The publication of images of the victim’s blood and corpse—or parts thereof—therefore fails to meet the proportionality test, as the sacrifice of dignity and confidentiality required is not justified in light of the informational benefits that the broadcast of such images has brought to the public debate and to citizens.

It is precisely this circumstance that should have led journalists, within the so-called margin of editorial discretion, to choose not to broadcast such images as part of their television reports. Consequently, it must be concluded that the broadcast of the images of the victim’s corpse violated Article 5, para 1, subparagraphs (a) and (c), and Article 85 of the Regulations; Articles 136 et seq. and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 to the Code and, consequently, Article 2-quater of the Code. For the reasons set forth above, the Authority considers that the statements, documentation, and explanations provided by the controller during the investigation do not address the findings notified by the Office in the notice initiating the proceedings and are therefore insufficient to allow for thedismissal of this proceeding, as none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply.

The processing carried out by the company is, in fact, unlawful, under the terms set forth above, in relation to Articles 5(1)(a) and (c) and 85 of the Regulation, Articles 136 et seq. and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 of the Code and, consequently, Article 2-quater of the Code. 5. CORRECTIVE MEASURES While acknowledging the removal of certain parts of the episode aired on XX at XX, we note the persistent display of certain images (the copious presence of blood on the stairs and the victim’s body, approximately at [OMITTED] seconds and [OMITTED] of the current version of the episode available online) that constitute excessive content in light of the protective considerations set forth above. In light of this, it is deemed appropriate to order, pursuant to Art. 58, para 2, letter f), a prohibition on the processing of these images, similar to those already removed.

Therefore, pursuant to Art. 58, para 2, subparagraph f) of the Regulation, we hereby prohibit the further dissemination of images of bloodstains and body parts of the victim as indicated in the notice of violation, as well as the dissemination of the images referred to at [OMISSIS] seconds and [OMISSIS] minutes of the current version of the episode available online. Furthermore, taking note of the removal of the images broadcast during the episode of “XX” on XX (approximately “from minute XX to minute XX”) depicting the leg of Chiara Poggi’s corpse, which showed a wound and bruises, pursuant to Article 58, para 2, subparagraph f of the Regulation, we hereby prohibit the further dissemination of the aforementioned images as specified in the notice of violation It is further noted that the conditions set forth in Art. 17 of Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at the performance of the tasks and the exercise of the powers entrusted to the Data Protection Authority, are met. [OMITTED] FOR THESE REASONS Pursuant to Articles 57 and 83 of the Regulation, the processing carried out by RTI S.p.A., with registered office in Rome, Largo del Nazareno, No. 8, Tax ID No. 03976881007, pursuant to Article 143 of the Code, for violating Articles 5(1)(a) and (c) and 85 of the Regulation, Articles 136 et seq. and, in particular, Article 137 of the Code, as well as Articles 6 and 8 of the Code of Ethics set forth in Annex A1 of the Code and, consequently, Article 2-quater of the Code; pursuant to Article 58, para 2, subparagraph f of the Regulation, a prohibition is imposed on the further dissemination of the images a) relating to bloodstains and body parts of the victim as indicated in the statement of charges, as well as a prohibition on the dissemination of the images referred to at the [OMISSIS] seconds and [OMISSIS] minutes of the current version of the episode of “XX” from XX available online; b) depicting the leg of Chiara Poggi’s corpse, which showed a wound and bruises, as broadcast during the episode of “XX” on XX; [OMISSIS] IT IS HEREBY ORDERED - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this order be published on the Data Protection Authority’s website; - pursuant to Art. 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation in the Authority’s internal register provided for by Article 57, para 1, letter u), of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts by submitting a petition to the ordinary court of the location specified in the aforementioned Art 10, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori