Italian DPA: Municipality of Aprilia unlawfully disclosed whistleblower data to employer

Introduction. In a complaint filed on XX, supplemented on XX, Mr. XX alleged a data breach by the Municipality of Aprilia (hereinafter, the “Municipality”), stating, in particular, that on XX, he had sent a certified email (PEC) to the Municipality’s registry “requesting a meeting with the Special Commissioner […] in which he highlighted the reckless and XX management of the […] XX,” and that the aforementioned certified email requesting the meeting had been “forwarded first to two City officials […] and then directly to the Board of Liquidators [of XX, hereinafter also “XX”], which on XX […] in its capacity as employer, notified [the complainant] of the initiation of disciplinary proceedings.” In a subsequent note dated XX, the data subject supplemented the complaint initially filed by providing, in particular, evidence of the termination imposed by XX, which was notified to him “on XX, ref. no. XX, [regarding] the outcome of the disciplinary proceedings, which concluded with dismissal for just cause.”

The Preliminary Investigation In a letter dated XX, ref. no. XX, to which reference is made in its entirety, the Municipality responded to a request for information made by this Authority in a letter dated XX, ref. no. XX, stating, in particular, that: - “by Decree of the President of the Republic dated April 23, 2025, the Aprilia City Council was […] dissolved due to mafia infiltration pursuant to Art. 143 of Legislative Decree 267/2000, and the resulting Extraordinary Commission was appointed”; - “The processing of the complainant’s personal data was carried out by the Municipality of Aprilia in the course of performing tasks in the public interest and exercising public authority conferred by law, pursuant to Art. 6(1)(e) of Regulation (EU) 2016/679”; in particular, this “falls within the context of the institutional functions exercised by the Extraordinary Commission […], and is based on: - the functions of administration, guidance, and oversight assigned to the Commission, aimed at restoring administrative and managerial legality within the Municipality and its subsidiaries; - in the powers of the shareholder entity over its investee companies, pursuant to Art. 9 of Legislative Decree No. 175/2016; - in the system of controls over investee companies provided for in Art. 147-quater of Legislative Decree No. 267/2000”; - “The aforementioned communication, […] was functionally limited to the purposes pursued by the Municipality and did not entail any automatic extension of the legal basis to the recipient for further or independent processing […]. In particular, the disclosure of the complainant’s name was necessary for the purpose of assessing the credibility of the report and conducting a proper investigation, with its use limited to those purposes”; - “The certified email (PEC) was […] sent […to] the Extraordinary Commission […which] proceeded to request information regarding the legal representatives of XX […using] the email address exclusively used by the Board of Liquidators.” Based on the information gathered, the Office, by letter dated XX (Ref. No. XX), notified the Municipality of Aprilia, pursuant to Article 166, paragraph 5, of the Code, of the initiation of proceedings for the adoption of the measures referred to in Article 58, para 2, of the Regulation, since the disclosure of the complainant’s data by the Municipality to XX was carried out without an appropriate legal basis, in violation of Articles 6, para 1, subparagraphs (c) and (e), para 2, and para 3, subparagraph (b) of the Regulation, and Article 2-ter of the Code, as well as in a manner inconsistent with the principles of “lawfulness, fairness, and transparency,” “purpose limitation,” and “data minimisation,” in violation of Article 5, para 1, subparagraphs (a), (b), and (c) of the Regulation. In the same notice, the Municipality was invited to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code; as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The Municipality, which did not request a hearing, submitted its defense briefs via a letter dated XX, ref. no. XX, to which full reference is made, stating, in particular, that: a. With regard to the legal basis for the processing carried out, it was indicated that: - “By decree of the Prefect of Latina, an Investigative Commission was appointed—pursuant to Art. 141, paragraph 2, of the TUEL—to verify the possible existence of influence or infiltration by mafia-style organized crime within the local government. Following the findings that emerged, by decree of the President of the Republic dated April 23, 2025 […], the Extraordinary Commission for the management of the local government entity was appointed […]”; - “The activities that are the subject of these proceedings fall within the initial phase of the commissioner’s representation […] to assess, verify, and restore administrative and managerial legality within the Municipality and the companies/agencies under its jurisdiction. […] “constitute the legal basis for the processing of the data in question: •Article 114, paragraphs 1 and 6, of Legislative Decree No. 267/2000, which defines the nature of the Special Agency and specifies the obligations that the local government has toward it; •Article 143, paragraph 1, of Legislative Decree No. 267/2000, which provides for the dissolution of the entity in the event of “forms of influence […] such as to compromise the proper functioning or impartiality of the administration,” with the purpose of ensuring the restoration of administrative legality; • Article 144, paragraph 1, of Legislative Decree No. 267/2000, pursuant to which the Extraordinary Commission exercises the powers vested in the body’s governing bodies; • Article 145, paragraph 4, of Legislative Decree No. 267/2000, which provides for the granting of stringent investigative powers to the Extraordinary Commission, whenever the dissolution, as in the present case, is ordered in connection with specific instances of mafia influence related to the awarding of contracts or the granting of concessions for local public services; • Article 147-quater, paragraph 1, of Legislative Decree No. 267/2000, which provides for constant and effective oversight of subsidiaries—to which Special Agencies, such as XX, are assimilated […]—from both an administrative and financial standpoint”; - “A combined reading of the aforementioned provisions, also in light of the provisions of Art 6, paragraph 3, subparagraphs (a) and (b), of the Regulation, outlines a regulatory framework in which audit and oversight activities are not merely optional but constitute an integral and necessary part of the exercise of the functions assigned to the Extraordinary Commission in a municipality dissolved due to mafia infiltration”; - the “verification […] of the statements made by an individual reporting on ‘…reckless management and with XX…’ within the municipal Special Agency” was intended to “determine whether the statements contained in the certified email (PEC) had any basis in fact or were the result of baseless allegations made by an individual employed by his own Special Agency […to which] the Municipality of Aprilia had entrusted various municipal services […]”; b. regarding the procedures for disclosing the complainant’s personal data, the Municipality stated, in particular, that: - “the legal provisions authorizing the […] processing of the […complainant’s] personal data and the Presidential Decree of April 23, 2025 […], as a general administrative act […], constitute the framework within which said Commission operates, in accordance with the broadest powers referred to in the aforementioned Art 145, paragraph 4, of Legislative Decree 267/00 […]”; - “It appeared entirely lawful, necessary, and proportionate to inform […XX] of the receipt of a request for a meeting submitted by an employee of the same company, in which the employee alleged, in entirely general terms, the ‘…insane management and XX of the municipal company…,” with the aim of obtaining a report on the aforementioned employee”; - “Given the close relationship between the Municipality and the municipal utility, XX, it appeared essential […] to do so before […] deciding whether or not to grant the requested meeting”; - “In this context, it is reiterated that the disclosure of the minimum personal data (first and last name) of the complainant to XX, in its capacity as an independent controller and employer of the author of the certified email, was necessary for the purposes of conducting the preliminary investigation, as it represented the only suitable means of enabling a concrete—rather than merely abstract—verification of the reported facts”; “The disclosure was therefore limited to the data deemed necessary for the purposes pursued, without including any information beyond that already contained in the communication sent to the Authority by the complainant”; - “The Administration’s actions were carried out in accordance with the principle of data minimisation, understood not only as a quantitative reduction of the data processed, but also as ensuring the adequacy and relevance of such data with respect to the specific investigative context”; Finally, with regard to the subsequent outcomes of the discussions with XX, the Municipality stated that: - “Any further decisions adopted […by XX] regarding the complainant fall within the scope of its autonomous organizational and decision-making authority and are not attributable, either causally or functionally, to the purposes of the communication issued by the Municipality” - “the alleged unlawful processing would have concerned a single communication, addressed to a very limited number of people,” “the third party that became aware of the personal data is a Special Agency operating on behalf of the Municipality, equivalent to a Public Entity,” “the processing occurred entirely through negligence, due to the belief that a legal basis existed,” there are no “previous measures,” and that the Municipality has stated it is “willing to issue, even in the near future, a circular to all management-level staff to highlight the critical issues that have emerged in this specific case and to adopt corrective measures.” It is further noted that on XX, the complainant supplemented his complaint by providing additional documentation to the Authority, submitting some of the correspondence exchanged between himself, the Municipality, and XX for the purpose of obtaining further clarification on how his “report” to the Municipality regarding XX was handled. In this regard, in order to obtain a comprehensive overview from both parties, the Authority submitted a further request for information to the Municipality via a letter dated XX, ref. no. XX, to which the Municipality responded via a letter dated XX, ref. no. XX, providing the requested clarifications and documentation.

