Italian DPA: Il Fatto Quotidiano must erase data subject's personal data from cable car

[Web Doc. No. 10273039] Decision of July 3, 2026 Register of Decisions No. 491 of July 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “Regulation”); HAVING REGARD TO the Code on the Protection of Personal Data (Legislative Decree No. 196 of June 30, 2003) (hereinafter the “Code”); HAVING REGARD TO the Code of Ethics concerning the processing of personal data in the exercise of journalistic activities, as set forth in Annex 1 of the Code (hereinafter “Code of Ethics”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation No. 1/2019 of the Data Protection Authority”); HAVING REGARD TO the documentation on file; HAVING REGARD TO the observations submitted by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the Office of the Data Protection Authority, adopted by resolution of June 28, 2000 (web doc. No. 1098801); RAPPORTEUR: Prof. Ginevra Cerrina Feroni;

Origin of the preliminary investigation In a complaint received by this Authority on February 29, 2024, Ms. XX (hereinafter the “complainant” or “the affected party”), through her legal representative, Attorney XX, complained of the harm resulting from the continued online availability—in association with her name—of an article published on January 4, 2024, by the newspaper “Il Fatto Quotidiano” —published by Società Editoriale Il Fatto S.p.A. (hereinafter also “the publisher” or “the Company”)—regarding the tragic XX cable car accident that occurred on May 23, 2021. The article in question—titled “XX” (accessible at the link https://...)—according to the data subject, presents a “misleading, sensationalist, and at times untruthful” account of the facts described therein. In particular, the article includes the complainant’s identifying information—who, at the time of the events, was an employee of the company “Ferrovie del XX” — and reports that she was admitted to the XX ward of XX Hospital in the days immediately following the aforementioned incident. According to the journalist’s account, the complainant allegedly faced pressure from her employer regarding information she was said to be aware of “and which she could have disclosed to the investigators.” This editorial content would therefore be likely to lead readers to mistakenly believe that the complainant was involved in the criminal proceedings arising from the aforementioned events, even though she had never “ever been a person under investigation or a defendant, but rather solely a person informed of the facts—as is obvious, especially regarding the organizational aspects of Ferrovie del XX, having worked there for some time.” In the complaint in question, the complainant requested the deletion of her personal data contained in the article in question, its removal “from the website and online archive of *Il Fatto Quotidiano*,” as well as its deindexing, in response to the Company’s refusal on February 1, 2024, of the preliminary inquiry submitted on January 29; This was because, according to the publisher, the article—concerning “a matter of undoubted public interest”—was produced in the legitimate exercise of the right to report the news, and the reference to the data subject, “who was never identified as a subject of the investigation, […] is entirely relevant […] to the subject matter, given that her name appears numerous times in the investigation files, exactly as reported by the journalist […].”

Actions Taken By letter dated October 18, 2024 (Ref. No. 122100/24), the data controller was asked to provide comments, pursuant to Article 157 of the Code, regarding the matters raised in the complaint. In response to the aforementioned request, the data controller, in a communication dated November 6, 2024, confirmed the lawfulness of the processing in question, since the disclosure of the complainant’s personal data—including those relating to her hospitalization in the XX ward of XX Hospital—was, in the data controller’s view, “indispensable for providing adequate and complete information” on the matter in question. In particular, the journalist considered the complainant to be a key figure in the matter, partly due to the romantic relationship she had had in the past with one of the suspects, the manager of the company “Ferrovie del XX.” Indeed, prior to the aforementioned hospitalization, the complainant “had expressed her intention to provide the judicial authorities with information useful for clarifying the matter, for which she felt guilty.” Only after her hospitalization—and especially following a meeting at the hospital with her employer and former partner, who was under investigation in the legal case—did the complainant reportedly offer a different account from the one she had originally provided, one that redefined the entire framework of the charges. This reportedly led the journalist to speculate that the employer had influenced the complainant’s change in her account of events, as evident from the very title of the article in question. “Solely to accommodate the complainant’s requests and without the decision being interpreted as an implicit admission of liability,” the Company stated that it had proceeded to de-index the article in question. The response provided by the owner to the Office’s aforementioned request for information—which was initially sent to the complainant at an incorrect certified email (PEC) address—was resent on November 20, 2024, to the correct address indicated in the initial complaint. On November 29, 2024, the complainant submitted a reply in which she essentially reiterated the arguments already set forth in the complaint. In particular, she pointed out that the news report in question was the result of the journalist’s personal reconstruction of events, which was contradicted by the investigative records themselves—both regarding her central role in the criminal proceedings and the alleged “attempts to coerce” her employer aimed at preventing her from filing a complaint against him. The complainant also emphasized that the conduct attributed to her and described in the article in question needed to be contextualized, as it was linked to an evident state of psychological and physical shock caused by the tragic events described therein, as would be evident from the preliminary witness statements provided by the attorney for the company involved in the wake of the cable car accident. Finally, this editorial content—which, moreover, contained inaccurate information regarding the complainant’s job title (she held the position of clerk and not Deputy Administrative Director of the company, as stated in the article) — does not appear to have been “removed from the web, as it is still accessible” on the social network “XX” of “Il Fatto Quotidiano.” On December 10, 2024, the data controller outlined the subsequent financial investigations conducted by the investigators against the complainant “confirming the role that [she] would have had or could have had” in the events described. Furthermore, in stating that it could not proceed with the removal of the editorial content from its archive, the Company emphasized that de-indexing constitutes “the best option for balancing the preservation of historical memory with the complainant’s request that the article no longer be displayed when her personal details are entered.” In light of this, on May 29, 2025, this Authority requested that the complainant provide the necessary clarifications regarding the additional comments submitted by the Company, with particular reference “to the alleged financial investigations conducted against her and which, in the account provided by the data controller, would suggest issues of possible criminal relevance, as well as imply a central role that [she] allegedly played in the news story recounted in the article in question” (Ref. No. 77388/25). In a communication dated June 4, 2025, the complainant confirmed that she had always held the role of “person informed of the facts” and, noting that in a criminal investigation it is entirely normal for investigations “to extend even to current or former employees of a company […],” she stated that the described financial investigations conducted against her “simply portrayed her as a single person living with her immediate family, with average income and as the owner of her own home.” Furthermore, while she considered the publisher’s initial decision to de-index the article in question to be commendable, she noted that the editorial content in question had once again become searchable online in association with the search term “XX.” Specifically, “when typing those words into major search engines (Microsoft Bing and Google), the first result that appears is precisely the full article published on the XX portal, and users have the option to download the January 4, 2024, issue of Il Fatto Quotidiano for just a few euros.” Therefore, the complainant—in the event that “this Authority does not deem the request for immediate removal of the article to be proportionate”— —has requested “the deletion—through anonymization—of [her] personal data […],” as well as the de-indexing of the article “from every search engine, including other publishing platforms affiliated with the Data Controller, such as XX.”

Initiation of proceedings (Art. 166, paragraph 5, of the Code) Based on the evidence gathered during the activities described above, by notice dated June 18, 2025 (Ref. No. 86921/25), served pursuant to Art. 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures referred to in Article 58, paragraph 2, of the Regulation against the data controller, inviting the latter to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The alleged violations in question concerned the following provisions: - Articles 137, paragraphs 1 and 3, 139, and 2-quater of the Code; - Articles 5, 6, paragraph 1, and 10 of the Code of Ethics; - Article 5, paragraph 1, subparagraphs (a) and (c), of the Regulations. This is because the publication in question—which also involved data capable of revealing the complainant’s state of health—appears to have taken place in violation of the principle of “essentiality of information,” as well as the principles of lawfulness, fairness, and data minimization in the processing of personal data.

Defenses of the Party (Article 166, paragraph 6, of the Code) In a brief received on July 14, 2025, the data controller requested that the proceedings initiated against it be dismissed “due to the cessation of the subject matter of the dispute,” given that the article cited in the complaint had been permanently removed from the online archive of the news outlet in question. In particular, the Company stated that this action was taken solely to “accommodate the complainant’s needs,” expressly clarifying that the decision could in no way be interpreted as an implicit admission of liability regarding the allegations raised. In reiterating the arguments already presented during the preliminary investigation, the publisher argued that the article in question merely reported information drawn from investigative records, which indicated the complainant’s significance in the context of the story being told, even though she had acted solely as a person with knowledge of the facts. According to the defense’s argument, this circumstance was consistently reflected in the editorial content in question, in which no responsibility other than or in addition to that resulting from the investigative framework—which did not include her involvement as a person under investigation—was in any way attributed to the complainant. The publisher further argued that a different narrative approach—one based on omitting the complainant’s identifying information and the role she played in the incident—would have compromised the very comprehensibility of the journalistic report. In support of this claim, the company submitted a version of the article devoid of any identifying references to the complainant, pointing out that the proposed solution would, in its view, have resulted in an altered or incomplete representation of the facts, thereby infringing upon the right to report the news. In particular, according to the publisher, the removal of references to the complainant’s professional role would have made “incomprehensible” the content of the news story, especially with regard to her initial admission of responsibility, and could even have generated distorting effects, such as a generic “witch hunt against the former employee,” which could involve third parties completely unconnected to the matter. Based on these considerations, the publisher determined that the article had been written in accordance with the principle of essential information, as well as in compliance with the code of ethics applicable to journalistic practice, which would allow the journalist “to report not only the personal details of individuals involved in any capacity in criminal proceedings, but also their sensitive personal data—which, moreover, was derived from specific judicial documents […]”—provided that such elements are indispensable for ensuring adequate coverage of events of significant public interest.

ASSESSMENTS BY THE AUTHORITY In light of the evidence gathered in the course of this proceeding and the statements made by the data subject, pursuant to Article 168 of the Code, the following legal assessments are provided. First, it should be noted that the article cited in the complaint appears to have first been deindexed by major search engines and then removed from the online archive of the news outlet in question, as verified by the Office upon accessing the relevant link, which now redirects to a page that is no longer available. According to the data subject, the article in question is currently found among Google search results associated with her name, constituting a processing of personal data distinct from that which is the subject of this proceeding and which refers to the XX publishing platform. It follows that, with regard to the processing in question, the conditions for intervention by this Authority do not exist, as it is not included within the scope of these proceedings, as defined by the relief sought in the complaint filed by the data subject. In any case, the complainant retains the option to contact the aforementioned platform in accordance with the procedures indicated by the platform itself, as well as, independently, to contact the search engine operator, should descriptive snippets, cached copies, or other references associated with her name. This is to obtain the de-indexing of such results and ensure full and effective protection against the continued display of content that is no longer available at the original source. That said, the article that is the subject of the complaint contains information regarding the complainant’s health, which has been made identifiable through the publication of her identifying information. The dissemination of such data concerning the complainant—who, moreover, does not appear to be involved in the criminal proceedings arising from the aforementioned incident and who, instead, reportedly served solely as a “person informed of the facts”— —does not appear to comply with the principles of lawfulness, fairness, and data minimization, nor with the limits imposed by the principle of “essentiality of information.” The fact that the news story involved matters of public interest does not, in fact, automatically justify the disclosure of the identifying information of the individuals mentioned, especially when such details are not strictly essential to understanding the facts reported. In the present case, the informational purpose pursued could have been fully satisfied through a narrative that, while maintaining reference to the factual context, the role played by the data subject in the incident, and the statements she made immediately following the events—which were subsequently revised or denied—would nevertheless omit her personal details. In other words, the public interest underlying the dissemination of the news concerned the historical event and its implications, not the need to make immediately identifiable the individual who, at that stage, had merely provided statements as a person informed of the facts. Therefore, the assertion that the omission of the complainant’s name compromised the completeness or comprehensibility of the information cannot be accepted. From a narrative perspective, what was relevant was the description of the events, the role played by the complainant at the time of the events, and the statements