Garante per la protezione dei dati personali (Italy) - 9827402

Garante per la protezione dei dati personali - 9827402

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 12 GDPR Article 13 GDPR Article 17 GDPR Article 18 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	06.10.2022
Fine:	10,000 EUR
Parties:	Garante per la protezione dei dati personali Codess Sociale, Soc. Coop. sociale
National Case Number/Name:	9827402
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante per la protezione dei dati personali (in IT)
Initial Contributor:	n/a

The Italian DPA imposed a €10,000 fine on Codess Sociale, Soc. Coop. company (the controller) for failure to respond to an erasure request pursuant to Article 12 GDPR in relation to Article 17 GDPR.

English Summary

Facts

On September 17 2020 a data subject resigned as a voluntary member from Codess Sociale, Soc. Coop. company (the controller) by means of a letter delivered to the headquarters. In this letter he asked the controller to delete his personal data from its physical and computer archives pursuant to Article 17 GDPR which provides for a right of erasure of personal data. The data subject received a registered letter from the controller on February 7 2021 in which it had acknowledged the resignation but did not response to the request to delete the personal data. On January 28 2021 the data subject lodged a complaint to the Italian DPA for unlawful processing of personal data by the controller. Upon invitation by the DPA to provide comments on the facts that were subject to complaints, the controller replied with reference to the preliminary declaring that it has provided the data subject with at time of recruitment with the information notice pursuant to Article 13 GDPR which specified that the collected data will be kept for a necessary period of time and in any case for a maximum of 120 months, even after resignation.

The DPA notified the initiation of the sanctioning procedure against the controller on July 19 2021 and on August 6 2021 the controller sent defense writings pursuant to Article 18 GDPR in which it declared that the notice of the resignation by the data subject did not meet the necessary formal requirements, was not addressed to those formally identified by the GDPR as it was transmitted by hand and was not formulated as a formal request to the data dontroller or the DPA to delete data on the basis of the exercise of a right.

Holding

First, the DPA held that the controller did not reply to the request for deletion of personal data made by the data subject on September 17 2020 within deadline provided in Article 12(3) GDPR. Article 12(3) GDPR provides for a reply “without undue delay and, in any case, no later than one month from receipt of the request”. Furthermore, it did not inform the data subject, within the same deadline, of the reasons for non-compliance and of the possibility of lodging a complaint with the authority pursuant to Article 12(4) GDPR.

Second, it noted that the complaint sent by the data subject was correctly received by the controller and that the data subject received feedback that all the documentation had been correctly transmitted to the office in charge. Therefore, the argument put forward by the controller cannot be taken as a valid reason to justify the controller’s failure to comply.

In this regard, the DPA held that statements made by the controller in the defense do not make it possible to overcome the findings notified by the DPA and are insufficient to allow proceedings to be dismissed.

Therefore, the DPA declared the complaint lodged by the data subject well-founded and the controller’s failure to respond to the cancellation request submitted by the data subject unlawful for breach of Article 12 GDPR in relation to Article 17 GDPR. Due to this violation the DPA imposed a penalty of 10,000 € on the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web no. 9827402]

Injunction against Codess Sociale, Soc. Coop. social - October 6, 2022

Register of measures
no. 322 of 6 October 2022

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by Prof. Pasquale Stanzione, president, prof.ssa Ginevra Cerrina Feroni, vice president, dr. Agostino Ghiglia and the lawyer Guido Scorza, components, and the cons. Fabio Mattei general secretary;

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation");

HAVING REGARD TO Legislative Decree 30 June 2003, n. 196 (Code regarding the protection of personal data, hereinafter the "Code") as amended by Legislative Decree 10 August 2018, n. 101 containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679";

CONSIDERING the complaint presented by Mr. XX on 28/01/2021, regularized on 05/03/2021, pursuant to art. 77 of the Regulations, with which the failure to respond to the request to exercise rights formulated against Codess Sociale, Soc. Coop. social;

HAVING REGARD TO the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation n. 1/2000;

SPEAKER Dr. Agostino Ghiglia;

WHEREAS

1. The initiation of proceedings.

With the complaint presented to this Authority on 01/28/2021, regularized on 03/05/2021, Mr. XX complained of unlawful processing of personal data by Codess Sociale, Soc. Coop. company (hereinafter "the Company"), consisting in the failure to respond to the request to exercise the rights, formulated by the same against the Company on 09/17/2020. In particular, the complainant represented that he had resigned as a voluntary member with a letter delivered to the headquarters of the RSA "XX" (facility where he had served), in which he simultaneously asked the Company to cancel his personal data, present in physical and computer archives. In response to the aforementioned request, the complainant received a registered letter from the Company on 07/01/2021, with which the same acknowledged the resignation as a voluntary member, but did not provide any response regarding the request for cancellation of personal data .

