Garante per la protezione dei dati personali (Italy) - 9936247
| Garante per la protezione dei dati personali - 9936247 | |
|---|---|
 | |
| Authority: | Garante per la protezione dei dati personali (Italy) |
| Jurisdiction: | Italy |
| Relevant Law: | Article 17(1) GDPR Article 58(2)(b) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 31.08.2023 |
| Published: | 09.10.2023 |
| Fine: | n/a |
| Parties: | Associazione ContiamoCI! ETS |
| National Case Number/Name: | 9936247 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Italian |
| Original Source: | Garante per la protezione dei dati personali (Italy) (in IT) |
| Initial Contributor: | ar |
The Italian DPA issued a reprimand under Article 58(2)(b) GDPR to the controller, an association for medical personnel. The controller was found to have breached Article 17(1) GDPR as it continued to process the data of the complainant and renewed his membership - despite the complainant’s request to delete his personal data.
English Summary
Facts
On 28 October 2021, the complainant requested the controller, an association for medical personnel, to delete his personal data and on 13 January 2022, the controller confirmed the deletion. However, on 9 August 2022, the complainant received an email from the controller regarding information on the expiry of his membership, which was followed by the automatic renewal thereof. Thus, on 15 December 2022, the complainant filed a complaint with the Italian DPA, who, on 20 February 2023, requested the controller to provide feedback on the matter.
The controller replied to the DPA to have deleted the data of the complainant on 25 February 2023.
Hence, on 14 March 2023, the DPA informed the controller of the commencement of the proceedings due to the breach of Article 17(1) GDPR and invited the controller to provide its justifications.
The controller presented a defence submission in which it explained that when the complainant submitted his deletion request, the association had started only a few months prior. It further elaborated that the company operates through the support of voluntary staff for all the tasks it has to perform, such as the management of databases, funding and requests to exercise rights under the GDPR. In this case, the volunteer in charge communicated internally that he had deleted the complainant’s data. However, simultaneously, the controller decided to renew the membership for the following year, free of charge for all members, active and inactive. Thus, by automatically renewing all members free of charge, the complainant’s unfulfilled request was missed by the controller. However, if the complainant had informed the controller of the mistake following the email of 9 August 2022 instead of bringing a complaint to the DPA in December, the controller would have recognized its error and corrected it immediately.
Holding
Upon review of the controller’s statements, the Italian DPA acknowledged that the controller continued to process the data of the complainant and renewed his membership to the association despite having declared to the complainant, in response to his specific request, that it had cancelled his personal data. Therefore, it ascertained that despite the request made by the complainant and the absence of reasons for refusing it, the controller did not delete the personal data in breach of Article 17(1) GDPR and did so only following the intervention of the DPA.
However, considering the defence submission and the circumstances of the controller during which the breach took place, the cooperation of the controller with the DPA during the proceedings and the absence of previous breaches, the DPA deemed this case a ‘minor breach’ under Article 83(2) GDPR. Hence, the DPA decided that it was sufficient in the situation at hand to simply issue a reprimand to the controller pursuant to Article 58(2)(b) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
