Executive Lead
Municipal digitalization initiatives increasingly delegate public registry management to commercial mobile applications without maintaining strict regulatory oversight. When digital cemetery registries and memorialization services blur the lines between administrative record-keeping and commercial user tracking, the statutory protections governing citizens and deceased individuals collapse into jurisdictional ambiguity.
A critical investigation into outsourced municipal digital platforms demonstrates how administrative chain-of-custody failures leave sensitive registry information vulnerable to commercial misallocation. The intersection of local authority delegation, multi-tiered subcontracting, and posthumous privacy rights reveals a systemic enforcement gap across public sector software deployments.
Historical and Institutional Context
The transformation of public cemetery administration from physical ledgers to cloud-based management platforms began as a municipal efficiency drive across European local authorities. Under the framework of Italian Legislative Decree no. 196/2003, local administrations initially structured vendor agreements around localized service provisions, such as physical votive lighting management and basic registry indexing.
As digital platforms evolved, municipal authorities sought comprehensive digital solutions capable of mapping grave plots, managing memorial tributes, and offering remote interaction for relatives. However, the contractual foundations governing these relationships frequently failed to adapt to modernized data protection requirements introduced by the European General Data Protection Regulation (Regulation EU 2016/679).
Historical records show that formal designations dating back to municipal mayoral decrees established legacy frameworks that persisted without adequate updates. In many jurisdictions, public service agreements originally drafted exclusively for mechanical or electrical upkeep were casually repurposed to cover comprehensive cloud application suites, creating substantial regulatory discrepancies.
The administrative shift accelerated with the integration of specialized applications designed to aggregate deceased records, geolocation data, and registered user profiles. This technological expansion created a fragmented operational architecture where municipal entities, in-house public utilities, and private software intermediaries operated across conflicting legal definitions of data control.
Key Entities and Structural Actors
The institutional ecosystem surrounding municipal cemetery app deployments involves public territorial authorities, intermediary operational bodies, and multi-layered software development vendors operating under distinct contractual mandates.
Public and Institutional Bodies
The [[Municipality of Ancona|Q3415]] served as the original statutory data controller, maintaining legal ownership of municipal civil status and cemetery registry records while delegating administrative operations to external entities through historical executive decrees, including Mayoral Decree no. 139/2008.
The public utility company AnconAmbiente operated as an intermediate institutional entity tasked with local operational management. Under municipal delegation, this body executed direct procurement procedures for technological solutions and entered into downstream agreements with external software service providers.
The [[Italian Data Protection Authority|Q3758637]] acted as the national supervisory authority responsible for enforcing compliance under the framework of the [[General Data Protection Regulation|Q1172284]] and national legislative provisions governing administrative transparency and civil data rights.
Commercial and Technical Intermediaries
The corporate entity ISSAM Consultancy LTD entered into contractual arrangements as a designated data processor under Article 28 of the GDPR, holding structural responsibility for technical service provision and system-level data management operations.
The software development enterprise STUP 1 S.r.l.s. operated as a sub-processor designated by ISSAM Consultancy LTD to process user registry data for the Aldilapp platform, while simultaneously engaging in direct software provision contracts with the local public utility.
Critical Analysis of Evidence and Governance Failures
A rigorous examination of public records, contractual instruments, and supervisory notices uncovers profound structural disconnects within the administrative processing chain. Rather than a unified data management workflow, the architecture presents significant regulatory fragmentation.
Contractual Ambiguity and Scope Repurposing
Contractual documentation reveals that formal processor designation instruments suffered from severe title and scope discrepancies. Agreements formally designated under specific operational headings were retroactively treated as catch-all authorizations for unrelated digital processing activities.
“The subsequent deed of designation, pursuant to art. 28 of Regulation EU 2016/679, for the sake of brevity alone, bears as its title the wording of the ‘votive lamp service’, but in reality this agreement authorizes the processor to process the entire list of services carried out by the operator.”
This contractual conflation demonstrates a fundamental breakdown in the principle of purpose specification. When a legal agreement titled for simple utility lighting is leveraged to govern mobile application databases, geolocation tracking, and biometric or familial registries, the legal basis of processing becomes inherently compromised.
Multi-Tiered Delegation and Sub-Processor Friction
The operational chain between public authority and technical provider involved an opaque distribution of responsibilities. While AnconAmbiente enacted a direct award to STUP 1 S.r.l.s. for software supply, parallel agreements designated ISSAM Consultancy LTD as the external processor, which subsequently re-designated STUP 1 S.r.l.s. as a sub-processor for handling user registries.
This fragmented delegation model generated conflicting data ownership claims. The platform deployed two distinct privacy notices (designated Information Notices A1 and A2) to end users, simultaneously asserting separate data controller roles and confusing platform visitors regarding who held legal authority over their processed data.
“The concept of data controller should not be confused with other concepts, sometimes conflicting or coinciding, typical of other fields of law, such as that of author or holder of intellectual property rights or competition law.”
The supervisory record firmly rejects the argument that technical vendors can independently alter processing parameters to claim autonomous data control. When administrative clarity is missing in the foundational Article 28 instrument, processing ambiguity directly stems from institutional failure rather than unilateral vendor action.
The Post-Mortem Data Boundary and Civil Rights
A central vulnerability exposed by this architecture involves the legal treatment of deceased individuals’ records. While Recital 27 of the GDPR provides a safeguard clause allowing European Union Member States to regulate posthumous data processing, the Italian legal framework establishes explicit mechanisms under Article 2-terdecies of the Privacy Code.
“The rights referred to in Articles 15 to 22 of the Regulation relating to personal data concerning deceased persons may be exercised by those who have an interest of their own, or act to protect the interested party, as their agent, or for family reasons deserving protection.”
The operational evidence shows that while vendors claimed to process exclusively deceased records—theoretically attempting to bypass general GDPR provisions—the integration of user profiles, self-declarations, and administrative delegation inevitably captured living personal data. The failure of public entities to receive or properly route statutory requests under Article 2-terdecies underscores a total absence of functional rights-management workflows within the app interface.
Unresolved Questions in Public Tech Procurement
The documentary evidence leaves critical operational questions unanswered. It remains undetermined how local public authorities evaluate technical and organizational safeguards when granting direct commercial awards for public records management platforms.
Furthermore, the persistent reliance on legacy decrees pre-dating modern European privacy frameworks highlights widespread administrative inertia. Local administrations frequently transfer operational risk to private micro-enterprises without maintaining ongoing oversight mechanisms or verifying whether sub-processor chains maintain active, compliant data separation.
Transparency and Legal Framework
This investigation is established on primary public administrative records and formal supervisory findings issued under Italian Law no. 689/1981 and Article 166 of the Italian Personal Data Protection Code. These instruments document official regulatory compliance inquiries regarding municipal administration and third-party software procurement.
In accordance with Article 5 of Italian Law no. 633/1941, official texts of state acts and public administrative proceedings are exempt from copyright restrictions and belong fully to the public domain. The complete administrative documentation is accessible via the Italian Data Protection Authority register under official proceeding reference Provvedimento del 12 febbraio 2026, Docweb n. 10225650, accessible through garanteprivacy.it.