Trib. of Bologna - RG 12124/2020
|Trib. of Bologna - RG 12124/2020|
|Court:||Tribunal of Bologna (Italy)|
|Parties:||Data subject against COMET S.P.A.|
|National Case Number/Name:||RG 12124/2020|
|European Case Law Identifier:|
|Original Source:||archive.org (in Italian)|
|Initial Contributor:||andrea mereu|
The Tribunal of Bologna held that a copy of data as described in Article 15(3) GDPR was not limited to personal data, but also extended to documentation related to the processing (for example including documentation signed by the data subject, e.g. the release of privacy consents in the paper forms).
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject made an access request to Comet s.p.a., the controller, to verify the lawfulness of the processing of her personal data for marketing purposes. In particular, she requested the information provided for in Article 15(1)(a) and (h) GDPR, and a copy of the personal data in possession of the controller.
The controller did not respond to the request. Therefore, the data subject appealed to the Tribunal of Bologna, requesting an order for the fulfilment of her right under Article 15 GDPR. She stated that the controller must (have) processed her personal data, since she had a 'loyalty card' from the controller and documentation relating to the purchase of a smart TV (receipt and financing contract).
Holding[edit | edit source]
The Court held that it was becoming increasingly crucial to protect people's rights when it comes to the processing of their personal data, especially from an economic standpoint. In doing so, it is necessary to remember that protecting people's fundamental rights cannot be sacrificed in favour of the interests of the market alone.
The Court recalled that the GDPR, although known as the Privacy Regulation, actually has a far wider scope of application that extends beyond and individual's right to privacy, which is historically linked to their most private sphere. While the liberal concept of privacy requires essentially refraining from something for its protection, the current conception of privacy has an interactive and dynamic nature. It particularly concerns personal data and their circulation. The right to data protection is the cornerstone of the (positive) freedom to fully control the flow of an individual's own data. It is distinct from the (negative) freedom not to be interfered with in an individual's own private sphere. This is also, and above all, in the logic of market regulation covered by the GDPR.
The Court added that it was sufficient to say that 'the Economist' described personal data as the new 'most valuable resource', i.e. the new oil.
The Court considered that the controller failed to act within the time limit, whereas the applicant had exercised her right correctly. Therefore, the Court held that, with reference to Article 12(1), (2), (3) and (4), and Article 15 GDPR, the data subject's right to access must be fulfilled by the controller. Consequently, the Court ordered the controller to provide the data subject with all the personal data, and documents relating to the data subject in possession.
Comment[edit | edit source]
The Court adopted a broad interpretation of the concept of a copy of the personal data undergoing processing, including all documentation related to processing (Trib. di Bologna: "Va conseguentemente stabilito il diritto della ricorrente di ottenere tutti i documenti alla stessa afferenti ... [...] Dichiara procedibile il presente ricorso, e accerta il diritto della parte istante ad ottenere l'accesso e la copia di tutti i dati ed i documenti detenuti dalla società resistente ed afferenti alla propria posizione e per l'effetto dispone che la società resistente, quale responsabile del trattamento, proceda alla consegna di tutti i dati ed i documenti in suo possesso afferenti alla parte Ricorrente.")
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.
