Garante per la protezione dei dati personali (Italy) - 9960875

Garante per la protezione dei dati personali - 9960875

Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 12(3) GDPR Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	16.11.2023
Published:
Fine:	40,000 EUR
Parties:	Amazon Italia Transport s.r.l.
National Case Number/Name:	9960875
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Italian
Original Source:	Garante per la Protezione dei Dati Personali (in IT)
Initial Contributor:	ar

The Italian DPA fined Amazon Italia Transport s.r.l. €40,000 for failing to comply with the access request of the complainant within the time limit set by Article 12(3) GDPR.

English Summary

Facts

A data subject brought a complaint to the Italian DPA against Amazon Italia Transport s.r.l. (the controller). The complainant claimed that the controller, his former employer, did not provide a reply to his access request within the time limits laid down by Article 12(3) GDPR.

Thus, on 26 January 2022, the DPA requested the controller to submit its observations on the matter.

On 4 February 2022, the controller provided that because the complainant’s request was broad and generic, internal coordination between the various departments concerned was needed, which did not allow it to comply with the request within the time limits set by Article 12 GDPR. The personal data requested by the complainant and further information relating to the processing of the personal data were then provided by the controller.

On the basis of the declarations made by the controller, the DPA notified it on 21 March 2022 of the initiation of the sanctioning procedure under Article 166(5) of the Italian Privacy Code in relation to the alleged breaches of Article 12(3) GDPR and Article 15 GDPR.

Holding

In light of the information provided by the controller, the DPA noted that the controller responded to the complainant’s access request under Article 15 GDPR almost six months after the deadline set by the GDPR and only after the filing of the complaint and the opening of the enquiry by the DPA. The DPA also acknowledged that the controller declared to not have responded to the request in a timely manner due to the vastness and generality of the information requested by the complainant. Request that made it impossible for the controller to provide a more detailed response. However, referring to the EDPB Guidelines 01/2022, the DPA reiterated that a controller who processes a large amount of information relating to the data subject may ask the data subject to specify the information to which the request relates, as also provided in Recital 63 GDPR. Not only did the controller fail to request specifications, but it also did not inform the complainant of the reasons for the delay, thereby failing to comply with Article 12(3) GDPR.

Therefore, the DPA ruled that because the processing carried out by the controller breached Article 12 GDPR and Article 15 GDPR. Since the infringement could not be considered 'minor' taking into account its nature, seriousness and duration, the DPA fined the controller €40,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

SEE Newsletter of 15 December 2023

[doc. web no. 9960875]

Provision of 16 November 2023

Register of measures
n. 530 of 16 November 2023

THE GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

IN today's meeting, which was attended by prof. Pasquale Stanzione, president, Prof. Ginevra Cerrina Feroni, vice-president, Dr. Agostino Ghiglia and the lawyer. Guido Scorza, members and Dr. Claudio Filippi, deputy general secretary;

HAVING REGARD to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “Regulation”);

HAVING REGARD to the Code regarding the protection of personal data, containing provisions for the adaptation of national legislation to Regulation (EU) 2016/679 (Legislative Decree 30 June 2003, no. 196, as amended by Legislative Decree 10 August 2018, no. 101, hereinafter “Code”);

GIVEN the complaint presented by Mr. XX, through its lawyer Avv. XX, dated 01/12/2021, pursuant to art. 77 of the Regulation with which a violation of the regulations regarding the protection of personal data by Amazon Italia Transport s.r.l. was complained;

EXAMINED the documentation in the documents;

GIVEN the observations made by the general secretary pursuant to art. 15 of the Guarantor's regulation no. 1/2000;

SPEAKER prof. Pasquale Stanzione;

PREMISE

1. The complaint against the Company and the start of the preliminary investigation.

With the complaint presented on 01/12/2021, Mr. XX represented to this Authority that it had presented a request to exercise the rights pursuant to art. 15 of the Regulation, against Amazon Italia Transport s.r.l. (hereinafter "the Company"), of which he was an employee from 01/01/2018 to 04/06/2021. This request, aimed at knowing and obtaining a "copy of the personal data being processed and the information referred to in the aforementioned art. 15 (...)", was duly notified on 09/28/2021 via certified e-mail to the Company's address, as shown in the delivery receipt produced in the documents, but the Company did not provide any feedback within the terms established by the art. 12, par. 3, of the aforementioned Regulation.

With the note dated 01/26/2022, the Authority invited the Company to provide observations regarding the complaint and to comply with the complainant's requests.

With the communication dated 02/04/2022, the Company provided feedback immediately, and for information to the Authority, representing that:

- “since the request received was very broad and generic, concerning, in fact, all the processing of Mr.'s data. operated by Amazon, internal coordination between the various departments involved was necessary. This resulted in a slowness that did not allow Amazon to follow up on the request within the deadlines established by the art. 12 GDPR”;

- “In the context of the employment relationship with one's staff and therefore also with reference to the existing employment relationship (...) with Mr. , Amazon processes data in accordance with its EU privacy policy for Amazon employees, which is available to employees at all times on the company's intranet."