she made during the investigation; her identification by name, on the other hand, constituted an additional element, not essential for the exercise of the right to report the news, but rather amounted to surplus information capable of significantly amplifying her public exposure. This assessment is further supported by the specific narrative approach adopted in the article, which reportedly included statements made by the individual in question during a period of particular psychological distress, while also dwelling in great detail on the circumstances of her hospitalization. Precisely the particular vulnerability of the context in which these statements were made, together with the disclosure of medical information, would have required an even greater degree of caution in the disclosure of personal data, in order to avoid infringing upon the dignity and privacy of the individual concerned; this also taking into account the role the complainant played at that stage as a person with knowledge of the facts and her lack of involvement in the criminal proceedings. Furthermore, the digital context in which the publication took place is significant. The indexing of the article by common search engines has, in fact, led to a widespread dissemination of personal information regarding the complainant, with prejudicial effects likely to persist well beyond the time of the original publication. In this regard, the immediate association between the data subject’s name and a story characterized by significant media attention could have had a significant impact on her personal and professional reputation, especially considering that the story’s national resonance is such that it is periodically brought back to the attention of the public. It should also be clarified that this assessment does not, nor could it, affect the journalist’s editorial decision to cover a story of public interest, nor does it amount to an undue restriction of the right to report news or freedom of the press, both of which are constitutionally guaranteed. The subject of the dispute is not, in fact, the publication of the news story itself, nor the right and duty to report on matters of public importance; rather, the focus is on verifying whether the coverage complied with the principles of informational necessity and data minimization. From this perspective, the central issue does not lie in the decision to publish the news story in question, but rather in whether, within the context of the related narrative, it was necessary to reveal the complainant’s identity to the public during a purely investigative phase. It was precisely the fact that the data subject was not involved in any legal proceedings at the time of the publication in question that made it all the more urgent to protect her privacy, thereby preventing a person not implicated in any criminal charges—at least at that specific stage of the investigation—from being exposed and associated with a particularly serious incident. The proper balance between the right to report the news and the protection of personal data should, therefore, have been achieved through less intrusive narrative methods, capable of preserving the essential elements of the news story without disclosing information that is not strictly necessary. In this regard, it should be noted that the Code, by introducing in general terms the aforementioned principle of the essential nature of information as a guiding standard for the publication of personal data in journalism, intended to ensure greater rigor in the collection and dissemination of data capable of revealing a person’s state of health, while entrusting the sector-specific Code of Ethics provided for in Article 139 with the task of identifying more precise limits in this regard (see Article 137, paragraphs 1 and 3, of the Code). These limits are set forth in Article 5 of the Code of Ethics, which states that “When collecting data [...] capable of revealing health conditions [...], the journalist shall guarantee the right to information on matters of public interest, while respecting the essential nature of the information [...]”—and in Article 10 of the aforementioned Code of Ethics, which provides that “when referring to the health condition of a specific person—whether identified or identifiable—the journalist shall respect that person’s dignity, right to privacy, and personal dignity, especially in cases of serious or terminal illnesses, and shall refrain from publishing analytical data of strictly clinical interest” (see, among others, Decision No. 30 of January 25, 2018, web doc. No. 8364982, at www.gpdp.it). It follows that the editorial content in question appears to constitute processing that does not comply with the principles of lawfulness and fairness, as well as data minimization, as set forth in Article 5(1)(a) and (c) of the Regulation. The complainant’s identifying information does not, in fact, appear to be indispensable for a thorough account of an incident that could just as easily have been the subject of a detailed news report. Furthermore, the description of the circumstances surrounding the hospitalization—characterized by a particularly detailed account—also appears to exceed the limits of relevance and proportionality. The detailed account of the complainant’s statements, together with the particularly vivid and almost “sensationalized” portrayal of her psychological and physical condition, does not appear strictly necessary for the mere purpose of informing readers about a situation of vulnerability or distress, but rather takes on the characteristics of an undue overexposure of the individual, to the point of diverting the reader’s attention from the actual news being reported. From this perspective, the dissemination of information pertaining to a particularly sensitive personal and health-related matter, as described above, ultimately exceeds what is necessary to satisfy the public interest in knowing the facts, straying into a narrative that is prejudicial to the complainant’s dignity, privacy, and reputation.

CONCLUSIONS In light of these considerations, the allegations set forth in the notice initiating the proceedings pursuant to Article 166 of the Code are upheld, since the statements made during the investigation and the defenses raised by the data controller are insufficient to rebut the findings made by the Office, and, moreover, none of the cases provided for in Article 11 of Regulation No. 1/2019 apply. Therefore, the Authority finds that the conduct of the data controller was unlawful, in violation of Articles 137(1) and (3), 139, and 2-quater of the Code, 5, 6(1), and 10 of the Code of Ethics, as well as the general principles of lawfulness, fairness, and data minimization in the processing of personal data referred to in Article 5(1)(a) and (c) of the Regulation.

CORRECTIVE MEASURES Having thus established the unlawfulness of the aforementioned conduct: - the Authority acknowledges that the data controller removed the contested article in its defense brief; as such, there are currently no grounds for the Authority to take further action; - with regard to the processing already carried out and for deterrent purposes, it is considered that the conditions for the imposition of an administrative fine pursuant to Articles 58(2)(i) and 83(5) of the Regulation are met.