applies Art. 6(1)(e), Art. 2, Art. 5, Art. 6, Art. 9, Art. 18, Art. 58

Outcome of the Preliminary Investigation

Legislation on Data Protection As a preliminary matter, it should be noted that the processing of personal data must comply with applicable legislation on data protection and, in particular, with the provisions of the Regulation and the Code. Specifically, public entities may process personal data only if such processing “is necessary for compliance with a legal obligation to which the controller is subject,” or when “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6, para. 1, subsections (c) and (e) of the Regulation). National legislation has introduced more specific provisions to align with the application of the Regulation’s rules, establishing, with greater precision, specific requirements for processing and other measures designed to ensure lawful and fair processing (Art. 6, para. 2 of the Regulation) and, in this context, has provided that processing is permitted only when required by a law, regulation, or general administrative act (Art. 2-ter of the Code). The controller is required, in any case, to comply with data protection principles, including those of “lawfulness, fairness, and transparency,” “purpose limitation” and “data minimisation,” according to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject,” “collected for specified, explicit, and legitimate purposes, and subsequently processed in a manner that is not incompatible with those purposes,” as well as “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Art. 5, para. 1, subsections a), b), and c) of the Regulation). With regard to the case at hand, specifically concerning the disclosure of personal data to third parties, given the definition of “disclosure” set forth in Article 2-ter, paragraph 4, of the Code, it is clarified that the same article also provides that “The legal basis provided for in Article 6, paragraph 3, subparagraph b), of the Regulation consists of a law, regulation, or general administrative act” and that “the disclosure of personal data, processed for the performance of a task carried out in the public interest or in the exercise of official authority, to entities that intend to process such data for other purposes is permitted only if provided for under paragraph 1 or if necessary under paragraph 1-bis” (paragraphs 1 and 3). Finally, it should be noted that, pursuant to Article 2-decies of the Code, the disclosure and subsequent acquisition of personal data by another data controller, if carried out in the absence of an adequate legal basis, constitute a violation of the relevant regulations governing the processing of personal data and may not be used, except as provided for in Art. 160-bis of the Code, which does not prejudice the assessments of the judicial authority.

applies Art. 2, Art. 5, Art. 6

The Unlawful Disclosure of Personal Data First, it should be noted that the preliminary investigation was conducted exclusively in relation to the processing carried out by the Municipality of Aprilia, the sole entity against which the data subject filed the complaint, and did not, however, concern the subsequent processing carried out by XX, in its capacity as employer, particularly given the alternative remedies already pursued by the complainant against the latter regarding the lawfulness of the termination resulting from the aforementioned disclosure. That said, it should be noted that the investigation conducted on the basis of the evidence gathered and the facts that emerged following the preliminary inquiry, as well as the Office’s subsequent assessments, revealed that in the certified email (PEC) dated XX, the complainant merely requested a meeting with the Municipality’s Extraordinary Commission “a meeting in order to provide detailed information on the reckless and XX management of XXi,” stating that he was addressing the Municipality “both for reasons of public interest and in relation to […his] situation of workplace bullying” and that he remained “available for any further clarification or supplementary documents.” This communication did not include any attached documentation nor did it contain references to specifically identified circumstances or facts, which, if anything, would have constituted the subject matter of the requested meeting and/or of any supplementary documentation that the complainant had offered to provide, should the Commission request it. Following this communication and without conducting any preliminary investigation aimed at obtaining further details and/or information directly from the complainant regarding the matters generically outlined, the Municipality instead proceeded to disclose the complainant’s personal information, along with the certified email (PEC) address, to XX, a third party with independent legal personality and the complainant’s employer—regarding whom the complainant intended to bring potential unlawful conduct to the attention of the Special Commission for further investigation. Specifically, in an email dated XX, the Municipality requested from the Board of Liquidators of XX “a report on the employee” and, more generally, “on the matters he raised in the attached note [dated XX],” although, as admitted by the Extraordinary Commission itself, this was an entirely generic “report.” Following this request, XX initiated, on the one hand, disciplinary proceedings against its employee, which culminated in his dismissal, and, on the other hand, in a memo dated XX, forwarded to the Municipality a detailed report on the work-related events involving the complainant, focusing on a precise description of the previous disciplinary charges and sanctions imposed on him, supported by the relevant documentation. In light of this response, the Municipality determined that it did not need to conduct further inquiries with the complainant and did not proceed with the requested meeting, as the information provided was, in fact, superfluous to the subject matter of the report, since it focused exclusively on disciplinary matters relating to the employment relationship between the employee and XX. That said, with regard to the legal basis for the data disclosure, the City, in the aforementioned letter dated XX, initially stated—in a tautological manner—that the processing would take place “in the exercise of tasks in the public interest and of public powers conferred by law, pursuant to Article 6(1)(e) of Regulation (EU) 2016/679, in accordance with the principles of lawfulness, fairness, and transparency set forth in Article 5(1)(a) of the same Regulation” and “in the context of the institutional functions exercised by the Extraordinary Commission,” without, however, indicating an appropriate basis of lawfulness for the processing, failing to mention—as required by Article 2-ter of the Code— the specific law, regulation, or general administrative act that provides for the processing in question—namely, the disclosure of the complainant’s data to the Special Agency. In fact, the regulatory provisions cited by the Municipality govern very general aspects of local authorities’ participation in publicly owned or publicly funded companies: in particular, Articles 7–10 of Legislative Decree No. 175 of August 19, 2016, govern the establishment of publicly owned companies, the acquisition of shares in already established companies, the management of equity interests, divestitures, etc.; Art 9, specifically cited by the Municipality, governs certain general aspects regarding the manner in which a local government, as a shareholder, exercises its rights (shareholder agreements, validity of resolutions, appointment and removal of members of the company’s internal governing bodies, etc.). Similarly, Art 147-quater of Legislative Decree No. 267/2000, containing the “Consolidated Law on Local Government,” regulates the system of oversight over investee companies with regard to the achievement of established management objectives, analyzing any deviations, including in relation to potential economic and financial imbalances that are material to the entity’s budget. Similar considerations can be made with regard to the legal provisions cited in the defense briefs, and specifically, paragraphs 1 and 6 of Article 114 of Legislative Decree No. 267/2000, concerning the general aspects of the relationship between the local government and the special agency (endowment capital, determination of assigned purposes, fundamental acts, oversight, verification of management results, coverage of any social costs), Article 143, paragraph 1, of Legislative Decree No. 267/2000, regarding additional cases of dissolution of the local government, Article 144, paragraph 1, of Legislative Decree No. 267/2000, on the assignment of municipal tasks to the Extraordinary Commission, as well as the aforementioned Art 147-quater, paragraph 1, of Legislative Decree No. 267/2000. With regard, furthermore, to the “extensive investigative powers vested in the Commission” in the event of the dissolution of the local authority due to “specific situations of mafia influence related to the awarding of contracts or