The complainant's personal data, extracted from his personal file, and further information relating to the processing of personal data subject to the specific request were therefore provided.

Based on the declarations made by the company, the Office notified the Company, with note dated 03/21/2022, prot. n. 16328, the act of initiation of the sanctioning procedure pursuant to art. 166, paragraph 5, of the Code in relation to the violation of articles. 12, par. 3 and 15 of the Regulation.

The Company sent its defense writings on 04/20/2022, pursuant to art. 18 of law no. 689/1981, with which he underlined his good faith in the treatment in question, since the "delay is not at all due to the desire to harm Mr., or to prevent him from the legitimate exercise of his rights, but rather to a series of unfortunate circumstances (…)”.

In particular, it was represented that:

- the violation in question is not malicious in nature, as it was caused by "a substantial internal difficulty in dealing with the significant and constantly increasing quantity of requests for access to data pursuant to art. 15 of the Regulation not only by employees, but also by former employees. In most cases, these requests are accompanied - as in the present case - by the ex-employee's appeal against the dismissal. This circumstance involves a necessary coordination between the various internal offices and departments, in order to reconstruct what happened from time to time and evaluate the existence of any exemptions pursuant to the art. 23 of the Regulation, as implemented by art. 2-undecies of the Code (…);

- in this case, "the Company necessarily had to evaluate any repercussions in relation to its right of defense deriving from the satisfaction of the Request, given the specific circumstances of the dismissal and its challenge by the interested party. Unfortunately, this evaluation was not carried out efficiently by the competent functions and this led to Amazon's delay in responding to the Request within the deadlines established by law";

- “Following the episode in question, Amazon, aware of the error and the need to improve its internal organization in order to respond in the most effective and proactive manner to access requests, is preparing a single function at central level for the management of requests pursuant to art. 15 of the HR Regulation (employees and former employees). This procedure involves an initial screening of the request, followed by its treatment in a synergistic manner, involving both the central privacy function and the local HR functions. This will ensure better interdepartmental collaboration, ensuring that events of this type do not happen again in the future and consolidating the privacy by design and by default approach already adopted by the Company."

2. The outcome of the investigation and the procedure for the adoption of corrective and sanctioning measures.

Upon examination of the declarations made to the Authority during the procedure as well as the documentation acquired, it appears that the Company, as data controller, has carried out some processing operations, referring to the complainant, which are not compliant with the regulations regarding the protection of personal data.

In this regard, it is highlighted that, unless the fact constitutes a more serious crime, anyone who, in proceedings before the Guarantor, falsely declares or certifies information or circumstances or produces false deeds or documents is liable pursuant to art. 168 of the Code "False statements to the Guarantor and interruption of the execution of the tasks or exercise of the powers of the Guarantor".

On the merits, it emerged that the Company did not respond to the request to exercise the rights presented by the complainant pursuant to art. 15 of the Regulation, if not by 04/02/2022 and only following the presentation of the complaint and the opening of the investigation by the Guarantor, sending him a copy of the personal data and information relating to the employment relationship with the party . Compliance therefore occurred almost six months after the deadline set by the Regulation.

It should also be noted that the Company, during the investigation, declared that it had not responded promptly to the aforementioned request, also due to the vastness and generic nature of the information requested which prevented the response from being substantiated.

It is noted, in this regard, that the Guidelines on the right of access, approved by the EDPB on 03/28/2023, clarify that "a data controller who processes a large amount of information relating to the interested party may ask the interested party to specify the information or processing to which the request refers before the information is provided” (par. 2.3.1) in accordance with what is also established in recital 63 of the Regulation.

Therefore, given the declared difficulty in processing the request to exercise the rights within the terms established by the legislation, the Company did not make use of the right recognized by the Regulation to address the appropriate specifications to the interested party.

Nor did it inform the applicant of the reasons for the delay, thus failing to comply with the provision of the art. 12, par. 3 of the Regulation where it establishes that "this deadline [thirty days from receipt of the request] can be extended by two months, if necessary, taking into account the complexity and number of requests. The data controller shall inform the interested party of this extension and of the reasons for the delay, within one month of receiving the request".

3. Conclusions: declaration of unlawfulness of the processing. Corrective measures pursuant to art. 58, par. 2, of the Regulation.

For the above reasons, the Authority believes that the declarations, documentation and reconstructions provided by the data controller during the investigation do not make it possible to overcome the findings notified by the Office with the initiation of the procedure and which are therefore unsuitable to allow the dismissal of this proceeding, as none of the cases provided for in the art. 11 of the Guarantor Regulation n. 1/2019.