ORDER OF INJUNCTION Based on the foregoing, for the purposes of quantifying the administrative fine, the aforementioned Article 83(5) of the Regulation—which sets the maximum penalty at 20 million euros or, for undertakings, 4% of the annual worldwide turnover for the preceding fiscal year if higher, specifies the methods for determining the aforementioned fine, which must “in any case [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors—listed in paragraph 2—to be assessed when determining the relevant amount. The circumstances to be taken into account in this case, from the perspective of aggravating factors, are: 1. the gravity of the violation, the level of which—based on the factors set forth in Article 83(2)(a), (b), and (g) of the Regulation (see the document “Guidelines 04/2022 on the Calculation of Administrative Fines under the GDPR—Version 2.0—adopted on May 24, 2023”)—has been deemed moderate, in light of the nature, characteristics, and consequences of the processing carried out. In particular, the following factors are relevant: (a) the nature of the data involved, relating exclusively to the data subject’s state of health—to which the Regulation grants enhanced protection—as well as the manner of their dissemination, characterized by a “sensationalized” portrayal of the data subject’s psychological and physical condition, which exceeded the informational needs underlying the news report and was likely to amplify the intrusion into her private life, resulting in harm to her dignity and reputation (Art. 83, para. 2, subpars. a and g, of the Regulation); b) the harm caused to the data subject, whose vulnerable condition was extensively discussed in an article that remained indexed for a significant period through common search engines, until the Authority intervened and the editorial content was subsequently removed. It follows that linking the article to the data subject’s name resulted in the widespread dissemination of personal information concerning her and, therefore, indiscriminate access by an unspecified audience of users; this would thus have caused significant harm to the complainant’s privacy, which persisted for nearly a year from the time of the original publication (Article 83(2)(a) of the Regulation); 2. the grossly negligent nature of the conduct, given that the Company, by virtue of its organizational structure and the activities it carries out, should have possessed sufficient experience and expertise to enable it to make editorial decisions more in line with the applicable regulatory framework. In particular, the Company was required to comply with the principle of essentiality of information regarding matters of public interest, carefully balancing the right to report news against the protection of the fundamental rights and freedoms of the individuals concerned, with specific attention to the sensitive nature of the data processed, particularly those relating to health. This assessment is further confirmed by the fact that the data controller, even during the proceedings, continued to maintain the lawfulness of the publication in question, although the Authority had already highlighted—at the time of the formal notice—the need to comply with the core principles of journalistic practice; this highlighted the data controller’s persistent reluctance to respect the limits set by the law, underscoring the significant degree of negligence that characterized its conduct (Article 83(2)(b) of the Regulation); 3. the existence of previous proceedings initiated against the Company for violations related to the same subject area, with particular reference to the principle of the essential nature of information in the practice of journalism (see Decision No. 62 of March 2, 2023; Decision No. 60 of February 12, 2025; Decision No. 126 of February 27, 2025). The described conduct does not, therefore, appear to be an isolated incident, but rather indicates a well-established and repeated practice over time that does not comply with the obligations and principles set forth in the regulations governing the protection of personal data, which have been explicitly stated on multiple occasions in the decisions issued specifically against this same data controller (Article 83(2)(e) of the Regulation). The following mitigating factors must be taken into consideration: 1) the removal of the article that was the subject of the complaint, although this occurred only after the initiation of these proceedings (Article 83(2)(c) of the Regulation); 2) the purposes pursued by the data controller, which are attributable to the freedom of information referred to in Article 85 of the Regulation and Articles 136 et seq. of the Code. Based on all of the above elements, in application of the aforementioned principles of effectiveness, proportionality, and dissuasiveness set forth in Article 83(1) of the Regulation, and taking into account, the necessary balance between the rights of data subjects and the freedom of enterprise—including to limit the economic impact of the sanction on the data controller’s organizational, operational, and employment needs—it is deemed appropriate to impose on the data controller – Società Editoriale Il Fatto S.p.A. – an administrative fine in the amount of 23,750.00 euros (twenty-three thousand seven hundred fifty/00). In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of Regulation No. 1/2019, the additional penalty of publishing this decision—which contains the injunction order—on the Data Protection Authority’s website should be imposed, given the particularly serious nature of the violations identified. Finally, the conditions set forth in Article 17 of Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Authority, for the recording of the violations identified herein in the Authority’s internal register, as provided for in Article 57, paragraph 1, letter u), of the Regulation. FOR THESE REASONS Pursuant to Article 57(1)(f) of the Regulation, and having acknowledged that the article in question has been removed, the conduct of the data controller is hereby declared unlawful – Società Editoriale Il Fatto S.p.A., with registered office at Via di Sant’Erasmo 2, 00184 – Rome (VAT No. 10460121006) – as described in the grounds set forth herein; IT IS ORDERED pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the aforementioned data controller pay the sum of 23,750.00 euros (twenty-three thousand seven hundred fifty/00) as an administrative fine for the violations indicated in the grounds of the decision. IT IS ORDERED that the aforementioned data controller, in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, pay the sum of 23,750.00 euros (twenty-three thousand seven hundred fifty/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which enforcement measures will be taken pursuant to Article 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the penalty imposed within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; IT IS HEREBY ORDERED a) pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of Regulation No. 1/2019, that this order be published on the Data Protection Authority’s website; b) pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of Regulation No. 1/2019, the publication of the injunction order on the Authority’s website; c) pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with the ordinary courts, by filing an appeal, alternatively, with the court of the place where the data controller resides or has its registered office, or with the court of the place of residence of the data subject, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori [Web Doc. No. 10273039] Decision of July 3, 2026 Register of Decisions No. 491 of July 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “Regulation”); HAVING REGARD TO the Code on the Protection of Personal Data (Legislative Decree No. 196 of June 30, 2003), (hereinafter “Code”); HAVING REGARD TO the Code of Ethics concerning the processing of personal data in the exercise of journalistic activities, as set forth in Annex 1 of the Code (hereinafter “Code of Ethics”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and on www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); HAVING REGARD TO the documentation on file; HAVING REGARD TO the observations submitted by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the Office of the Data Protection Authority, adopted by resolution of June 28, 2000 (web doc. No. 1098801); RAPPORTEUR: Prof. Ginevra Cerrina Feroni; 1 FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1 Origin of the Preliminary Investigation In a complaint received by this Authority on February 29, 2024, Ms. XX (hereinafter the “complainant” or “the affected party”), through her legal representative, Attorney XX, complained of the harm resulting from the continued online availability—in association with her name—of an article published on January 4, 2024, by the newspaper “Il Fatto Quotidiano” —published by Società Editoriale Il Fatto S.p.A. (hereinafter also “the publisher” or “the Company”)—regarding the tragic XX cable car accident that occurred on May 23, 2021. The article in question—titled “XX” (accessible at the link https://...)—according to the data subject, presents a “misleading, sensationalist, and at times untruthful” account of the facts described therein. In particular, the article includes the complainant’s identifying information—who, at the time of the events, was an employee of the company “Ferrovie del XX” —and reports that she was admitted to the XX ward of XX Hospital in the days immediately following the aforementioned incident. According to the journalist’s account, the complainant allegedly faced pressure from her employer regarding information she was said to be aware of “and which she could have revealed to investigators.” This editorial content would therefore be likely to lead readers to mistakenly believe that the complainant was involved in the criminal proceedings arising from the aforementioned events, even though she has “ever been a person under investigation or a defendant, but solely a person informed of the facts—as is obvious, especially regarding the organizational aspects of Ferrovie del XX, having worked there for some time.” In the complaint in question, the complainant requested the deletion of her personal data contained in the disputed article, its removal “from the website and online archive of *Il Fatto Quotidiano*,” as well as its de-indexing, in response to the Company’s denial on February 1, 2024, of the preliminary inquiry submitted on January 29; This was because, according to the publisher, the article—concerning “a matter of undoubted public interest”—was produced in the legitimate exercise of the right to report the news, and the reference to the data subject, “who was never identified as a subject under investigation, […] is entirely relevant […] to the topic at hand, given that her name appears numerous times in the investigation files, exactly as reported by the journalist […].” 1.2 Actions Taken In a letter dated October 18, 2024 (Ref. No. 122100/24), the data controller was asked to provide its comments, pursuant to Article 157 of the Code, regarding the matters raised in the complaint. In response to the aforementioned request, the data controller, in a communication dated November 6, 2024, confirmed the lawfulness of the processing in question, since the disclosure of the complainant’s personal data—including those relating to her hospitalization in the XX ward of XX Hospital—was, in his view, “essential to provide adequate and complete information” on the matter in question. In particular, the journalist considered the complainant to be a key figure in the matter, in part due to the romantic relationship she had had in the past with one of the suspects, the manager of the company “Ferrovie del XX.” Indeed, prior to the aforementioned hospitalization, the complainant “had expressed her intention to provide the judicial authorities with information useful for clarifying the case, for which she felt guilty.” Only after her hospital stay—and especially following a meeting at the hospital with her employer and former partner, who was under investigation in the legal case—did the complainant reportedly offer a different account from the one she had originally provided, one that redefined the entire framework of the charges. This reportedly led the journalist to speculate that the employer had influenced the change in the complainant’s account, as evident from the very title of the article in question. “Solely to accommodate the complainant’s needs and without the decision being interpreted as an implicit admission of liability,” the Company stated that it had proceeded to de-index the article in question. The response provided by the owner to the Office’s aforementioned request for information—which was initially sent to the complainant at an incorrect certified email (PEC) address—was resubmitted on November 20, 2024, to the correct address indicated in the initial complaint. On November 29, 2024, the complainant filed a reply in which she essentially reiterated the arguments already set forth in the complaint. In particular, she pointed out that the report in question was the result of the journalist’s personal reconstruction of events, which was contradicted by the investigative records themselves—both regarding her central role in the criminal proceedings and the alleged “attempts to coerce” her employer aimed at preventing her from reporting him. The complainant also emphasized that the conduct attributed to her and described in the article in question needed to be contextualized, as it was linked to an evident state of psychological and physical shock caused by the tragic events described therein, as evidenced by the preliminary witness statements provided by the attorney for the company involved in the aftermath of the cable car accident. Finally, this editorial content—which, moreover, contains inaccurate information regarding the individual’s job title (she is an office worker, not the company’s Deputy Administrative Director, as stated in the article) — does not appear to have been “removed from the web, as it is still accessible” on the “XX” social network of “Il Fatto Quotidiano.” On December 10, 2024, the data controller reported on subsequent financial investigations conducted by the investigators against the complainant “confirming the role that [she] allegedly played or could have played” in the matter described. Furthermore, in stating that it could not proceed with the removal of the editorial content from its archive, the Company emphasized that de-indexing constitutes “the best option for balancing the preservation of historical memory with the complainant’s request that the article no longer be displayed when her personal information is entered.” In light of this, on May 29, 2025, this Authority requested that the complainant provide the necessary clarifications regarding the additional observations submitted by the Company, with particular reference “to the alleged financial investigations conducted against her which, in the account provided by the data controller, would suggest issues of possible criminal relevance, as well as imply a central role that [the complainant] allegedly played in the news story recounted in the article in question” (Ref. No. 77388/25). In a communication dated June 4, 2025, the complainant confirmed that she had always held the role of “person informed of the facts” and, noting that in a criminal investigation it is entirely normal for investigations “to extend even to the current or former employees of a company […],” she stated that the described financial investigations conducted against her “simply painted the picture of a person