the granting of concessions for local public services,” pursuant to Article 145, paragraph 4, of Legislative Decree No. 267/2000—also cited by the Municipality as the basis for the processing in question—it should be noted that these powers extend, even with respect to special agencies, in the ability to “request details and information regarding the conduct of the bidding process and the performance of the contract” (Art. 14, paragraph 3-bis, of Decree-Law No. 152 of May 13, 1991, No. 152, converted, with amendments, by Law No. 203 of July 12, 1991), and to adopt the “measures deemed necessary […] at any time and stage of the contractual procedure, or the termination of the contract already concluded.” The request made by the Municipality to XX cannot in any way be classified under these provisions, not only because of the absence of any reference to a tender or procurement contract, but also because it is aimed solely at “request a report on the employee in question and on the arguments he put forward in the attached note,” and not on specific situations pertaining to the “conduct of the competitive bidding process” or the “performance of the procurement contract”—circumstances certainly not provided by the complainant in the generic certified email (PEC) dated XX. Moreover, although the aforementioned Commission invoked the exercise of the powers provided for in Article 145 of Legislative Decree 267/2000 as the basis for processing the complainant’s data, it did not deem it necessary to obtain—by specifically requesting them from the complainant— precisely that additional information or those documents “regarding the reckless management and the XX of the XX,” which would have enabled it to exercise those powers; nor, as noted, did it deem it necessary to schedule an appointment with the complainant. Given that Article 2-ter, paragraph 4, of the Code clarifies that “disclosure” means “making personal data known to one or more specific parties other than the data subject” and the other parties indicated in the aforementioned provision, and that the same article specifies that “The legal basis provided for in Article 6, paragraph 3, letter b), of the Regulation consists of a law, regulation, or general administrative act” (paragraphs 1 and 3), the disclosure of the complainant’s personal data and the forwarding of the certified email (PEC) dated XX to XX—a third party and independent controller—appear to have been carried out by the Municipality without an adequate legal basis. In fact, none of the provisions cited by the Municipality to justify the disclosure of the complainant’s personal data meets the requirements set forth in data protection legislation. Article 6(3)(b) of the Regulation provides that the legal basis for processing necessary to comply with a legal obligation or to perform a task carried out in the public interest must include specific provisions such as, for example, the general conditions regarding the lawfulness of processing by the controller, the types of data subject to processing, the data subjects, the recipients to whom personal data may be disclosed and the purposes for which they are disclosed, the purpose limitation, storage periods, and processing operations and procedures, including measures to ensure lawful and fair processing. In light of the aforementioned regulatory framework and the information provided by the Municipality during the preliminary investigation, the processing of the complainant’s data was therefore carried out without an adequate legal basis, in violation of the principle of “lawfulness, fairness, and transparency” set forth in Art. 5(1), subparagraph (a), of the Regulation, as well as Articles 6(1)(c) and (e), (2), and (3)(b) of the Regulation and Article 2-ter of the Code.

applies Art. 5(1), Art. 5(1)(a), Art. 6(1)(c), Art. 6(1)(e), Art. 6(2), Art. 6(3), Art. 6(3)(b), Art. 2, Art. 6, Art. 7, Art. 14

Violation of the principles of “purpose limitation” and “data minimization” In addition to what was set forth in paragraph 3.2 above, and without prejudice to the need for an adequate legal basis, with reference to the stated processing purpose—identified as the “assessment of the reliability of the report and proper investigation”— in the “need to conduct more detailed investigations […] to determine whether the allegations contained in the certified email had any basis in fact or were the result of baseless claims made by an individual employed by the Municipality’s own special agency,” within the scope of the aforementioned “administrative, policy-making, and supervisory functions assigned to the Commissioner’s Office,” it is noted that the Municipality has not provided sufficient evidence to demonstrate either that an investigation into the “report” was actually conducted, nor the actual necessity of forwarding the complainant’s certified email (PEC) directly to XX instead of formulating specific requests for further investigation—while taking particular precautions—possibly following the acquisition of more specific information from the complainant. In this regard, it is noted first of all that, although the complainant did not request that his identity be kept confidential, nor did he request the application of legal provisions—which are provided for by law—that ensure the confidentiality of the complainant’s identity and the content of the report, it is evident, in essence, that the Municipality should have—also with a view to preventing the risk of retaliatory actions against the employee—nevertheless taken special precautions and measures in handling the preliminary information it received and in investigating the details of the report. In this regard, it should be noted that the “report” and the subsequent request for a meeting made to the Municipality by the complainant are presumably based on the trust placed in the exercise of the investigative powers vested in the Extraordinary Commission for the pursuit of the purposes assigned to it (such as, pursuant to the Presidential Decree of April 23, 2025, “to eliminate effects detrimental to the public interest and ensure the financial rehabilitation of the local government”), rather than on the existence of the Municipality’s equity interests in the “reported” entity. Second, it should be noted that the subject matter of the request made by the Municipality to XX (“a report on the employee […] and on the points he raised in the memo”), together with the transmission of the certified email (PEC) to the “reported” individual —who is also the complainant’s employer—could not be considered, ex ante, suitable for achieving the purpose of obtaining the specific information identified by the aforementioned provisions as the basis for the processing, given the extreme vagueness of the report (“reckless management by XX”), not only exposed the latter to a foreseeable risk of retaliation but also could not be considered, a priori, suitable for achieving the purpose of obtaining the specific information identified by the cited provisions as the basis for the processing, since that request was addressed precisely to the “reported” individual; as in fact emerged during the investigation, the request made to XX on XX did not yield any clarification regarding the possible groundlessness of what was—generically—reported, but rather resulted in a report entirely focused on the employee’s employment relationship. Therefore, the disclosure of the complainant’s data to XX was carried out not only in the absence of a legal basis but also in violation of the principle of “purpose limitation,” as set forth in Article 5, para 1, subparagraph b) of the Regulation. Similarly, the request for a “report on the employee” and the subsequent acquisition of the detailed response prepared by XX cannot be considered justified, given that the Municipality has no authority over the management of the Special Agency’s personnel and could not have issued any decision in this regard. In any case, even if one were to consider the need for a preliminary “exploratory” request addressed directly to the “reported” individual, the Municipality would still have been required, in accordance with the principle of “data minimization” set forth in Art. 5, para. 1, subparagraph (c) of the Regulation, the necessary safeguards to ensure that the data subject was not, in the first instance, exposed to the presumed risk of retaliation by their employer. The Extraordinary Commission could have, on the one hand, requested clarification from the Special Agency regarding the “report,” without revealing the data subject’s identity, and, on the other hand, utilize additional legal remedies provided for by law, where deemed necessary, to preliminarily gather information on the possible affiliation of the complainant “XX,” including for the purpose of deciding whether or not to grant the data subject’s request for a meeting. For the reasons set forth above, it is therefore established that the Municipality processed data in a manner inconsistent with the principles of “purpose limitation” and “data minimisation,” in violation of Article 5(1)(b) and (c) of the Regulation.