The processing carried out by the company, with reference to the failure to respond to the access request presented by the complainant, is in fact illicit, in the terms set out above, in relation to the articles. 12 and 15 of the Regulation.

Therefore, given the corrective powers attributed by art. 58, par. 2 of the Regulation provides for the application of a pecuniary administrative sanction pursuant to art. 83 of the Regulation, commensurate with the circumstances of the specific case (art. 58, par. 2, letter i) Regulation).

4. Adoption of the injunction order for the application of the pecuniary administrative sanction and accessory sanctions (articles 58, par. 2, letter i), and 83 of the Regulation; art. 166, paragraph 7, of the Code).

The Guarantor, pursuant to art. 58, par. 2, letter. i) of the Regulation and of the art. 166 of the Code, has the power to inflict a pecuniary administrative sanction provided for by art. 83, par. 5 of the Regulation, through the adoption of an injunction order (art. 18 of law 24 November 1981 n. 689).

The violation, ascertained within the terms set out in the justification, cannot be considered "minor", taking into account the nature, severity and duration of the violation itself, the degree of responsibility and the way in which the supervisory authority became aware of of the violation (cons. 148 of the Regulation).

With reference to the elements listed in the art. 83, par. 2, of the Regulation for the purposes of the application of the pecuniary administrative sanction and the related quantification, taking into account that the sanction must "in any case [be] effective, proportionate and dissuasive" (art. 83, par. 1 of the Regulation), it is represented that, in this case, the following circumstances were considered:

- in relation to the nature, gravity and duration of the violation, the nature of the violation which concerned the exercise of the rights of the interested party and the delay in the response to the exercise of the rights were considered relevant;

- with reference to the negligent or malicious nature of the violation and the degree of responsibility of the owner, account was taken of the conduct of the Company which promptly adapted to the indications given during the proceedings as well as the circumstance that the violation concerned only one interested party ;

- the cooperation provided during the investigation and the adjustments made with a view to privacy by design and by default.

It is also believed that they assume relevance in the specific case, taking into account the aforementioned principles of effectiveness, proportionality and dissuasiveness which the Authority must comply with in determining the amount of the sanction (art. 83, par. 1, of the Regulation), in firstly, the economic conditions of the offender, determined on the basis of the revenues achieved by the Company with reference to the ordinary financial statements for the year 2022. Lastly, the extent of the sanctions imposed in similar cases is taken into account.

In light of the elements indicated above and the assessments carried out, it is believed, in this case, to apply against Amazon Italia Transport s.r.l., the administrative sanction of the payment of a sum equal to 40,000.00 (forty thousand) euros.

In this context, it is also believed, in consideration of the type of violations ascertained which concerned the exercise of the rights of the interested party, that pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Guarantor's Regulation no. 1/2019, this provision must be published on the Guarantor's website.

It is also believed that the conditions set out in art. 17 of Regulation no. 1/2019.

ALL THE WHEREAS, THE GUARANTOR

notes the unlawfulness of the processing carried out by Amazon Italia Transport s.r.l., in the person of the legal representative pro tempore, with registered office in Viale Monte Grappa 3/5 - 20124 Milan (MI), C.F. 09598330968, pursuant to art. 143 of the Code, for the violation of articles. 12 and 15 of the Regulation;

ORDER

pursuant to art. 58, par. 2, letter. i), of the Regulation, to Amazon Italia Transport s.r.l., to pay the sum of 40,000.00 (forty thousand) euros as a pecuniary administrative sanction for the violations indicated in this provision;

ORDERS

therefore to the same Company to pay the aforementioned sum of 40,000.00 (forty thousand) euros according to the methods indicated in the attachment, within 30 days of notification of this provision, under penalty of the adoption of the consequent executive acts pursuant to the art. 27 of law no. 689/1981. Please note that the violator remains entitled to settle the dispute by paying - always according to the methods indicated in the attachment - an amount equal to half of the sanction imposed, within the deadline set out in the art. 10, paragraph 3, of the legislative decree. lgs. n. 150 of 1.9.2011 provided for the filing of the appeal as indicated below (art. 166, paragraph 8, of the Code);

HAS

the publication of this provision on the Guarantor's website pursuant to art. 166, paragraph 7, of the Code and art. 16, paragraph 1, of the Guarantor's Regulation no. 1/2019, and believes that the conditions set out in the art. 17 of Regulation no. 1/2019.

Pursuant to art. 78 of the Regulation, as well as articles 152 of the Code and 10 of Legislative Decree no. 150/2011, opposition to this provision may be lodged with the ordinary judicial authority, with an appeal filed with the ordinary court of the place identified in the same art. 10, within thirty days from the date of communication of the provision itself, or sixty days if the appellant resides abroad.

Rome, 16 November 2023

PRESIDENT
Stanzione

THE SPEAKER
Stanzione

THE DEPUTY SECRETARY GENERAL
Philippi