With the note of 03/18/2021 (prot. n. 14812), the Company was invited to provide observations regarding the facts subject to the complaint and to adhere to the request to exercise the rights, advanced by the complainant.

The Company provided a reply with the note dated 31/03/2021, preliminarily declaring that it had provided the complainant, during the hiring phase, with the information pursuant to art. 13 of the Regulation, in which it was specified that "the data collected will be kept for the period necessary to comply with the accounting/fiscal constraints, or of any other nature connected to the regulations in force and in any case for a maximum period of 120 months from when it should stop providing his volunteer activity. This taking into account that, even following resignation, it is not possible to proceed with the immediate cancellation of data from the shareholders' register or from "other supports of the Cooperative". In any case, the Company communicated that it had closed the Reserved Area on its website, to which the shareholder has access by entering his/her authentication credentials, and the cancellation of the name from the shareholders' register.

In the light of the above, the Office proceeded to notify the deed of initiation of the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code for violation of art. 12, par. 3 and 4, in relation to the art. 17 of the Regulation (prot. n. 38009 of 07/19/2021).

On 06/08/2021, the Company sent its own defensive writings, pursuant to art. 18 of the law n. 689/1981, with which he declared that:

- the communication of 09/17/2020, with which the complainant had resigned as a voluntary member, was delivered by hand to the headquarters of the RSA "XX" and addressed to the management contacts, the health director of the facility and other subjects ;

- this communication did not meet the minimum formal and substantial requirements to be understood as an "application for the exercise of rights" and implemented within the terms by the competent subjects;

- in particular, the communication would be flawed in form because "the recipients were not those formally identified by the GDPR (the data controller and/or the DPO); because the delivery did not take place to the institutional email but by hand and moreover in a peripheral operating unit (...); because the object of the communication did not consist in the request to exercise the rights";

- was also flawed in substance because "a real formal request was not even formulated to the Data Controller or to the DPO for data deletion based on the exercise of a right, but it was simply assumed and taken for granted by the writer a mandatory automatic deletion of your data (...) and communication within arbitrarily defined terms (...)".

2. The outcome of the investigation.

Following the examination of the documentation produced and the declarations made by the party during the proceedings, provided that, unless the fact constitutes a more serious offence, whoever, in a proceeding before the Guarantor, falsely declares or attests news or circumstances or produces false deeds or documents and is liable pursuant to art. 168 of the Code, it is ascertained that the Company has not provided a reply to the request for cancellation of personal data formulated by the complainant on 09/17/2020, within the deadline set by art. 12, par. 3 of the Regulation ("without unjustified delay and, in any case, at the latest within one month of receipt of the request"), nor did it proceed to inform the applicant, within the same term, of the reasons for the non-compliance as well as the possibility of propose a complaint to the Authority (Article 12, paragraph 4 of the Regulation).

In this regard, it should be noted that the communication sent by the complainant on 09/17/2020 with the subject "Resignation" and containing the request for cancellation of personal data, was correctly received by the Company which in fact replied to you by registered letter of 02/10/2020, in which "the Board of Directors took note of the withdrawal as a voluntary member, accepting his resignation". Among other things, it appears from the documentation in the documents, that the complainant has asked the owner to provide feedback and that he has received confirmation from the RSA that all the documentation had been correctly sent to the appropriate offices. Therefore, the argument put forward by the party on the basis of which no reply had been provided to the request for cancellation of the data as the communication had not been sent to the institutionally competent subjects cannot be assumed as a valid reason to justify the non-compliance by part of the data controller, having had full knowledge of the content of the aforementioned communication.

It should also be noted that, based on the provisions of art. 12 of the Regulation, the data controller "facilitates the exercise of the rights of the interested party pursuant to articles 15 to 22" and "provides the interested party with information relating to the action taken regarding a request pursuant to articles 15 to 22 without unjustified delay and, in any case, at the latest within one month of receipt of the request. This deadline may be extended by two months, if necessary, taking into account the complexity and number of requests".

The same article 12, par. 4 of the Regulation specifies that in the event that he does not comply with the requests to exercise the rights "the data controller informs the interested party without delay and at the latest within one month of receiving the request, of the reasons for the non-compliance and of the possibility of lodge a complaint with a supervisory authority and to lodge a judicial appeal".

In the light of the aforementioned regulatory framework, it has been ascertained that the Company did not provide a timely response to the request for data cancellation and that, only following the intervention of the Authority, did it proceed to inform the complainant of the reasons which made it impossible proceed with the deletion of the data. The conduct thus described is in contrast with the obligation to provide feedback "without unjustified delay" to the interested party and in any case within one month of receiving the request pursuant to art. 12 of the Regulation.

3. Conclusions: illegality of the treatments carried out. Corrective Actions.

In the light of the foregoing assessments, it should be noted that the statements made by the data controller in the defense writings ˗ for the truthfulness of which one may be called upon to answer pursuant to art. 168 of the Code ˗ do not allow the findings notified by the Office to be overcome with the act of initiating the procedure and are insufficient to allow it to be dismissed, since none of the cases envisaged by art. 11 of the Guarantor's regulation n. 1/2019, concerning the internal procedures of the Authority with external relevance.

Failure by the Company to respond to the cancellation request presented by the complainant is unlawful in the terms set out above, due to violation of art. 12 in relation to the art. 17 of the Regulation.

For the above reasons, therefore, the complaint presented pursuant to art. 77 of the Regulation and, in the exercise of the corrective powers attributed to the Authority pursuant to art. 58, par. 2 of the Regulation, the application of a pecuniary administrative sanction pursuant to art. 83, par. 5, of the Regulation.

4. Injunction order.

The Guarantor, pursuant to art. 58, par. 2, lit. i) of the Regulation and of the art. 166 of the Code, has the power to impose a pecuniary administrative sanction provided for by art. 83, par. 5, of the Regulation, through the adoption of an injunction order (art. 18. Law 24 November 1981 n. 689), in relation to the processing of personal data referring to the complainant, the illegality of which has been ascertained, within the terms exposed above.

With reference to the elements listed by art. 83, par. 2 of the Regulation for the purposes of applying the administrative fine and the related quantification, taking into account that the fine must be "in each individual case effective, proportionate and dissuasive" (art. 83, paragraph 1 of the Regulation), it is represented that, in the present case, the following circumstances were taken into consideration:

- with regard to the nature, gravity and duration of the violation, the nature of the violation was considered relevant, which concerned the provisions relating to the exercise of the rights of the interested parties; as well as the circumstance that the violation lasted for a long time;

- the absence of previous relevant violations committed by the data controller;

- the degree of cooperation provided by the Company during the proceedings;

- the social nature of the activity carried out by the party.

In consideration of the aforementioned principles of effectiveness, proportionality and dissuasiveness (Article 83, paragraph 1, of the Regulation) with which the Authority must comply in determining the amount of the sanction, the economic conditions of the offender were taken into consideration, determined based on the revenues achieved and referred to the financial statements for the year 2021.

Based on the aforementioned elements, evaluated as a whole, it is decided to determine the amount of the pecuniary sanction in the amount of 10,000.00 (ten thousand) euros for the violation of art. 12, in relation to the art. 17 of the Regulation.

In this context, also in consideration of the type of violation ascertained, which concerned the rights of the interested party, it is believed that, pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor's regulation n. 1/2019, this provision must be published on the Guarantor's website.

Finally, it should be noted that the conditions pursuant to art. 17 of regulation no. 1/2019 concerning internal procedures having external relevance, aimed at carrying out the tasks and exercising the powers delegated to the Guarantor.

ALL THAT BEING CONSIDERED, THE GUARANTOR

declares, pursuant to articles 57, par. 1, lit. f) and 83 of the Regulation, the unlawfulness of the processing carried out, in the terms referred to in the justification, for the violation of the art. 12, in relation to the art. 17 of the Regulation;

ORDER

to Codess Sociale, Soc. Coop. company in the person of its pro-tempore legal representative, with registered office in Padua, Via Boccaccio n. 96, P.I. 03174760276 pursuant to art. 58, par. 2, of the Regulation, to pay the sum of 10,000.00 (ten thousand) euros as an administrative fine for the violations indicated in the justification;

ENJOYS

to the same Company to pay the sum of Euro 10,000.00 (ten thousand) according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of adopting the consequent executive deeds pursuant to art. 27 of the law n. 689/1981. It is represented that pursuant to art. 166, paragraph 8 of the Code, without prejudice to the offender's right to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the fine imposed within the term referred to in art. 10, paragraph 3, of Legislative Decree lgs. no. 150 of 1 September 2011 envisaged for the filing of the appeal as indicated below.

HAS

pursuant to art. 166, paragraph 7, of the Code and of the art. 16, paragraph 1, of the Guarantor's regulation n. 1/2019, the publication of this provision on the Guarantor's website and believes that the conditions set forth in art. 17 of regulation no. 1/2019.

Pursuant to art. 78 of the Regulation, of the articles 152 of the Code and 10 of Legislative Decree 1 September 2011, n. 150, against this provision it is possible to lodge an appeal before the ordinary judicial authority, under penalty of inadmissibility, within thirty days from the date of communication of the provision itself or within sixty days if the appellant resides abroad.

Rome, 6 October 2022

PRESIDENT
station

THE SPEAKER
guille

THE SECRETARY GENERAL
Matthew