applies Art. 5(1)(b), Art. 5(1)(c), Art. 5

Conclusions. In light of the assessments referred to above, and taking into account the statements made by the controller during the preliminary investigation—the veracity of which may be called into question pursuant to Article 168 of the Code—it is noted that the evidence provided by the controller in its defense briefs do not sufficiently address the findings notified by the Office in the notice initiating the proceedings, and are insufficient to warrant the dismissal of these proceedings pursuant to Art. 14, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, as none of the cases provided for in Art. 11, as referred to therein, apply. Therefore, the Office’s preliminary findings are confirmed, and it is determined that the processing of personal data by the Municipality was unlawful, as it did not comply with the principles of “lawfulness, fairness, and transparency,” “purpose limitation,” and “data minimisation,” in violation of Article 5, para 1, subparagraphs (a), (b), and (c) of the Regulation, as well as in the absence of an appropriate legal basis, in violation of Articles 6(1)(c) and (e), para 2, and (3)(b) of the Regulation and Article 2-ter of the Code. The violation of the aforementioned provisions renders applicable the administrative sanction provided for in Article 83(5) of the Regulation, pursuant to Articles 58(2)(i), and 83(3) of the Regulation, as also referred to in Article 166(2) of the Code. Considering, in any case, that the Municipality’s conduct has ceased to have any effect, the conditions for adopting further corrective measures under Article 58, para 2, of the Regulation do not apply.

applies Art. 6(1)(c), Art. 6(1)(e), Art. 58(2)(i), Art. 83(3), Art. 83(5), Art. 2, Art. 5, Art. 11, Art. 14, Art. 58

Adoption of the injunction order for the imposition of the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction order, by which it also orders the application of the ancillary administrative sanction of its publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). Given that the violation of the aforementioned provisions occurred as a result of a single act (the same processing operation or related processing operations), Article 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, all the violations detected—relating to Articles 5 and 6 of the Regulation and Article 2-ter of the Code—are subject to the penalty provided for in Article 83, para 5, of the Regulation—as also referred to in Art 166, paragraph 2, of the Code—the total amount of the fine shall be set at up to 20,000,000 euros (twenty million/00). The aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Art. 83, para. 2, of the Regulation. Taking into account that: - with specific regard to the nature, severity, and duration of the violation, it must be considered that, although the processing concerned only one data subject, it had a significant impact on that individual as a result of the disclosure of his or her personal data to the employer (see Article 83(2)(a) of the Regulation); - the infringement was committed through negligence, as the processing was carried out based on the—albeit erroneous—“belief that a legal basis existed” (Article 83(2)(b) of the Regulation); - with regard to the categories of personal data disclosed, the data referred to in Articles 9 and 10 of the Regulation—concerning special categories of personal data or data relating to criminal convictions or offenses—are not included (Article 83(2)(g) of the Regulation) It is considered that, in the present case, the severity of this violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the Calculation of Administrative Fines under the GDPR” of May 24, 2023, paragraph 60). That said, it is considered that, for the purposes of quantifying the fine, the following factors should be taken into account in the data controller’s favor: the fact that the controller is a medium-sized municipality, that there are no prior relevant violations committed by the controller, as well as the specific context in which the controller operated in the case at hand, since the processing took place “during the early stages of the commissioner’s representation” and for the purpose of addressing a report of potential issues within the organizational structure of one of the companies entrusted with municipal public services (Art. 83, para. 2, subpars. e) and k), of the Regulation). However, the Municipality must be held accountable for failing to adopt measures to mitigate the harm suffered by the data subject, as it did not conduct further verifications or investigations regarding the preliminary information received from the complainant before involving—if necessary – XX (Art 83, para 2, subparagraphs c) of the Regulation). In light of the aforementioned factors, evaluated as a whole, it is determined that the amount of the monetary penalty shall be set at 5,000.00 (five thousand/00) euros for the violation of Articles 5, para 1, subparagraphs (a), (b) and (c), as well as Article 6, para 1, subparagraphs (c) and (e), para 2, and para 3, subparagraph (b) of the Regulation, and Article 2-ter of the Code, as an administrative fine deemed, pursuant to Article 83, para 1, of the Regulation, to be effective, proportionate, and dissuasive. In this context, it is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this chapter containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the specific circumstances of the case at hand, concerning the processing of a data subject’s personal data in the context of the sensitive handling of a “report” regarding potential criminal activity within the organizational context of the Special Agency where he was employed, thereby exposing him to potential retaliatory measures by the aforementioned employer. Finally, it is noted that the conditions set forth in Art. 17 of Regulation No. 1/2019 are met. NOW THEREFORE, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by the Municipality of Aprilia is unlawful, under the terms set forth in the reasoning, in violation of Articles 5(1)(a), (b) and (c), as well as Art 6(1)(c) and (e), para 2, and para 3(b) of the Regulation and Art 2-ter of the Code ORDERS pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the Municipality of Aprilia, with its headquarters at Piazza Roma, No. 1, 04011 Aprilia (LT), Tax ID No. 80003450592, to pay the total amount of 5,000.00 euros (five thousand/00) as an administrative fine for the violations set forth in the grounds of this decision. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed fine; ORDERS The Municipality of Aprilia: - to pay the total amount of 5,000.00 euros (five thousand/00) in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, in accordance with the procedures set forth in the attachment, within thirty days of service of this order, failing which the relevant enforcement measures will be adopted pursuant to Art. 27 of Law No. 689/1981; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this order on the Data Protection Authority’s website; - Pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58, para 2, of the Regulation in the Authority’s internal register provided for by Article 57, para 1, subparagraph (u), of the Regulation. Pursuant to Articles 78 of the Regulation, 152 of the Code, and 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, on pain of inadmissibility, within thirty days from the date of notification of this decision or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori [Web Doc. No. 10296755] Decision of September 3, 2026 Register of Decisions No. 615 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, President; Prof. Ginevra Cerrina Feroni, Vice President; Dr. Agostino Ghiglia, member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter, “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and on www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having reviewed the documentation on file; Having reviewed the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Ginevra Cerrina Feroni; PREAMBLE 1 Introduction. In a complaint filed on XX, supplemented on XX, Mr. XX alleged a violation of personal data protection regulations by the Municipality of Aprilia (hereinafter, the “Municipality”), stating, in particular, that on XX, he had sent a certified email (PEC) to the Municipality’s registry “requesting a meeting with the Special Commissioner […] in which he highlighted the reckless and XX management of the […] XX,” and that the aforementioned certified email requesting the meeting had been “first forwarded to two City officials […] and then directly to the Board of Liquidators [of XX, hereinafter also “XX”], which on XX […] in its capacity as employer, notified [the complainant] of the initiation of disciplinary proceedings.” In a subsequent note dated XX, the data subject supplemented the complaint initially filed by providing, in particular, evidence of the termination carried out by XX, which was notified to him “on XX, ref. no. XX, [regarding] the outcome of the disciplinary proceedings, which concluded with dismissal for just cause.” 