Enforcement · Italian Data Protection Authority (Garante) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Conservatorio di Musica S. Cecilia di Roma: Insufficient legal basis for data processing

The Italian DPA has imposed a fine of EUR 6,000 on 'Conservatorio di Musica S.

€6,000 Fine
Conservatorio di Musica S. Cecilia di Roma
ITALY
Art. 5 GDPR Art. 6 GDPR Art. 38 GDPR Art. 2 GDPR
Supervisory Authorities Controllers Personal Data Processing Education
Nov 10, 2022 Source garanteprivacy.it

Full text

The Italian DPA has imposed a fine of EUR 6,000 on 'Conservatorio di Musica S. Cecilia di Roma'. A student of the educational institution had filed a complaint with the DPA for having received a disciplinary sanction for a statement made during a student assembly. Although it was not supposed to be, the assembly was recorded and the institution used the recordings to base the disciplinary action on it. During its investigation, the DPA determined that the controller did not have a valid legal basis to use the assembly recordings and, therefore, the processing of the student's personal data was unlawful. Also, the DPA found that the educational institution's data protection officer was also the institution's director. The DPA considered this to be an unlawful conflict of interest.

Industry: Public Sector and Education

How it connects

References

Related across sources

C-210/16 Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein C-210/16 (Wirtschaftsakademie) CJEU Jun 5, 2018 IP Address Controllers Processors
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
C-579/21 Proceedings brought by J.M In Case C-579/21, the Court of Justice of the European Union ruled on a preliminary reference from the Itä-Suomen hallinto-oikeus (Administrative Court of Eastern Finland)… CJEU ·First Chamber Jun 22, 2023 Right of Access Personal Data Right to Restriction
C-534/20 Leistritz AG v LH The Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the German Bundesarbeitsgericht in a dispute between Leistritz AG and its former… CJEU ·First Chamber Jun 22, 2022 Processors Controllers Personal Data
C-453/21 X-FAB Dresden GmbH & Co. KG v FC In Case C-453/21, the CJEU addressed a preliminary reference from the Bundesarbeitsgericht concerning X-FAB Dresden GmbH & Co. KG's dismissal of its employee FC from the position… CJEU ·Sixth Chamber Feb 9, 2023 Processors Supervision Prior Consultation
C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority
Related documents