who is the sole member of her household, with average income and owner of her own home.” Furthermore, while she considered the owner’s initial decision to de-index the article in question to be commendable, she noted that the editorial content in question had once again become searchable online, in association with the search term “XX.” Specifically, “when typing those words into major search engines (Microsoft Bing and Google), the first result that appears is precisely the full article published on the XX portal, and the user has the option to download the January 4, 2024, issue of Il Fatto Quotidiano for just a few euros.” Therefore, the complainant—in the event that “this Authority does not deem the request for immediate removal of the article to be proportionate”— — has requested “the deletion—through anonymization—of [her] personal data […],” as well as the de-indexing of the article “from every search engine, including other publishing platforms affiliated with the Data Controller, such as XX.” 2 INITIATION OF PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND SANCTIONARY MEASURES AND DEFENSES BY THE PARTY 2.1 Initiation of proceedings (Art. 166, paragraph 5, of the Code) Based on the evidence gathered during the activities described above, by notice dated June 18, 2025 (Ref. No. 86921/25), served pursuant to Art. 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures referred to in Article 58, paragraph 2, of the Regulation against the data controller, inviting the latter to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The alleged violations in question concerned the following provisions: - Articles 137, paragraphs 1 and 3, 139, and 2-quater of the Code; - Articles 5, 6, paragraph 1, and 10 of the Rules of Professional Conduct; - Article 5, paragraph 1, subparagraphs (a) and (c), of the Regulation. This is because the alleged publication—which also concerned data capable of revealing the complainant’s state of health—appears to have taken place in violation of the principle of “essentiality of information,” as well as the principles of lawfulness, fairness, and data minimization in the processing of personal data. 2.2 Defenses of the Party (Article 166, paragraph 6, of the Code) In a brief received on July 14, 2025, the data controller requested that the proceedings initiated against it be dismissed “due to the cessation of the subject matter of the dispute,” given that the article cited in the complaint had been permanently removed from the online archive of the news outlet in question. In particular, the Company stated that this action was taken solely to “accommodate the complainant’s needs,” expressly clarifying that the decision could in no way be interpreted as an implicit admission of liability regarding the allegations raised. In reiterating the arguments already put forth during the preliminary investigation, the publisher argued that the article in question merely reported information drawn from investigative records, which indicated the complainant’s relevance to the events described, even though she had acted solely as a person with knowledge of the facts. According to the defense’s argument, this circumstance was consistently reflected in the editorial content in question, in which no responsibility other than or beyond that resulting from the investigative framework—which did not include the complainant’s involvement as a person under investigation—was in any way attributed to her. The publisher further argued that a different narrative approach—one based on omitting the complainant’s identifying information and the role she played in the incident—would have compromised the very comprehensibility of the journalistic report. In support of this claim, the Company submitted a version of the article devoid of any identifying references to the complainant, highlighting that the proposed solution would, in its view, have resulted in an altered or incomplete representation of the facts, thereby infringing upon the right to report the news. In particular, according to the publisher, the removal of references to the complainant’s professional role would have made “the content of the news story incomprehensible,” the content of the news story, especially with regard to her initial admission of responsibility, and could even have generated distorting effects, such as a generic “witch hunt against the former employee,” which could involve third parties completely unrelated to the matter. Based on these considerations, the publisher concluded that the article had been written in accordance with the principle of essential information, as well as in compliance with the code of ethics applicable to journalistic practice, which allows the journalist “to report not only the identifying information of individuals involved in any capacity in criminal proceedings, but also their sensitive personal data—which, moreover, is derived from specific judicial documents […]”—provided that such elements are indispensable for ensuring adequate coverage of events of significant public interest. 3 THE AUTHORITY’S ASSESSMENTS In light of the evidence gathered in the course of this proceeding and the statements made by the data subject, pursuant to Article 168 of the Code, the following legal assessments are provided. First, it should be noted that the article cited in the complaint appears to have first been deindexed by major search engines and then removed from the online archive of the news outlet in question, as verified by the Office upon accessing the relevant link, which now redirects to a page that is no longer available. According to the data subject, the article in question is currently found among Google search results associated with her name, constituting a processing of personal data distinct from that which is the subject of this proceeding and which refers to the XX publishing platform. It follows that, with regard to the processing in question, the conditions for intervention by this Authority do not exist, as it is not included within the scope of these proceedings, as defined by the relief sought in the complaint filed by the data subject. In any case, the complainant retains the option to contact the aforementioned platform in accordance with the procedures indicated by the platform itself, as well as, independently, to contact the search engine operator, should descriptive snippets, cached copies, or other references associated with her name. This is to obtain the de-indexing of such results and ensure full and effective protection against the continued display of content no longer available at the original source. That said, the article that is the subject of the complaint contains information regarding the health status of the data subject, who is identifiable through the publication of her identifying information. The dissemination of such data concerning the complainant—who, moreover, does not appear to be involved in the criminal proceedings arising from the aforementioned incident and who, instead, reportedly served solely as a “person informed of the facts”— —does not appear to comply with the principles of lawfulness, fairness, and data minimization, nor with the limits imposed by the principle of “essentiality of information.” The fact that the news story involved matters of public interest does not, in fact, automatically justify the disclosure of the identifying information of the individuals mentioned, especially when such details are not strictly necessary for understanding the facts reported. In the present case, the informational purpose sought could have been fully satisfied through a narrative that, while maintaining reference to the factual context, the role played by the individual concerned in the events, and the statements she made immediately following the events—which were subsequently revised or denied—would nevertheless omit her identifying