2 The Preliminary Investigation In a letter dated XX, ref. no. XX—to which full reference is made—the Municipality responded to a request for information made by this Authority in a letter dated XX, ref. no. XX, stating, in particular, that: - “by Decree of the President of the Republic dated April 23, 2025, the Aprilia City Council was […] dissolved due to mafia infiltration pursuant to Art. 143 of Legislative Decree 267/2000, and the resulting Extraordinary Commission was appointed”; - “The processing of the complainant’s personal data was carried out by the Municipality of Aprilia in the exercise of tasks in the public interest and public powers conferred by law, pursuant to Art. 6(1)(e) of Regulation (EU) 2016/679”; in particular, this “falls within the scope of the institutional functions exercised by the Extraordinary Commission […], and is based on: - the administrative, policy-making, and supervisory functions assigned to the Commission aimed at restoring administrative and managerial legality within the Municipality and its affiliated companies; - in the powers of the shareholder entity over its subsidiaries, pursuant to Art. 9 of Legislative Decree No. 175/2016; - in the system of controls over the investee companies provided for in Art. 147-quater of Legislative Decree No. 267/2000”; - “The aforementioned communication, […] was functionally limited to the purposes pursued by the Municipality and did not entail any automatic extension of the legal basis on the part of the recipient for further or independent processing […]. In particular, the disclosure of the complainant’s name was necessary for the purpose of assessing the credibility of the report and conducting a proper investigation, with its use limited to those purposes”; - “The certified email (PEC) was […] sent […to] the Extraordinary Commission […which] proceeded to request information regarding the legal representatives of XX […using] the email address exclusively used by the Board of Liquidators.” Based on the information obtained, the Office, by letter dated XX (Ref. No. XX), notified the Municipality of Aprilia, pursuant to Article 166, paragraph 5, of the Code, of the initiation of proceedings for the adoption of the measures referred to in Article 58, paragraph 2, of the Regulation, since the disclosure of the complainant’s data by the Municipality to XX was carried out without an appropriate legal basis, in violation of Articles 6, para 1, letters c) and e), para 2, and para 3, subparagraph (b) of the Regulation and Article 2-ter of the Code, as well as in a manner inconsistent with the principles of “lawfulness, fairness, and transparency,” “purpose limitation,” and “data minimisation,” in violation of Article 5, para 1, subparagraphs (a), (b), and (c) of the Regulation. In the same notice, the Municipality was invited to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code; as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). The Municipality, which did not request a hearing, submitted its defense briefs via a letter dated XX, ref. no. XX, to which full reference is made, stating, in particular, that: a. With regard to the legal basis for the processing carried out, it was indicated that: - “By decree of the Prefect of Latina, an Investigative Commission was appointed—pursuant to Art. 141, paragraph 2, of the TUEL—to verify the possible existence of influence or infiltration by mafia-style organized crime within the Entity. Following the findings that emerged, by decree of the President of the Republic dated April 23, 2025 […], the Extraordinary Commission for the management of the local government was appointed […]”; - “The activities that are the subject of these proceedings fall within the initial phase of the commission’s representation […] to assess, verify, and restore administrative and managerial legality within the Municipality and the companies/agencies under its jurisdiction. […] “constitute the legal basis for the processing of the data in question: •Article 114, paragraphs 1 and 6, of Legislative Decree No. 267/2000, which defines the nature of the Special Agency and specifies the obligations that the local government has toward it; •Article 143, paragraph 1, of Legislative Decree No. 267/2000, which provides for the dissolution of the entity in the event of “forms of influence […] such as to compromise the proper functioning or impartiality of the administration,” with the purpose of ensuring the restoration of administrative legality; • Article 144, paragraph 1, of Legislative Decree No. 267/2000, pursuant to which the Extraordinary Commission exercises the powers vested in the Authority’s governing bodies; • Article 145, paragraph 4, of Legislative Decree No. 267/2000, which provides for the granting of stringent investigative powers to the Extraordinary Commission, whenever the dissolution, as in the present case, is ordered in connection with specific instances of mafia influence related to the awarding of contracts or the granting of concessions for local public services; • Article 147-quater, paragraph 1, of Legislative Decree No. 267/2000, which provides for constant and effective oversight of investee companies—to which Special Agencies, such as XX, are equated […]—from both an administrative and financial standpoint”; - “A combined reading of the aforementioned provisions, also in light of the provisions of Art 6, paragraph 3, subparagraphs (a) and (b), of the Regulation, outlines a regulatory framework in which audit and oversight activities are not merely optional but constitute an integral and necessary part of the exercise of the functions assigned to the Extraordinary Commission in a municipality dissolved due to mafia infiltration”; - the “verification […] of the statements made by an individual reporting on ‘…reckless management and with XX…’ within the municipal Special Agency” was intended to “determine whether the statements contained in the certified email (PEC) had any basis in fact or were the result of baseless allegations made by an individual employed by his own Special Agency […to which] the Municipality of Aprilia had entrusted various municipal services […]”; b. regarding the procedures for disclosing the complainant’s personal data, the Municipality stated, in particular, that: - “the legal provisions authorizing the […] processing of the personal data of the […complainant and the] Presidential Decree of April 23, 2025 […], as a general administrative act […], constitute] the framework within which said Commission operates, in accordance with the broadest powers referred to in the aforementioned Art 145, paragraph 4, of Legislative Decree 267/00 […]”; - “It appeared entirely lawful, necessary, and proportionate to inform […XX] of the receipt of a request for a meeting submitted by an employee of the same company, in which the employee made a completely general allegation regarding the “…insane management and XX of the municipal utility…,” with the aim of obtaining a report on the aforementioned employee”; - “Given the close relationship between the Municipality and the municipal utility, XX, it appeared essential […] to do so before […] deciding whether or not to grant the requested meeting”; - “In this context, it is reiterated that the disclosure of the minimum personal data (first and last name) of the complainant to XX, in its capacity as an independent controller and employer of the author of the certified email (PEC), was necessary for the purposes of conducting the preliminary investigation, as it represented the only suitable means to allow for a concrete—rather than merely abstract—verification of the reported facts”; “The disclosure was therefore limited to the data deemed necessary for the purposes pursued, without including any information beyond that already contained in the communication sent to the Authority by the complainant”; - “The Administration’s actions were carried out in accordance with the principle of data minimisation, understood not only as a quantitative reduction of the data processed, but also as ensuring the adequacy and relevance of such data with respect to the specific context of the investigation”; c. Finally, with regard to the subsequent outcomes of the dialogue with XX, the Municipality stated that: - “Any further decisions adopted […by XX] concerning the complainant fall within its autonomous organizational and decision-making sphere and are not attributable, either causally or functionally, to the purposes of the communication made by the Authority”; - “the alleged unlawful processing would have concerned a single communication, addressed to a very limited number of people,” “the third party that became aware of the personal data is a Special Agency instrumental to the Municipality, treated as a public entity,” “the processing occurred entirely through negligence, due to the belief that a legal basis existed,” there are no “previous measures,” and that the Municipality has made itself “available to issue, even in the near future, a memo to all managerial staff to highlight the critical issues that have emerged in this specific case and to take corrective measures.” It is further noted that on XX, the complainant supplemented his complaint by providing additional documentation to the Authority, submitting some of the correspondence exchanged between himself, the Municipality, and XX, for the purpose of obtaining further clarification on how his “report” to the Municipality of XX was being handled. In this regard, in order to obtain a comprehensive overview from both parties, the Authority submitted a further request for information to the Municipality via a letter dated XX, ref. no. XX, to which the Municipality responded via a letter dated XX, ref. no. XX, providing the requested clarifications and documentation. 