Trib. of Bologna - RG 12124/2020

Trib. of Bologna - RG 12124/2020
Court:	Tribunal of Bologna (Italy)
Jurisdiction:	Italy
Relevant Law:	Regulation 2016/679
Decided:	30.07.2022
Published:	30.07.2022
Parties:	Data subject against COMET S.P.A.
National Case Number/Name:	RG 12124/2020
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	Italian
Original Source:	archive.org (in Italian)
Initial Contributor:	andrea mereu

The Tribunal of Bologna held that a copy of data as described in Article 15(3) GDPR was not limited to personal data, but also extended to documentation related to the processing (for example including documentation signed by the data subject, e.g. the release of privacy consents in the paper forms).

English Summary

Facts

A data subject made an access request to Comet s.p.a., the controller, to verify the lawfulness of the processing of her personal data for marketing purposes. In particular, she requested the information provided for in Article 15(1)(a) and (h) GDPR, and a copy of the personal data in possession of the controller.

The controller did not respond to the request. Therefore, the data subject appealed to the Tribunal of Bologna, requesting an order for the fulfilment of her right under Article 15 GDPR. She stated that the controller must (have) processed her personal data, since she had a 'loyalty card' from the controller and documentation relating to the purchase of a smart TV (receipt and financing contract).

Holding

The Court held that it was becoming increasingly crucial to protect people's rights when it comes to the processing of their personal data, especially from an economic standpoint. In doing so, it is necessary to remember that protecting people's fundamental rights cannot be sacrificed in favour of the interests of the market alone.

The Court recalled that the GDPR, although known as the Privacy Regulation, actually has a far wider scope of application that extends beyond and individual's right to privacy, which is historically linked to their most private sphere. While the liberal concept of privacy requires essentially refraining from something for its protection, the current conception of privacy has an interactive and dynamic nature. It particularly concerns personal data and their circulation. The right to data protection is the cornerstone of the (positive) freedom to fully control the flow of an individual's own data. It is distinct from the (negative) freedom not to be interfered with in an individual's own private sphere. This is also, and above all, in the logic of market regulation covered by the GDPR.

The Court added that it was sufficient to say that 'the Economist' described personal data as the new 'most valuable resource', i.e. the new oil.

The Court considered that the controller failed to act within the time limit, whereas the applicant had exercised her right correctly. Therefore, the Court held that, with reference to Article 12(1), (2), (3) and (4), and Article 15 GDPR, the data subject's right to access must be fulfilled by the controller. Consequently, the Court ordered the controller to provide the data subject with all the personal data, and documents relating to the data subject in possession.

Comment

The Court adopted a broad interpretation of the concept of a copy of the personal data undergoing processing, including all documentation related to processing (Trib. di Bologna: "Va conseguentemente stabilito il diritto della ricorrente di ottenere tutti i documenti alla stessa afferenti ... [...] Dichiara procedibile il presente ricorso, e accerta il diritto della parte istante ad ottenere l'accesso e la copia di tutti i dati ed i documenti detenuti dalla società resistente ed afferenti alla propria posizione e per l'effetto dispone che la società resistente, quale responsabile del trattamento, proceda alla consegna di tutti i dati ed i documenti in suo possesso afferenti alla parte Ricorrente.")

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

N. R.G. 12124/2020


COURT OF BOLOGNA
FIRST CIVIL SECTION


The Honorary Judge Dr Alessia Zucconi
noted that

by an appeal pursuant to Article 702 bis of the Code of Civil Procedure, Ms SEMSE complained of the failure to
holder Comet s.p.a.'s failure to reply to the exercise of the right of access
the data subject's right of access to her personal data.
The applicant states that she, in order to check her personal data
exercised on 06.08.2020 her right of access under Article 15 of Regulation
2016/679 against Comet S.p.A. (see doc. 2).
The applicant states that this check was necessary to verify the
lawfulness of the ongoing marketing processing of its personal data.
By exercising the right of access, the complainant requested in particular the
information provided for in Article 15(a) and (h) and a copy of the personal data in
possession of the other party (Art. 15(3) cited above: 'The data controller shall
provide a copy of the personal data undergoing processing').
The applicant states that the multinational company, however, has never replied nor has it ever
expressed its willingness to use the three-month extension made possible by Art.
15 of Regulation 2016/679, and did not provide the information relating to the
processing of personal data, pursuant to Article 15 para. 1, despite a specific
request to that effect.
The applicant submits that this right of access is a mandatory right
granted to the data subject whenever there is a processing of personal data (Art.
15 of Regulation 2016/679).
In the present case, in particular, the applicant indicates the existence of a
processing of personal data since Ms Qaum in possession of
a Comet loyalty card and from the documentation (receipt and
financing contract) relating to a purchase for a smart TV made


by Ms Maria Tabacco at Comet in Prato (see doc. 1 and doc. 6).