information. In other words, the public interest underlying the dissemination of the news concerned the historical fact and its implications, not the need to make immediately identifiable the individual who, at that stage, had merely provided statements as a person with knowledge of the facts. Therefore, the argument that the omission of the complainant’s name would have compromised the completeness or comprehensibility of the information cannot be accepted. From a narrative perspective, what was relevant was the description of the events, the role played by the complainant at the time of the events, and the statements she made during the investigation; her identification by name, on the other hand, constituted an additional element, not indispensable for the exercise of the right to report the news, but rather amounted to superfluous information capable of significantly amplifying her public exposure. This assessment is further supported by the specific narrative approach adopted in the article, which reportedly quoted statements made by the individual in question during a period of particular psychological distress, while also dwelling in great detail on the circumstances of her hospitalization. Precisely the particular vulnerability of the context in which these statements were made, together with the disclosure of health-related information, would have required an even greater degree of caution in the disclosure of personal data, in order to avoid infringing upon the dignity and privacy of the individual concerned; this also taking into account the role the complainant played at that time as a person with knowledge of the facts and the fact that she was not a party to the criminal proceedings. Furthermore, the digital context in which the publication took place is significant. The indexing of the article by common search engines led to a widespread dissemination of personal information regarding the complainant, with prejudicial effects likely to persist well beyond the time of the original publication. In this regard, the immediate association between the data subject’s name and a story characterized by significant media attention could have had a significant impact on her personal and professional reputation, especially considering that the story’s national resonance is such that it is periodically brought back to the public’s attention. It should also be clarified that this assessment does not, nor could it, affect the journalist’s editorial decision to cover a story of public interest, nor does it amount to an undue restriction of the right to report news or freedom of the press, both of which are constitutionally guaranteed. The subject of the dispute is not, in fact, the publication of the news story itself, nor the right and duty to report on matters of public importance; rather, the focus is on verifying whether the coverage complied with the principles of informational necessity and data minimization. From this perspective, the central issue does not lie in the decision to publish the news story in question, but rather in whether, within the context of the narrative, it was necessary to reveal the complainant’s identity to the public during a purely investigative phase. Precisely because the data subject was not involved in any legal proceedings at the time of the publication in question, the need to protect her privacy was all the more pressing, to prevent a person not facing criminal charges—at least at that specific stage of the investigation—from being exposed and associated with a particularly serious incident. The proper balance between the right to report the news and the protection of personal data should therefore have been achieved through less invasive narrative methods, capable of preserving the essential elements of the news story without disclosing information that was not strictly necessary. In this regard, it should be noted that the Code, by introducing in general terms the aforementioned principle of the essential nature of information as a criterion for determining the publication of personal data in journalism, intended to ensure greater rigor in the collection and dissemination of data capable of revealing a person’s state of health, while entrusting the sector-specific Rules of Professional Conduct provided for in Article 139 with the task of identifying more precise limits in this regard (see Article 137, paragraphs 1 and 3, of the Code). These limits are set forth in Article 5 of the Code of Ethics, which states that “When collecting data [...] capable of revealing health conditions [...], the journalist shall guarantee the right to information on matters of public interest, while respecting the essential nature of the information [...]”—and in Article 10 of the aforementioned Code of Ethics, which provides that “when referring to the state of health of a specific person—whether identified or identifiable—the journalist shall respect that person’s dignity, right to privacy, and personal dignity, especially in cases of serious or terminal illnesses, and shall refrain from publishing analytical data of strictly clinical interest” (see, among others, Decision No. 30 of January 25, 2018, web doc. No. 8364982, at www.gpdp.it). It follows that the editorial content in question appears to constitute processing that does not comply with the principles of lawfulness and fairness, as well as data minimization, as set forth in Article 5(1)(a) and (c) of the Regulation. The complainant’s identifying information does not, in fact, appear to be indispensable for a thorough account of an incident that could just as easily have been the subject of a detailed news report. Furthermore, the description of the circumstances surrounding her hospitalization—characterized by a particularly detailed account—also appears to exceed the limits of relevance and proportionality. The detailed account of the complainant’s statements, together with the particularly vivid and almost “sensationalized” portrayal of her psychological and physical condition, does not appear strictly necessary for the mere purpose of informing readers about a situation of vulnerability or distress; but rather takes on the characteristics of an undue overexposure of the individual, to the point of diverting the reader’s attention from the actual news being reported. From this perspective, the dissemination of information pertaining to a particularly sensitive personal and health-related matter, as described above, ultimately exceeds what is necessary to satisfy the public’s interest in knowing the facts, crossing the line into a narrative that is prejudicial to the complainant’s dignity, privacy, and reputation. 4 CONCLUSIONS In light of these considerations, the allegations set forth in the notice initiating the proceedings pursuant to Article 166 of the Code are upheld, since the statements made during the preliminary investigation and the defenses raised by the data controller are insufficient to rebut the findings made by the Office and, moreover, none of the cases provided for in Article 11 of Regulation No. 1/2019 apply. Therefore, the Authority finds that the conduct of the data controller was unlawful, in violation of Articles 137(1) and (3), 139, and 2-quater of the Code, 5, 6(1), and 10 of the Code of Ethics, as well as the general principles of lawfulness, fairness, and data minimization in the processing of personal data referred to in Article 5(1)(a) and (c) of the Regulation. 5 CORRECTIVE MEASURES Having therefore established the unlawfulness of the conduct noted above: - the Authority acknowledges that the data controller removed the contested article in its defense brief; as such, the conditions for the Authority to take further action do not currently exist; - with regard to processing operations already carried out and for deterrent purposes, it is considered that the conditions exist for the imposition of an administrative fine pursuant to Articles 58(2)(i) and 83(5) of the Regulation. 