3 Outcome of the Preliminary Investigation 3.1 Legislation Governing the Protection of Personal Data As a preliminary matter, it should be noted that the processing of personal data must comply with applicable legislation governing data protection and, in particular, with the provisions of the Regulation and the Code. Specifically, public entities may process personal data only if such processing “is necessary for compliance with a legal obligation to which the controller is subject,” or when “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6, para. 1, subpars. (c) and (e) of the Regulation). National legislation has introduced more specific provisions to align the application of the Regulation’s rules, establishing, with greater precision, specific requirements for processing and other measures designed to ensure lawful and fair processing (Article 6, para 2 of the Regulation) and, in this context, has provided that processing is permitted only when required by a law, regulation, or general administrative act (Article 2-ter of the Code). The controller is required, in any case, to comply with data protection principles, including those of “lawfulness, fairness, and transparency,” “purpose limitation,” and “data minimisation,” pursuant to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject,” “collected for specified, explicit, and legitimate purposes, and subsequently processed in a manner that is not incompatible with those purposes,” as well as “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Art. 5, para. 1, subpars. a), b), and c) of the Regulation). With regard to the case at hand, specifically concerning the disclosure of personal data to third parties, given the definition of “disclosure” set forth in Article 2-ter, paragraph 4, of the Code, it is clarified that the same article also provides that “The legal basis provided for in Article 6, paragraph 3, subparagraph b) of the Regulation consists of a law, regulation, or general administrative act” and that “the disclosure of personal data, processed for the performance of a task carried out in the public interest or in the exercise of official authority, to entities intending to process such data for other purposes is permitted only if provided for under paragraph 1 or if necessary under paragraph 1-bis” (paragraphs 1 and 3). Finally, it should be noted that, pursuant to Article 2-decies of the Code, the disclosure and subsequent acquisition of personal data by another data controller, if carried out in the absence of an adequate legal basis, constitute a violation of the relevant regulations governing the processing of personal data and may not be used, except as provided for in Art. 160-bis of the Code, which does not prejudice the assessments of the judicial authority. 3.2 The Unlawful Disclosure of Personal Data First, it should be noted that the investigation was conducted exclusively in relation to the processing carried out by the Municipality of Aprilia—the sole entity against which the data subject filed the complaint—and did not, however, concern the subsequent processing carried out by XX, in its capacity as employer, particularly given the alternative remedies already pursued by the complainant against the latter regarding the lawfulness of the termination resulting from the aforementioned disclosure. That said, it should be noted that the investigation conducted on the basis of the evidence gathered and the facts that emerged following the preliminary inquiry, as well as the Office’s subsequent assessments, revealed that, in the certified email (PEC) dated XX, the complainant merely requested that the Municipality’s Extraordinary Commission “a meeting in order to provide detailed information on the reckless and XX management of XXi,” stating that he was addressing the Municipality “both for reasons of public interest and in relation to […his] situation of workplace bullying” and that he remained “available for any further clarification or supplementary documents.” This communication did not include any attached documentation nor did it contain references to specifically identified circumstances or facts, which, if anything, would have constituted the subject matter of the requested meeting and/or of any supplementary documentation that the complainant had offered to provide, should the Commission request it. Following this communication and without conducting any preliminary investigation aimed at obtaining further details and/or information directly from the complainant regarding the matters generically described, the Municipality instead proceeded to disclose the complainant’s personal information, along with the certified email (PEC) of XX, to XX—a third party with independent legal personality and the complainant’s employer—regarding whom the complainant intended to bring potential unlawful conduct to the attention of the Special Commission for further investigation. Specifically, in an email dated XX, the Municipality requested from the Board of Liquidators of XX “a report on the employee” and, in general, “on the matters he raised in the attached note [dated XX],” although, as admitted by the Extraordinary Commission itself, this was an entirely generic “report.” Following this request, XX initiated, on the one hand, disciplinary proceedings against its employee, which culminated in his dismissal, and, on the other hand, in a memo dated XX, he sent the Municipality a detailed report on the work-related events involving the complainant, focusing on a precise description of the previous disciplinary charges and sanctions imposed on him, supported by the relevant documentation attached. In light of this response, the Municipality determined that it did not need to conduct further investigations with the complainant and did not proceed with the requested meeting, as the information provided was, in fact, superfluous to the subject matter of the report, since it focused exclusively on disciplinary matters relating to the employment relationship between the employee and XX. That said, with regard to the legal basis for the data disclosure, the Municipality, in the aforementioned letter dated XX, initially stated—in a tautological manner—that the processing would take place “in the exercise of tasks in the public interest and public powers conferred by law, pursuant to Article 6(1)(e) of Regulation (EU) 2016/679, in accordance with the principles of lawfulness, fairness, and transparency set forth in Article 5(1)(a) of the same Regulation” and “in the context of the institutional functions exercised by the Special Commission,” without, however, indicating an appropriate basis of lawfulness for the processing, failing to mention—as required by Article 2-ter of the Code— the specific law, regulation, or general administrative act that provides for the processing in question—namely, the disclosure of the complainant’s data to the Special Agency. In fact, the regulatory provisions cited by the Municipality govern very general aspects of local authorities’ participation in publicly owned or publicly funded companies: in particular, Articles 7–10 of Legislative Decree No. 175 of August 19, 2016, govern the establishment of publicly owned companies, the acquisition of shares in already established companies, the management of shareholdings, divestitures, etc.; Art 9, specifically cited by the Municipality, governs certain general aspects regarding the exercise of rights by the local government as a shareholder (shareholder agreements, validity of resolutions, appointment and removal of members of the company’s internal bodies, etc.). Similarly, Art 147-quater of Legislative Decree No. 267/2000, containing the “Consolidated Law on Local Government,” regulates the system of controls over investee companies with regard to the achievement of established management objectives, analyzing any deviations, including with respect to potential economic and financial imbalances relevant to the entity’s budget. Similar considerations may be made regarding the regulatory provisions cited in the defense briefs, and specifically, paragraphs 1 and 6 of Article 114 of Legislative Decree No. 267/2000, regarding the general aspects of the relationship between the local government and the special agency (endowment capital, determination of assigned purposes, fundamental acts, oversight, verification of management results, coverage of any social costs), Article 143, paragraph 1, of Legislative Decree No. 267/2000, regarding additional cases of dissolution of the local government, Article 144, paragraph 1, of Legislative Decree No. 267/2000, on the assignment of municipal duties to the Extraordinary Commission, as well as the aforementioned Art. 147-quater, paragraph 1, of Legislative Decree No. 267/2000. With regard, furthermore, to the “extensive investigative powers vested in the Commission,” in the event of the dissolution of the local authority due to “specific situations of mafia influence related to the awarding of contracts or the granting of concessions for local public services,” pursuant to Art Article 145, paragraph 4, of Legislative Decree No. 267/2000—also cited by the Municipality as the basis for the processing in question—makes it clear that these powers apply, including with respect to special-purpose agencies, in the ability to “request details and information regarding the conduct of the bidding process and the performance of the contract” (Art. 14, paragraph 3-bis, of Decree-Law No. 152 of May 13, 1991, No. 152, converted, with amendments, by Law No. 203 of July 12, 1991), and to adopt the “measures deemed necessary […] at any time and stage of the contractual procedure, or the termination of the contract already concluded.” The request made by the Municipality to XX cannot in any way be classified under these provisions, not only because of the absence of any reference to a competitive bidding process or procurement contract, but also because it is aimed solely at “request a report on the employee in question and on the points he raised in the attached note,” and not on specific situations pertaining to the “conduct of the bidding process” or the “performance of the procurement contract”—circumstances certainly not provided by the complainant in the generic certified email (PEC) dated XX. Moreover, although the aforementioned Commission invoked the exercise of the powers provided for in Article 145 of Legislative Decree 267/2000 as the basis for processing the complainant’s data, it did not deem it necessary to obtain—by specifically requesting them from the complainant— precisely that additional information or documentation “regarding the reckless management and XX of the XX,” which would have enabled it to exercise those powers; nor, as noted, did it deem it necessary to schedule an appointment with the complainant. Given that Article 2-ter, paragraph 4, of the Code clarifies that “disclosure” means “making personal data known to one or more specific parties other than the data subject” and the other parties indicated in the aforementioned provision, and that the same article specifies that “The legal basis provided for in Article 6, paragraph 3, letter b), of the Regulation consists of a law, regulation, or general administrative act” (paragraphs 1 and 3), the disclosure of the complainant’s personal data and the forwarding of the certified email (PEC) dated XX to XX, a third party and independent controller, appears to have been carried out by the Municipality without an adequate legal basis. In fact, none of the provisions cited by the Municipality as the basis for disclosing the complainant’s personal data meets the requirements set forth in data protection legislation. Article 6(3)(b) of the Regulation provides that the legal basis for processing necessary to comply with a legal obligation or to perform a task carried out in the public interest must include specific provisions such as, for example, the general conditions regarding the lawfulness of the processing by the controller, the types of data subject to processing, the data subjects, the recipients to whom the personal data may be disclosed and the purposes for which they are disclosed, the purpose limitation, storage periods, and the processing operations and procedures, including measures to ensure lawful and fair processing. In light of the aforementioned regulatory framework and the information provided by the Municipality during the preliminary investigation, the processing of the complainant’s data was therefore carried out without an adequate legal basis, in violation of the principle of “lawfulness, fairness, and transparency” set forth in Art. 5, para. 1, subparagraph (a) of the Regulation, as well as Articles 6(1)(c) and (e), (2), and (3)(b) of the Regulation and Article 2-ter of the Code. 3.3 Violation of the principles of “purpose limitation” and “data minimization” In addition to what was set forth in paragraph 3.2 above, and without prejudice to the need for an adequate legal basis, with reference to the stated processing purpose—identified as the “assessment of the reliability of the report and proper investigation”— in the “need to conduct more detailed investigations […] to determine whether the statements contained in the certified email (PEC) were substantiated or were the result of baseless allegations made by an individual employed by its own special agency,” within the scope of the aforementioned “administrative, policy-making, and supervisory functions assigned to the Commission,” it is noted that the Municipality has not provided adequate evidence to demonstrate either the actual conduct of an investigation into the “report,” nor the actual necessity of forwarding the complainant’s PEC message directly to XX rather than formulating specific requests for further investigation—while taking particular precautions—possibly following the acquisition of more specific information from the complainant. In this regard, it is noted first of all that, although the complainant did not request that his identity be kept confidential, nor did he request the application of legal provisions—which are provided for by law—that ensure the confidentiality of the complainant’s identity and the content of the report, it is evident, in essence, that the Municipality should have—even with a view to preventing the risk of retaliatory acts against the employee—nevertheless taken special precautions and measures in handling the preliminary information it received and in investigating the matter reported. In this regard, it should be noted that the “report” and the subsequent request for a meeting made to the Municipality by the complainant are presumably based on the trust placed in the exercise of the investigative powers vested in the Special Commission for the pursuit of the purposes assigned to it (such as, pursuant to the Presidential Decree of April 23, 2025, “to eliminate effects detrimental to the public interest and ensure the financial rehabilitation of the local government”), rather than on the existence of the Municipality’s equity interests in the “reported” entity. Second, it should be noted that the subject matter of the request made by the Municipality to XX (“a report on the employee […] and on the points he raised in the note”), together with the transmission of the certified email to the “reported” individual —who is also the complainant’s employer—given the extremely vague nature of the report (“reckless management by XX”), not only exposed the latter to a foreseeable risk of retaliation but also could not be considered, ex ante, suitable for achieving the purpose of obtaining the specific information identified by the cited provisions as the basis for the processing, since that request was addressed precisely to the “reported” individual; as in fact emerged during the investigation, the request made to XX on XX did not yield any clarification regarding the possible groundlessness of what was—generically—reported, but rather resulted in a report entirely focused on the employee’s employment relationship. Therefore, the disclosure of the complainant’s data to XX was carried out not only in the absence of a legal basis but also in violation of the principle of “purpose limitation” set forth in Article 5(1)(b) of the Regulation. Similarly, the request for an “employee report” and the subsequent acquisition of the detailed response prepared by XX cannot be considered justified, given that the Municipality has no authority over the management of the Special Agency’s personnel and could not have issued any decision in this regard. In any case, even if one were to consider the need for a preliminary “exploratory” request addressed directly to the “reported” individual, the Municipality would still have been required, in accordance with the principle of “data minimization” set forth in Art. 5, para. 1, subparagraph (c) of the Regulation, the necessary safeguards to ensure that the data subject was not, in the first instance, exposed to the presumed risk of retaliation from their employer. The Extraordinary Commission could have, on the one hand, requested clarification from the Special Agency regarding the “report,” without revealing the data subject’s identity, and, on the other hand, utilize additional legal remedies, where deemed necessary, to preliminarily gather information regarding the complainant “XX”’s possible affiliation, including for the purpose of deciding whether or not to grant the data subject’s request for a meeting. For the reasons set forth above, it is therefore established that the Municipality processed data in a manner inconsistent with the principles of “purpose limitation” and “data minimisation,” in violation of Article 5(1)(b) and (c) of the Regulation. 4 Conclusions. In light of the assessments referred to above, and taking into account the statements made by the controller during the preliminary investigation—the veracity of which may be called into question pursuant to Article 168 of the Code—it is noted that the evidence provided by the controller in its defense briefs do not sufficiently address the findings notified by the Office in the notice initiating the proceedings, and are insufficient to warrant the dismissal of this proceeding pursuant to Art. 14, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, as none of the cases provided for in Art. 11, as referenced therein, apply. Therefore, the Office’s preliminary findings are confirmed, and the processing of personal data by the Municipality is found to be unlawful, as it was carried out in a manner inconsistent with the principles of “lawfulness, fairness, and transparency,” “purpose limitation,” and “data minimisation,” in violation of Article 5, para 1, subparagraphs (a), (b), and (c) of the Regulation, as well as in the absence of an appropriate legal basis, in violation of Articles 6(1)(c) and (e), para 2, and (3)(b) of the Regulation and Article 2-ter of the Code. The violation of the aforementioned provisions renders applicable the administrative sanction provided for in Article 83(5) of the Regulation, pursuant to Articles 58(2)(i), and 83(3) of the Regulation, as also referred to in Article 166, paragraph 2, of the Code. Given, in any case, that the Municipality’s conduct has ceased to have any effect, the conditions for adopting further corrective measures under Art 58, para 2, of the Regulation are not met. 5 Adoption of an injunction ordering the imposition of an administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166(7) of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction, by which it also orders the application of the ancillary administrative sanction of its publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). Given that the violation of the aforementioned provisions occurred as a result of a single act (the same processing operation or related processing operations), Art. 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, all the violations identified—relating to Articles 5 and 6 of the Regulation and Article 2-ter of the Code—are subject to the penalty provided for in Article 83, para 5, of the Regulation—as also referred to in Art 166, paragraph 2, of the Code—the total amount of the penalty shall be set at up to 20,000,000 euros (twenty million/00). The aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Article 83, para 2, of the Regulation. Taking into account that: - with specific regard to the nature, severity, and duration of the violation, it must be considered that, although the processing concerned only one data subject, it had a significant impact on that individual as a result of the disclosure of his or her personal data to the employer (see Article 83(2)(a) of the Regulation); - the infringement was committed negligently, as the processing was carried out based on the—albeit erroneous—“belief that a legal basis existed” (Article 83(2)(b) of the Regulation); - with regard to the categories of data disclosed, the data referred to in Articles 9 and 10 of the Regulation—concerning special categories of personal data or data relating to criminal convictions or offenses—are not included (Article 83(2)(g) of the Regulation) It is considered that, in the present case, the severity of this violation committed by the controller is moderate (see European Data Protection Board, “Guidelines 4/2022 on the Calculation of Administrative Fines under the GDPR” of May 24, 2023, paragraph 60). That said, it is considered that, for the purposes of quantifying the fine, the following factors should be taken into account in the data controller’s favor: the fact that the controller is a medium-sized municipality, that there are no prior relevant violations committed by the controller, as well as the specific context in which the controller found itself operating in the case at hand, since the processing took place “during the early stages of the commissioner’s representation” and for the purpose of addressing a report of potential critical issues within the organizational context of one of the companies entrusted with municipal public services (Art. 83, para 2, subparagraphs (e) and (k), of the Regulation). However, the Municipality must be held accountable for failing to adopt measures to mitigate the harm suffered by the data subject, as it did not conduct further verifications or investigations regarding the preliminary information received from the complainant before involving—if necessary – XX (Art 83, para 2, subparagraphs (c) of the Regulation). In light of the aforementioned factors, evaluated as a whole, it is determined that the amount of the administrative fine shall be set at 5,000.00 (five thousand/00) euros for the violation of Articles 5, para 1, subparagraphs (a), (b), and (c), as well as Article 6, para 1, subparagraphs (c) and (e), para 2, and para 3, subparagraph (b) of the Regulation, and Article 2-ter of the Code, as an administrative fine deemed, pursuant to Article 83, para 1, of the Regulation, to be effective, proportionate, and dissuasive. In this context, it is also considered that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this chapter containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the specific circumstances of the case at hand, concerning the processing of a data subject’s personal data in the context of the sensitive handling of a “report” regarding potential criminal activity within the organizational context of the Special Agency where he was employed, thereby exposing him to potential retaliatory measures by the aforementioned employer. Finally, it is noted that the conditions set forth in Art. 17 of Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY pursuant to Articles 57(1)(f) and 83 of the Regulation, finds that the processing carried out by the Municipality of Aprilia is unlawful, under the terms set forth in the reasoning, in violation of Articles 5(1)(a), (b) and (c), as well as Article 6(1)(c) and (e), (2), and (3)(b) of the Regulation and Article 2-ter of the Code ORDERS pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the Municipality of Aprilia, with its headquarters at Piazza Roma, No. 1, 04011 Aprilia (LT), Tax ID 80003450592, to pay the total sum of 5,000.00 euros (five thousand/00) as an administrative fine for the violations set forth in the grounds of this decision. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed fine; ORDERS The Municipality of Aprilia: - to pay the total amount of 5,000.00 euros (five thousand/00) in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, in accordance with the procedures set forth in the attachment, within thirty days of service of this order, failing which the Authority will adopt the necessary enforcement measures pursuant to Art. 27 of Law No. 689/1981; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; - Pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, this order shall be published on the Data Protection Authority’s website; - Pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Articles 78 of the Regulation, 152 of the Code, and 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, on pain of inadmissibility, within thirty days from the date of notification of the decision or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Cerrina Feroni THE SECRETARY GENERAL Montuori

applies Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(e), Art. 6(2), Art. 6(3), Art. 6(3)(b), Art. 57(1)(f), Art. 57(1)(u), Art. 58(2), Art. 58(2)(i), Art. 83(2)(a), Art. 83(2)(b), Art. 83(2)(g), Art. 83(3), Art. 83(5), Art. 2, Art. 5, Art. 6, Art. 7, Art. 9, Art. 10, Art. 11, Art. 14, Art. 15, Art. 16, Art. 17, Art. 18, Art. 27, Art. 37, Art. 57, Art. 58, Art. 78, Art. 83