Conservatorio di Musica S. Cecilia di Roma: Insufficient legal basis for data processing

The Italian DPA has imposed a fine of EUR 6,000 on 'Conservatorio di Musica S. Cecilia di Roma'. A student of the educational institution had filed a complaint with the DPA for having received a disciplinary sanction for a statement made during a student assembly. Although it was not supposed to be, the assembly was recorded and the institution used the recordings to base the disciplinary action on it. During its investigation, the DPA determined that the controller did not have a valid legal basis to use the assembly recordings and, therefore, the processing of the student's personal data was unlawful. Also, the DPA found that the educational institution's data protection officer was also the institution's director. The DPA considered this to be an unlawful conflict of interest.

GDPR Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 38 GDPR, Art. 2-ter Codice della privacy
Industry: Public Sector and Education