6 INJUNCTION ORDER Based on the foregoing, for the purposes of determining the amount of the administrative fine, the aforementioned Article 83(5) of the Regulation—which sets the maximum penalty at 20 million euros or, for undertakings, 4% of the worldwide annual turnover for the preceding fiscal year, whichever is higher, specifies the method for determining the aforementioned penalty, which must “in any case [be] effective, proportionate, and dissuasive” (Article 83(1) of the Regulation), identifying, for this purpose, a series of factors—listed in paragraph 2—to be assessed when determining the relevant amount. The circumstances to be taken into account in this case, from the perspective of aggravating factors, are: 1. the gravity of the violation, the level of which—based on the factors set forth in Article 83(2)(a), (b), and (g) of the Regulation (see the document “Guidelines 04/2022 on the Calculation of Administrative Fines under the GDPR – Version 2.0 – Adopted on May 24, 2023”)—was deemed moderate, in light of the nature, characteristics, and consequences of the processing carried out. In particular, the following factors are relevant: a) the nature of the data involved, relating exclusively to the data subject’s state of health—to which the Regulation grants enhanced protection—as well as the manner of their dissemination, characterized by a “sensationalized” portrayal of her psychological and physical condition, exceeding the informational needs underlying the news report and likely to amplify the intrusion into her private life, with consequent harm to her dignity and reputation (Art. Article 83, paragraph 2, subparagraphs (a) and (g), of the Regulation); b) the harm caused to the data subject, whose vulnerable condition was extensively discussed in an article that remained indexed for a significant period through common search engines, until the Authority intervened and the editorial content was subsequently removed. It follows that linking the article to the data subject’s name resulted in the widespread dissemination of personal information relating to her and, consequently, indiscriminate access by an unspecified audience of users; this would thus have caused significant harm to the complainant’s privacy, which persisted for nearly a year from the time of the original publication (Article 83(2)(a) of the Regulation); 2. the grossly negligent nature of the conduct, given that the Company, by virtue of its organizational structure and the activities it carries out, should have possessed sufficient experience and expertise to enable it to make editorial decisions more in line with the applicable legal framework. In particular, the Company was required to comply with the principle of essentiality of information regarding matters of public interest, carefully balancing the right to report news against the protection of the fundamental rights and freedoms of the data subjects, with specific attention to the sensitive nature of the data processed, particularly those relating to health. This finding is further confirmed by the fact that the data controller, even during the proceedings, continued to assert the lawfulness of the contested publication, although the Authority had already highlighted—at the time the complaint was filed—the need to comply with the core principles of journalistic practice; this highlighted the data controller’s persistent reluctance to comply with the limits set by the law, underscoring the significant degree of negligence that characterized its conduct (Article 83(2)(b) of the Regulation); 3. the existence of previous proceedings initiated against the Company for violations related to the same subject area, with particular reference to the principle of the essential nature of information in the practice of journalism (see Decision No. 62 of March 2, 2023; Decision No. 60 of February 12, 2025; Decision No. 126 of February 27, 2025). The described conduct does not, therefore, appear to be an isolated incident, but rather indicates a well-established and repeated practice over time that does not comply with the obligations and principles set forth in the regulations governing the protection of personal data, which have been explicitly stated on multiple occasions in the orders issued specifically against the same data controller (Article 83(2)(e) of the Regulation). The following mitigating factors must be taken into consideration: 1) the removal of the article that was the subject of the complaint, although this occurred only after the initiation of these proceedings (Article 83(2)(c) of the Regulation); 2) the purposes pursued by the data controller, which are related to the freedom of information referred to in Article 85 of the Regulation and Articles 136 et seq. of the Code. Based on the totality of the above elements, in application of the aforementioned principles of effectiveness, proportionality, and deterrence, as set forth in Article 83(1) of the Regulation, and taking into account, the necessary balance between the rights of data subjects and the freedom of enterprise, including to limit the economic impact of the sanction on the controller’s organizational, operational, and employment needs, it is deemed appropriate to impose on the data controller – Società Editoriale Il Fatto S.p.A. – an administrative fine in the amount of 23,750.00 euros (twenty-three thousand seven hundred fifty/00). In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of Regulation No. 1/2019, the additional penalty of publishing this decision—containing the injunction order—on the Data Protection Authority’s website should be imposed, given the particularly serious nature of the violations found. Finally, the conditions set forth in Article 17 of Regulation No. 1/2019 regarding internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Authority, for the recording of the violations identified herein in the Authority’s internal register, as provided for in Article 57, paragraph 1, subparagraph (u), of the Regulation. FOR THESE REASONS Pursuant to Article 57(1)(f) of the Regulation, while acknowledging that the disputed article has been removed, the conduct of the data controller – Società Editoriale Il Fatto S.p.A., with registered office at Via di Sant’Erasmo 2, 00184 – Rome (VAT No. 10460121006) – as described in the grounds set forth herein; IT IS ORDERED pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the aforementioned data controller pay the sum of 23,750.00 euros (twenty-three thousand seven hundred fifty/00) as an administrative fine for the violations indicated in the grounds. IT IS ORDERED that the aforementioned data controller, in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, pay the sum of 23,750.00 euros (twenty-three thousand seven hundred fifty/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Article 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the penalty imposed, within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; IT IS HEREBY ORDERED a) pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of Regulation No. 1/2019, that this order be published on the Data Protection Authority’s website; b) pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; c) pursuant to Article 17 of Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, paragraph 2, of the Regulation in the Authority’s internal register provided for in Article 57, paragraph 1, letter u), of the Regulation. Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an objection to this decision may be filed with the ordinary courts, by filing an appeal, alternatively, with the court of the place where the data controller resides or has its registered office, or with the court of the place of residence of the data subject, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori