Garante per la protezione dei dati personali (Italy) - 9936247

From GDPRhub
Revision as of 14:20, 31 October 2023 by Aa (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Garante per la protezione dei dati personali - 9936247
LogoIT.png
Authority: Garante per la protezione dei dati personali (Italy)
Jurisdiction: Italy
Relevant Law: Article 17(1) GDPR
Article 58(2)(b) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 31.08.2023
Published: 09.10.2023
Fine: n/a
Parties: Associazione ContiamoCI! ETS
National Case Number/Name: 9936247
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Italian
Original Source: Garante per la protezione dei dati personali (Italy) (in IT)
Initial Contributor: ar

The Italian DPA issued a reprimand under Article 58(2)(b) GDPR to the controller, an association for medical personnel. The controller was found to have breached Article 17(1) GDPR as it continued to process the data of the complainant and renewed his membership - despite the complainant’s request to delete his personal data.

English Summary

Facts

On 28 October 2021, the complainant requested the controller, an association for medical personnel, to delete his personal data and on 13 January 2022, the controller confirmed the deletion. However, on 9 August 2022, the complainant received an email from the controller regarding information on the expiry of his membership, which was followed by the automatic renewal thereof. Thus, on 15 December 2022, the complainant filed a complaint with the Italian DPA, who, on 20 February 2023, requested the controller to provide feedback on the matter.

The controller replied to the DPA to have deleted the data of the complainant on 25 February 2023.

Hence, on 14 March 2023, the DPA informed the controller of the commencement of the proceedings due to the breach of Article 17(1) GDPR and invited the controller to provide its justifications.

The controller presented a defence submission in which it explained that when the complainant submitted his deletion request, the association had started only a few months prior. It further elaborated that the company operates through the support of voluntary staff for all the tasks it has to perform, such as the management of databases, funding and requests to exercise rights under the GDPR. In this case, the volunteer in charge communicated internally that he had deleted the complainant’s data. However, simultaneously, the controller decided to renew the membership for the following year, free of charge for all members, active and inactive. Thus, by automatically renewing all members free of charge, the complainant’s unfulfilled request was missed by the controller. However, if the complainant had informed the controller of the mistake following the email of 9 August 2022 instead of bringing a complaint to the DPA in December, the controller would have recognized its error and corrected it immediately.

Holding

Upon review of the controller’s statements, the Italian DPA acknowledged that the controller continued to process the data of the complainant and renewed his membership to the association despite having declared to the complainant, in response to his specific request, that it had cancelled his personal data. Therefore, it ascertained that despite the request made by the complainant and the absence of reasons for refusing it, the controller did not delete the personal data in breach of Article 17(1) GDPR and did so only following the intervention of the DPA.

However, considering the defence submission and the circumstances of the controller during which the breach took place, the cooperation of the controller with the DPA during the proceedings and the absence of previous breaches, the DPA deemed this case a ‘minor breach’ under Article 83(2) GDPR. Hence, the DPA decided that it was sufficient in the situation at hand to simply issue a reprimand to the controller pursuant to Article 58(2)(b) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.