Commissioner (Cyprus) - 11.17.001.010.172: Difference between revisions

Revision as of 13:48, 31 January 2024

Commissioner - 11.17.001.010.172

Authority:	Commissioner (Cyprus)
Jurisdiction:	Cyprus
Relevant Law:	Article 12(3) GDPR Article 56 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	23.10.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	11.17.001.010.172
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	English
Original Source:	11.17.001.010.172 (in EN)
Initial Contributor:	sh

The Cypriot DPA reprimanded the operator of a website for failing to comply with an access request in a timely manner under Article 12(3) GDPR.

English Summary

Facts

A complaint was lodged with the Maltese DPA against Brivio Limited (the controller) for a failure to respond to an access request under Article 15 GDPR.

The data subject was a registered user on the online casino “icecasino.com” and contacted the controller, who is the operator of the website via email. The data subject requested his information regarding all personal data concerning him, payments made and casino games that he had participated in on the website under Article 15 GDPR. Allegedly the controller never responded, which led to the submission of his complaint after the expiry of the one month period to reply under Article 12(3) and (4) of the GDPR.

The controller is registered in Cyprus. The complaint was therefore transferred to the Cypriot DPA under Article 56 GDPR with the Cypriot DPA acting as the Lead Supervisory Authority (LSA).

Holding

The Cypriot DPA found a violation of Article 12(3) GDPR due to the delayed response to the access request.

First, the DPA considered mitigating factors such as eventual compliance, corrective measures, and cooperation from the controller. The controller had failed to comply with the request because the the customer support team who received the request, failed to inform the data protection team. After the complaint was submitted the controller reached out to the data subject and fulfilled the request. The controller internally reviewed their internal procedure and a new technical flow was adopted in order to facilitate the cooperation between the customer support team and the data protection team. Extra training for staff had also been carried out. This was considered favouribly by the DPA.

The DPA considered that the request could have been satisfied from the first instance if the appropriate organisational and technical measures were in place and the staff was properly trained in dealing with GDPR requests in a timely manner. Moreover. the controller’s data protection team only became aware of the access request after being notified of the complaint by the Cypriot DPA.

Last, the DPA considered aggravating factors. This was not the controllers first offence and that there already existed a previous similar violation by the controller.

Nevertheless, the Cypriot DPA only issued a reprimand to Brivio Limited. The company was reminded of its obligations under Article 12(3) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

@@ Line 68: / Line 68: @@
 A complaint was lodged with the Maltese DPA against Brivio Limited (the controller) for a failure to respond to an access request under [[Article 15 GDPR|Article 15 GDPR]].
-The data subject was a registered user on the online casino “icecasino.com”
+The data subject was a registered user on the online casino “icecasino.com” and contacted the controller, who is the operator of the website via email. The data subject requested his information regarding all personal data concerning him, payments made  and casino games that he had participated in on the website under [[Article 15 GDPR]]. Allegedly the controller never responded, which led to the submission of his complaint after the expiry of the one month period to reply under [[Article 12 GDPR|Article 12(3]]) and [[Article 12 GDPR|(4]]) of the GDPR.
-and contacted the controller, who is the operator of the website via email. He requested his information regarding all personal data concerning him, payments made  and casino games that he had participated in on the website under [[Article 15 GDPR]]. Allegedly the controller never responded which led to the submission of his complaint after the expiry of the one month period to reply under [[Article 12 GDPR|Article 12(3]]) and [[Article 12 GDPR|(4]]) of the GDPR.
 The controller is registered in Cyprus. The complaint was therefore transferred to the Cypriot DPA under [[Article 56 GDPR|Article 56 GDPR]] with the Cypriot DPA acting as the Lead Supervisory Authority (LSA).
@@ Line 76: / Line 75: @@
 The Cypriot DPA found a violation of [[Article 12 GDPR|Article 12(3) GDPR]] due to the delayed response to the access request.
-First, the DPA considered mitigating factors such as eventual compliance, corrective measures, and cooperation from the controller. The controller had failed to comply with the request because the the customer support team who received the request, failed to inform the data protection team. After the complaint was submitted the controller reached out to the data subject and fulfilled the request. They internally reviewed their internal procedure and a new technical flow was adopted in order to facilitate the cooperation between the customer support team and the data protection team. Extra training for staff had also been carried out. This was considered favouribly by the DPA.
+First, the DPA considered mitigating factors such as eventual compliance, corrective measures, and cooperation from the controller. The controller had failed to comply with the request because the the customer support team who received the request, failed to inform the data protection team. After the complaint was submitted the controller reached out to the data subject and fulfilled the request. The controller internally reviewed their internal procedure and a new technical flow was adopted in order to facilitate the cooperation between the customer support team and the data protection team. Extra training for staff had also been carried out. This was considered favouribly by the DPA.
-Second, the DPA considered that the request could have been satisfied from the first instance if the appropriate organisational and technical measures were in place and the staff was properly trained in dealing with GDPR requests in a timely manner. Moreover. the controller’s data protection team only became aware of the access request after being notified of the complaint by the Cypriot DPA.
+The DPA considered that the request could have been satisfied from the first instance if the appropriate organisational and technical measures were in place and the staff was properly trained in dealing with GDPR requests in a timely manner. Moreover. the controller’s data protection team only became aware of the access request after being notified of the complaint by the Cypriot DPA.
 Last, the DPA considered aggravating factors. This was not the controllers first offence and that there already existed a previous similar violation by the controller.
-For these reasons the Cypriot DPA issued a reprimand to Brivio Limited. The company was reminded of its obligations under [[Article 12 GDPR|Article 12(3) GDPR.]]
+Nevertheless, the Cypriot DPA only issued a reprimand to Brivio Limited. The company was reminded of its obligations under [[Article 12 GDPR|Article 12(3) GDPR.]]
 == Comment ==