No one entered an appearance for the defendant COMET S.p.A.

held
that the dispute falls within the jurisdiction of the monocratic judge
that Article 702-bis of the Code of Civil Procedure presupposes - for the use of the summary procedure - that the
defences carried out by the parties do not require a 'non summary' instruction;
that the non-summary nature of the instruction must be assessed not so much by reference to
the subject-matter of the claim, but rather in relation to the evidence necessary for the
the decision, on the basis of the defences put forward by the parties. This assertion is
justified by the consideration that for the purposes of the procedure under consideration, cases must not
be divided between cases that are objectively complé IS simple, but between cases
in which the investigation may be complex and lengthy and other cases in which the investigation
can be conducted in a deformed and rapid manner. The difference between the
two types may depend on the nature of the litigation (which does not require factual
factual findings, or requires them to a limited extent), or, often, the positions taken by the
by the parties, since they determine the quantity and quality of
claims and exceptions (which supplement the thema decidendum) and,
above all, the amount of preliminary investigation required, through the contestations or
less of the facts alleged by the other party. Since in civil proceedings the
principle of availability of evidence, it is through the parties' defences that one can
increase or decrease the evidentiary burden of the case, in the present case, the case
case is predominantly documentary in nature

held
therefore to adhere to the prevailing orientation that "the non
of the inquiry must be assessed not so much with reference to the subject matter of the
application, but rather in relation to the evidence necessary for the decision
on the basis of the defences put forward by the parties' and pointed out that in the present case the
documentation produced by the appellant condominium and the
procedural behaviour of the resisting parties render irrelevant the taking of evidence
oral evidence and consequently allow the case to be decided on the basis of the
documents;

considering the merits

that each of us is affected on a daily basis by the processing of data
concerning him or her.


In particular, the protection of the rights of the individual with regard to the processing of data


is of ever-increasing importance, also in terms of economic
which the protection of the fundamental rights of the individual cannot, however, be
neglected in order to favour only the development needs of the market.

The right to protection of personal data is the subject of Regulation (EU) 2016/679 - better
known by its English acronym GDPR - and which repealed the so-called
mother 95/46/EC - which, in our system, was followed by Legislative Decree 10


August 2018, No. 101, which contains Provisions for the adaptation of the legislation


national legislation to the provisions of Regulation (EU) 201 6/ 679.

Please note that the GDPR, although known as the Privacy Regulation, actually has a
much broader scope that goes beyond the right to privacy,
historically linked to the most intimate sphere" of each individual. While privacy
privacy of the liberal type requires, for its protection, essentially
abstention, the more current conception of privacy has a participative and
dynamic nature: it particularly concerns personal data and their circulation. The
right to the protection of personal data is the basis of the (positive) freedom to have full
full control over the flow of one's own data, which is distinct from the (negative) freedom
of not being interfered with in one's private sphere: this also, and above all
in the logic of market regulation that concerns the Regulation.

Suffice it to say that the Economist has given an interpretation of the importance of
personal data, defining them as the new 'most valuable resource', i.e. the new oil.
oil.

That said, the applicant's request is well-founded for the following reasons
below.

The present case concerns an appeal for access to
to personal data through the special procedure which does not fall either
subject matter of mandatory mediation or negotiation.

Turning to the merits of the case, it should be noted that the respondent Sibe
represented.

It should be recalled that under Article 12 EU REG. cited above provides that: "The
data controller shall take appropriate measures to provide the data subject with all
the information referred to in Articles 13 and 14 and the communications referred to in Articles
15 to 22 and Article 34 relating to the processing in a concise, transparent,
intelligible and easily accessible, in plain and intelligible language, in


particularly in the case of information specifically intended for minors.


