Information and Data Protection Commissioner
Vs
COMPLAINT
Reference is made to the complaint (registered internally with file number CDP/IMI/LSA/17 / 2 0 1 9 )
received from the Polish Office for Personal Data Protection concerning ("the
complainant") who is alleging that ("the controller" or " ") breached her
1
data protection rights, as enshrined under the General Data Protection Regulation ("GDPR" or the
"Regulation"). The complainant contended that the controller did not comply with her right of access
request in terms of Article 1 5 of the GDPR within the established thirty (30) days' time frame.
From the information provided by the complainant, it transpires that she filed her right of access request
on the 3'd of October 2 0 1 8 and on the 5th February 2 0 1 9 , the date when she filed the complaint with the
Polish DP A, the controller did not yet provide her with a reply.
INVESTIGATION
As part of the investigation process, on the 26th of July 2 0 1 9 , through an email, the Commissioner
requested the controller to put forward their submissions on the allegation raised by the complainant.
The submissions, that were received through an email on the 9th of August 2 0 1 9 , contained a letter that
supposedly was sent to the complainant on the 4th of October 2 0 1 8 , the day after the complainant's
request was received by , together with the file containing the copy of her data. As this letter
was in the Polish language, the Commissioner kindly requested the controller to provide an English
translation.
On the 12th of August 2 0 1 9 , the Commissioner was informed, through an email, that while working on
the English translation, realised that neither the letter nor the file containing the personal data
was ever sent to the complainant, due to (verbatim) "a wrong use of the security classification settings
by the 's employee with access to the mailbox ( ) used to
correspond with the said customer [the complainant]". The security classification was set to be
1
Regulation ( E U ) 2016/679 on the protection of natural persons with regard to the processing of personal data
a n d o n the free movement of such data, a n d repealing Directive 95/46/EC ( G e n e r a l Data Protection Regulation)
Airways Hause, Second Floor \. 1+3561 2 3 2 8 7 1 0 0
H i g hStreet, Sliema SLM 1549 8 [email protected]
MALTA. e www.idpc.arg.mt
i d f;! C .
JtlRlRMATIOH A1lll D,\tolo
PROJ'ECTION COMMISSlDN�
"Internal only". This setting does not allow communications to be sent outside the organization's
network domain.
Following an internal investigation on this matter, the controller found out that (verbatim) "after
internal organizational changes the person in charge of this particular customer request left the
company without concluding the case and ensuring that a reply was properly sent to the customer. For
this reason, the file containing the list of personal data processed by [ has not reach the
customer, together with the usual letter sent to customer's following a Data Subject Access Request".
The same day the error on the email setting was discovered, meaning on the 12th August 2 0 1 9 , in order
to immediately address the incident, sent the complainant another email apologising for the
late reply, attaching a letter giving details about the processing of personal data, together with the
requested information in the form of a PDF file.
On the 1 3 t h of August, the Commissioner requested a copy of the above-mentioned email and attached
PDF file, as evidence that action has been taken in that regard. The copy was eventually received on
the 14th August 2 0 1 9 .
The controller was further requested, through an email dated 19th August 2 0 1 9 , to put forward further
submissions on the organizational and security measures implemented following this incident, to
prevent such a similar incident from occurring again. From this submission, received on the 23rd August
2019, it transpires that now has extended its backup continuity procedure to ensure that
customers' requests to exercise their rights under the GDPR are addressed promptly, (verbatim) "The
procedure is designed to ensure an adequate follow-up and mirroring of the tasks within the Customer
Service Unit. All the customer requests are now followed-up by two persons, one been the main contact
(principal) and a second person following the correspondence as a back-up, with the capability to
intervene when the principal is not capable of doing so. The principal is a senior Customer Service
Agent while the "back-up" is either a Senior Team Member or a senior customer service officer having
experience and knowledge on the various internal procedures regarding the types of requests received
at by the Customer Services team. In case the first contact is away, sick or unavailable, the back-up is
able to take over the tasks ifthese are notfinalized or achieved, thereby closing of the customer requests
without impacting the customer negatively. Controls and checks have been integrated within the process
in order to avoid such an incident from occurring again in the future".
DECISION
On the basis of the foregoing the Commissioner considers that did not have
adequate procedures in place to deal with subject access requests, resulting with the
complainant actually deprived of her right to access her data within the timeframe stipulated
within the Regulation. Consequently, the data controller is found to be in violation of Article:
15 of the GDPR.
After having taken into consideration:
the controller's degree of cooperation with this Office;
that the controller took immediate action to comply with the complainant's request as soon as
the error in the security settings of the mail box used to communicate with the complainant was
discovered;
that the controller has now in place a better procedure introducing measures to improve the
process to deal with the customers' requests to exercise their rights under the GDPR and to
keep within the legal timeframes;
and also giving due regard to the circumstances contemplated under Article 83.2 of the
GDPR and taking into account Article 83.1, is hereby being served with
an administrative fine of eight thousand euros (€ 8,000).
The administrative fine shall be paid to the Commissioner within twenty-five (25) days
from receipt of this decision.
In addition, is hereby being instructed to implement the appropriate technical
measures to further enhance the measures already in place.
A copy of this decision is also being sent to the Polish Office for Personal Data Protection.
Information and Data Protection Commissioner
Today, the day of October, 2 0 1 9