N. R.G. 12124/2020 COURT OF BOLOGNA FIRST CIVIL SECTION The Honorary Judge Dr Alessia Zucconi noted that by an appeal pursuant to Article 702 bis of the Code of Civil Procedure, Ms SEMSE complained of the failure to holder Comet s.p.a.'s failure to reply to the exercise of the right of access the data subject's right of access to her personal data. The applicant states that she, in order to check her personal data exercised on 06.08.2020 her right of access under Article 15 of Regulation 2016/679 against Comet S.p.A. (see doc. 2). The applicant states that this check was necessary to verify the lawfulness of the ongoing marketing processing of its personal data. By exercising the right of access, the complainant requested in particular the information provided for in Article 15(a) and (h) and a copy of the personal data in possession of the other party (Art. 15(3) cited above: 'The data controller shall provide a copy of the personal data undergoing processing'). The applicant states that the multinational company, however, has never replied nor has it ever expressed its willingness to use the three-month extension made possible by Art. 15 of Regulation 2016/679, and did not provide the information relating to the processing of personal data, pursuant to Article 15 para. 1, despite a specific request to that effect. The applicant submits that this right of access is a mandatory right granted to the data subject whenever there is a processing of personal data (Art. 15 of Regulation 2016/679). In the present case, in particular, the applicant indicates the existence of a processing of personal data since Ms Qaum in possession of a Comet loyalty card and from the documentation (receipt and financing contract) relating to a purchase for a smart TV made by Ms Maria Tabacco at Comet in Prato (see doc. 1 and doc. 6). No one entered an appearance for the defendant COMET S.p.A. held that the dispute falls within the jurisdiction of the monocratic judge that Article 702-bis of the Code of Civil Procedure presupposes - for the use of the summary procedure - that the defences carried out by the parties do not require a 'non summary' instruction; that the non-summary nature of the instruction must be assessed not so much by reference to the subject-matter of the claim, but rather in relation to the evidence necessary for the the decision, on the basis of the defences put forward by the parties. This assertion is justified by the consideration that for the purposes of the procedure under consideration, cases must not be divided between cases that are objectively complé IS simple, but between cases in which the investigation may be complex and lengthy and other cases in which the investigation can be conducted in a deformed and rapid manner. The difference between the two types may depend on the nature of the litigation (which does not require factual factual findings, or requires them to a limited extent), or, often, the positions taken by the by the parties, since they determine the quantity and quality of claims and exceptions (which supplement the thema decidendum) and, above all, the amount of preliminary investigation required, through the contestations or less of the facts alleged by the other party. Since in civil proceedings the principle of availability of evidence, it is through the parties' defences that one can increase or decrease the evidentiary burden of the case, in the present case, the case case is predominantly documentary in nature held therefore to adhere to the prevailing orientation that "the non of the inquiry must be assessed not so much with reference to the subject matter of the application, but rather in relation to the evidence necessary for the decision on the basis of the defences put forward by the parties' and pointed out that in the present case the documentation produced by the appellant condominium and the procedural behaviour of the resisting parties render irrelevant the taking of evidence oral evidence and consequently allow the case to be decided on the basis of the documents; considering the merits that each of us is affected on a daily basis by the processing of data concerning him or her. In particular, the protection of the rights of the individual with regard to the processing of data is of ever-increasing importance, also in terms of economic which the protection of the fundamental rights of the individual cannot, however, be neglected in order to favour only the development needs of the market. The right to protection of personal data is the subject of Regulation (EU) 2016/679 - better known by its English acronym GDPR - and which repealed the so-called mother 95/46/EC - which, in our system, was followed by Legislative Decree 10 August 2018, No. 101, which contains Provisions for the adaptation of the legislation national legislation to the provisions of Regulation (EU) 201 6/ 679. Please note that the GDPR, although known as the Privacy Regulation, actually has a much broader scope that goes beyond the right to privacy, historically linked to the most intimate sphere" of each individual. While privacy privacy of the liberal type requires, for its protection, essentially abstention, the more current conception of privacy has a participative and dynamic nature: it particularly concerns personal data and their circulation. The right to the protection of personal data is the basis of the (positive) freedom to have full full control over the flow of one's own data, which is distinct from the (negative) freedom of not being interfered with in one's private sphere: this also, and above all in the logic of market regulation that concerns the Regulation. Suffice it to say that the Economist has given an interpretation of the importance of personal data, defining them as the new 'most valuable resource', i.e. the new oil. oil. That said, the applicant's request is well-founded for the following reasons below. The present case concerns an appeal for access to to personal data through the special procedure which does not fall either subject matter of mandatory mediation or negotiation. Turning to the merits of the case, it should be noted that the respondent Sibe represented. It should be recalled that under Article 12 EU REG. cited above provides that: "The data controller shall take appropriate measures to provide the data subject with all the information referred to in Articles 13 and 14 and the communications referred to in Articles 15 to 22 and Article 34 relating to the processing in a concise, transparent, intelligible and easily accessible, in plain and intelligible language, in particularly in the case of information specifically intended for minors. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. If requested by the person concerned, the information may be provided that the identity of the person concerned can be proved by other means. of the person concerned. 2. The controller shall facilitate the exercise of the rights of the data subject pursuant to Articles 15 to 22. In the cases referred to in Article 11, paragraph 2, the controller may not refuse to comply with the request of the data subject in order to exercise his/her rights under Articles 15 to 22, unless the data controller demonstrates that it is unable to identify the data subject. 3. The controller shall provide the data subject with information on the action taken in respect of a request pursuant to Articles 15 to 22 without undue delay and, in any event, at the latest within one one month from the receipt of the request. That period may be extended by two months, if necessary, taking into account the complexity and number of the requests. The data controller shall inform the data subject of such an extension, and of the reasons for the delay, within one month of receipt of the request. If the data subject makes the request by electronic means, the information shall be provided, where possible, by electronic means, unless ' otherwise specified the person concerned. 4. If the data subject's request is not complied with, the controller shall inform the data subject without delay, and at the latest within one month from receipt of the request, of the reasons for the non-compliance and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy'. Article 15 below provides that: "1. The data subject shall have the right to obtain from the confirmation from the data controller as to whether or not personal data of personal data concerning him/her and, if so, to obtain access to to the personal data and to the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organisations; d) where possible, the period for which the personal data are to be retained or, if that is not possible, the criteria used to determine that period; e) the existence of the right of the data subject to request from the controller the rectification or erasure of personal data or restriction of the processing of the personal data concerning him or her or to object to their processing; (f) the right to lodge a complaint with a supervisory authority; (g) if the data do not are collected from the data subject, all available information on their origin; h) the existence of an automated decision-making process, including profiling referred to in Article 22(1) and (4), and, at least in such cases, meaningful information on the logic used, as well as the importance and the expected consequences of such processing for the data subject. 2. Where personal data are transferred to a third country or to an international organisation international organisation, the data subject has the right to be informed of the existence of adequate safeguards within the meaning of Article 46 relating to the transfer. 3. The controller The controller shall provide a copy of the personal data undergoing processing. In case of of further copies requested by the data subject, the controller may charge charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless the data subject indicates otherwise otherwise specified by the data subject, the information shall be provided in an electronic format in common use. commonly used. 4. The right to obtain a copy referred to in paragraph 3 shall not infringe the rights and freedoms of others'; Therefore, in the light of the above provisions, considering that the respondent has failed to act within the time limit whereas, on the contrary, the applicant has correctly exercised its right, it must consequently be established the right of the applicant to obtain all documents relating to it, and receive all elements necessary for their processing by the company. therefore held That the Judge has no need for further investigative enquiries since he has at his disposal available to it every useful notion for reaching a decision and that it should therefore the application made by the appellant be granted. No order as to costs, given the special nature of the proceedings, the particular nature of the matter matter and the respondent's failure to appear. P.Q.M. The Court of Bologna, Section I Civil In the person of the Honorary Judge, Dr Alessia Zucconi Having regard to Article 702 bis of the Code of Civil Procedure, every other request, objection and deduction disregarded and/or absorbed, giving final judgment on the claim brought by Ji against COMET S.P.A., decides as follows: Declares the present application admissible, and ascertains the right of the applicant to obtain access to and a copy of all data and documents held by the respondent company and relating to its position, and company and pertaining to its position, and accordingly orders the company, in its capacity as data controller, to hand over all data and data and documents in its possession relating to the applicant. alt=. Thus decided in Bologna on 30 July 2022 The Honorary Judge Dr Alessia Zucconi CS