Right of access to data: the Italian Data Protection Authority fines company 70,000 euros for failure to respond fully.

The case

The case analyzed by the Italian DPA concerns an extremely general request made by an employee to his employer to access to his personal data: the request involves any type of personal data, processing and information whose content the employee was entitled to know under Article 15 of the GDPR.

Following the receipt of the access request, the employer had provided a merely interlocutory response ("we have taken charge of the request (...) to which we will respond within the timeframe provided for in Article 12 of the Regulation"), accompanied by a request addressed to the employee - unfulfilled - to compile and sign a predefined form, made available on the company's portal. According to the data controller, the filling out of said form was intended to facilitate the exercise of the rights, allowing the employee, who had made a generic request, to indicate precisely the information necessary for him.

In any case, in the view of the data controller, the generic nature of the request submitted by the employee and his failure to fill out the form were indications of a manifestly unfounded and excessive request, so that a response was deemed unnecessary by the data controller.

When the employee's complaint was submitted to the Italian DPA and the administrative proceedings were initiated, the company began to cooperate with the Italian DPA and provide effective feedback to the data subject, through:

• the sending of a considerable amount of documentation containing the personal data requested; and

• the reference to the general privacy notice provided to employees for the information on data processing requested by the complainant under Article 15 GDPR (i.e., purpose of processing, storage period).

The Italian DPA’s position

With reference to the request to complete the form, the Italian DPA clarified that "even if the predisposition of a form could, in general terms, constitute an organizational modality aimed at facilitating the data subjects’ requests, it would not be in compliance with the current personal data protection regulations to condition, on the prior sending of the aforementioned completed form, the start of the procedure preordained to undertake the exercise of the right without taking into consideration the requests presented in free form." Indeed, "the obligation to fill out a predefined form in addition to and independently of the specific application to exercise a right recognized by the system aggravates (instead of facilitating through the adoption of appropriate measures) the exercise of that right."

With regard to the subsequent response provided by the data controller to the data subject, the Italian DPA found that the considerable amount of paper documentation transmitted to the complainant had not been provided in a manner that facilitated his access to the information requested. In addition, the Italian DPA stated that, in any case, the information on data processing requested by the employee under Article 15 of the GDPR (i.e., the purposes of processing, the storage period, and the recipients to whom the data were disclosed) had not been provided with the response. In this regard, the Italian DPA has pointed out that "the right, granted to the data subject, to access the information provided for in Article 15 of the GDPR, cannot be considered fulfilled by the mere fact of having provided the information referred to in Articles 13 and 14 of the Regulation. (...) The right of access and the so-called right to information, although related, are, in fact, different rights, sanctioned by distinct provisions of the system, responding to needs of protection and guarantee of the data subject that are not completely overlapping."

In support of its position, the Italian DPA recalled the "Guidelines 01/2022 on data subject rights - Right of access" adopted on January 18, 2022, which state that “any information on the processing available to the controller may therefore have to be updated and tailored for the processing operations actually carried out with regard to the data subject making the request. Thus, referring to the wording of its privacy policy would not be a sufficient way for the controller to give information required by Art. 15(1)(a) to (h) and (2) unless the « tailored » information is the same as the « general » information”.

Conclusions

In the area of personal data protection, as stated by the Italian DPA, "the right of access is fundamental as it allows the data subject to exercise control over his/her personal data by placing him/herself also in a propaedeutic relationship with respect to possible further activities aimed at protecting his/her rights". For this reason, "the data subject's request for access does not provide for any limitation with regard to the information that can be accessed, so that it could be possible for the data subject to know the entire set of data processed by the data controller".

Whereas, from one hand, it is possible for the data subject to make such a broad request for access, on the other hand, the data controller, since it is obliged to facilitate the exercise of the data subject's right of access-regardless of the scope of the request-must provide up-to-date and tailored information to the processing operations actually carried out with respect to the data subject making the request. And this is also when, as in the case under analysis, the data controller processes a considerable amount of personal data, both with respect to the individual data subject exercising the right of access and, in general, with respect to the volume of data processed.

It is clear that big companies, such as the one sanctioned, need procedures to facilitate the exercise of the data subjects’ rights, including, above all, the right of access; however, such organizational measures cannot be considered adequate and compliant with privacy regulations if the data controller imposes them as essential conditions for the exercise of this right and if it is unable to guarantee, within the time limits provided by the law, an appropriate response to provide in a clear and transparent manner all the information requested by the data subject.

Article provided by INPLP member: Chiara Agostini (RP Legal & Tax, Italy)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)