(by Federica De Stefani, lawyer and head of Aidr Lombardy Region) Privacy and Covid bonus of € 600 in these days have been at the center of the news for the request made by some parliamentarians and public administrators in order to obtain the bonus paid by the INPS for the emergency caused by the pandemic.
The story has aroused heavy controversy and criticism, also from an ethical and moral point of view, as the bonus aimed at supporting VAT number holders severely hit by the lockdown and by the economic repercussions deriving from the latter on their respective work activities.
The indignation aroused by the news and the request, by several parties, to disclose the names of those who would have submitted the application, led to an intervention by the Guarantor for the protection of personal data who, in order to avoid privacy being invoked inappropriately, in its statement no. 9447662 of 11 August 2020 specified two important aspects. In the first place, privacy is not an obstacle to the publicity of data relating to the beneficiaries of the contribution where, as in the present case, it is not possible to infer a condition of economic and social hardship of the interested party. Secondly, the principle applies, all the more so, to all those for whom, due to the public function performed, the expectations of confidentiality are weakened, also as a result of the more incisive disclosure obligations of the assets to which the themselves.
The Guarantor then, with the press release of 17 August 2020, sent some clarifications to the INPS on the publication and communication of the data of the beneficiaries of the bonus who hold public elected positions.
In summary, there is no obligation to publish the personal data of the entire list of beneficiaries of economic contributions, which concern several million citizens.
In fact, the Guarantor reiterates the indications already provided to public administrations with its own guidelines on transparency.
They provide for the obligation to publish deeds of granting economic advantages, of any kind, to public and private persons and entities, if the amount of the disbursement exceeds one thousand euros.
In any case, the identification data of the natural persons recipients of any remuneration cannot be published and regardless of the amount of the latter, in the event that these data may reveal information relating to the state of health or the economic and social hardship of the concerned.
It is therefore the duty of the administration receiving the obligation to publish to assess the conditions of hardship and, in the event of their existence, to provide for the disbursement of the contribution, without however, for what has already been said, publish the personal data of the recipients.
This evaluation activity was in effect carried out by INPS which, based on the Cura Italia Decree, classified the bonus of 600 euros as a "social safety net", that is a benefit to support income and, as such, suitable for disclose a situation of economic hardship of the recipient.
The press release then goes on to indicate that, with reference to the requests for generalized civic access received by INPS regarding the data of the beneficiaries of the bonus, the Guarantor cannot adopt a formal opinion as the conditions are not met. In any case, he recalled the indications contained in the Guidelines of the National Anti-Corruption Authority, which specify that in order to assess the existence of a real concrete prejudice to the privacy of the interested parties, on the basis of which to decide whether or not to refuse civic access to their data, the entity receiving the request must refer to various parameters that must be assessed on a case-by-case basis. It is therefore the task of INPS to verify, in the individual concrete case, the possibility of making the requested personal data known through civic access.
Therefore, under certain conditions, the names of the beneficiaries can be made public, an aspect that has aroused public uproar and interest for the related political implications.
From a legal point of view, however, the crux of the matter also concerns other elements, namely the ways in which the INPS came to identify the interested parties and which criteria it used.
In practice, how was it possible to trace the identification of parliamentarians and other public administrators?
On this aspect, the Guarantor has opened a specific investigation asking the INPS in particular to know various elements that
concern:
- what is the legal basis of the processing carried out on the personal data of the interested parties;
- the origin and types of personal data processed, referring to the office of local and regional parliamentarian and administrator;
- the methods by which the processing was carried out, with specific regard to the "comparison" of the personal data of the applicants or beneficiaries of the bonus, with those relating to the office of local and regional parliamentarian and administrator;
- the scope of the processing and any communications to third parties of such data.
Therefore, if it is necessary to wait for the outcome of the investigation launched by the Guarantor, there is no doubt that there is more than a few doubts about compliance with the rules on the protection of personal data. What is striking is undoubtedly the clamor aroused by the affair on the political side, while few, and above all almost exclusively "insiders", have raised the problem of the ways in which the INPS has come to identify these names.
The suspicion, unfortunately, is that privacy still remains (almost) unexplored terrain for many today.