The information shall be provided in writing or by other means, including, where appropriate, by
electronic means. If requested by the person concerned, the information may be
provided that the identity of the person concerned can be proved by other means.
of the person concerned. 2. The controller shall facilitate the exercise of the rights
of the data subject pursuant to Articles 15 to 22. In the cases referred to in Article 11,
paragraph 2, the controller may not refuse to comply with the request
of the data subject in order to exercise his/her rights under Articles 15 to 22,
unless the data controller demonstrates that it is unable to identify
the data subject. 3. The controller shall provide the data subject with
information on the action taken in respect of a request pursuant to
Articles 15 to 22 without undue delay and, in any event, at the latest within one
one month from the receipt of the request. That period may be extended by
two months, if necessary, taking into account the complexity and number of the
requests. The data controller shall inform the data subject of such an extension,
and of the reasons for the delay, within one month of receipt of the request. If
the data subject makes the request by electronic means, the information shall be
provided, where possible, by electronic means, unless ' otherwise specified
the person concerned. 4. If the data subject's request is not complied with, the controller
shall inform the data subject without delay, and at the latest within one month from
receipt of the request, of the reasons for the non-compliance and of the possibility of
lodging a complaint with a supervisory authority and seeking a judicial remedy'.

Article 15 below provides that: "1. The data subject shall have the right to obtain from the
confirmation from the data controller as to whether or not personal data
of personal data concerning him/her and, if so, to obtain access to
to the personal data and to the following information: a) the purposes of the processing; b) the
categories of personal data concerned; c) the recipients or categories of recipients
to whom the personal data have been or will be disclosed, in particular if
recipients in third countries or international organisations; d) where possible, the
period for which the personal data are to be retained or, if that is not possible, the
criteria used to determine that period; e) the existence of the right
of the data subject to request from the controller the rectification or
erasure of personal data or restriction of the
processing of the personal data concerning him or her or to object to their processing;


(f) the right to lodge a complaint with a supervisory authority; (g) if the data do not


are collected from the data subject, all available information on their
origin; h) the existence of an automated decision-making process, including
profiling referred to in Article 22(1) and (4), and, at least in such
cases, meaningful information on the logic used, as well as the importance and the
expected consequences of such processing for the data subject. 2. Where
personal data are transferred to a third country or to an international organisation
international organisation, the data subject has the right to be informed of the existence of
adequate safeguards within the meaning of Article 46 relating to the transfer. 3. The controller
The controller shall provide a copy of the personal data undergoing processing. In case of
of further copies requested by the data subject, the controller may charge
charge a reasonable fee based on administrative costs. If
the data subject makes the request by electronic means, and unless the data subject indicates otherwise
otherwise specified by the data subject, the information shall be provided in an electronic format in common use.
commonly used. 4. The right to obtain a copy referred to in paragraph 3 shall not
infringe the rights and freedoms of others';
Therefore, in the light of the above provisions, considering
that the respondent has failed to act within the time limit whereas, on the contrary, the
applicant has correctly exercised its right, it must consequently be established
the right of the applicant to obtain all documents relating to it, and
receive all elements necessary for their processing by the
company.
therefore held
That the Judge has no need for further investigative enquiries since he has at his disposal
available to it every useful notion for reaching a decision and that it should therefore
the application made by the appellant be granted.
No order as to costs, given the special nature of the proceedings, the particular nature of the matter
matter and the respondent's failure to appear.
P.Q.M.
The Court of Bologna, Section I Civil
In the person of the Honorary Judge, Dr Alessia Zucconi
Having regard to Article 702 bis of the Code of Civil Procedure,


every other request, objection and deduction disregarded and/or absorbed,


giving final judgment on the claim brought by Ji
against COMET S.P.A., decides as follows:


Declares the present application admissible, and ascertains the right of the applicant to
obtain access to and a copy of all data and documents held by the respondent company and relating to its position, and
company and pertaining to its position, and accordingly orders the
company, in its capacity as data controller, to hand over all data and
data and documents in its possession relating to the applicant.
alt=.
Thus decided in Bologna on 30 July 2022

The Honorary Judge


Dr Alessia Zucconi


CS