Taking account of the Article 60 Draft Decision procedure that was opened by the Garante
in the EDPB information system pursuant to the cooperation and consistency principles set
out in Article 60 of the Regulation;
Taking account of the relevant and reasoned objections submitted pursuant to Article 60(4)
of the Regulation by the Austrian supervisory authority, which found that
should have provided the data subject only with the personal data relating to the latter as
contained in the documents held by the company (i.e., transcripts of phone conversations,
internal case notes) without making available copies of the said documents;
Having regard to the Revised Draft Decision approved by the Garante’s Board of
Commissioners at the meeting held on 16 September 2021, whereby the Garante followed
the relevant and reasoned objection raised by the Austrian supervisory authority;
Having regard to the Article 60 Revised Draft Decision procedure that was opened by the
Garante in the EDPB information system pursuant to the cooperation and consistency
principles set out in Article 60 of the Regulation;
Taking account that none of the supervisory authorities concerned raised additional
objections to the revised draft decision under the terms of Article 60(6) of the Regulation;
Having considered the records on file;
Having regard to the considerations made by the Secretary General pursuant to Section 15
of the Garante’s Rules of Procedure No 1/2000;
Acting on the report submitted by Prof.
WHEREAS
1. Description of the complaint
The complainant is an English national. He lodged a complaint with the UK Information
Commissioner’s Office (ICO) where he alleged that he had requested , on 28
May 2018, to send him both the transcripts of the phone conversations between him and the
customer support centre operated by (hereinafter )
and the documents (so-called ‘case notes’) relating to the specific incident – as he had turned
to following a malfunctioning of his vehicle. Further to the said request, had
reportedly stated they were not in a position to grant the requests on account of unspecified
Italian privacy rules and anyhow would not be able to reply until the ticket opened in
connection with the malfunctioning of the vehicle was closed.
2. The investigations by the Garante
The Garante accepted it was the lead supervisory authority in the procedure at issue since
the controller has its main establishment in Italy.
2
Further to the above complaint, the Garante requested the controller ( ), with
registered office in , to submit their views as to the processing of the
complainant’s personal data.
By way of a letter dated 17 April 2019, sent the information the Garante had
requested and declared the following: as part of the relevant call management policy,
only records inbound calls and only for training and quality monitoring purposes (this being
the so-called first-level help desk); calls are subsequently transferred to another operator
dealing with the specific subject matter (this being the so-called second-level help desk) and
are not recorded further – which also applies to outbound calls. In these cases, the operator
takes ‘notes’ relating to the conversations with customers. As for the complainant’s request
to obtain the recordings of second-level calls, declared the request could not be granted
since such calls are handled by the help desk and are not recorded.
As for the request to obtain copies of the ‘case notes’ relating to the calls in question,
declared that such notes had not been provided to the data subject since they were
considered ‘internal confidential documents’ that were helpful for case description and
management activities.
Based on the findings of the investigation, the Garante’s Office considered the complainant’s
data to have been processed by in breach of Articles 12(3) and (4) and 15 of
the GDPR on the following grounds:
- The data subject has the right to obtain access to any information and personal data
by which he/she is or can be identified (see Articles 15 and 4(1) GDPR); accordingly,
should have provided the complainant both with the transcripts of
phone calls, if recorded, and with the personal data relating to him as contained in
the so-called ‘internal case notes’;
- The controller is required to provide the data subject with the requested information
without undue delay and in any event within one month of receipt of the request, and
to specify any reasons whereby disclosure of the requested documents is not possible
(see Article 12(3) GDPR); accordingly, should have replied to the
complainant by specifying the reasons for not taking action on his request in order to
enable him to lodge a complaint with the supervisory authority if he was not satisfied
with the reply, irrespective of whether the case relating to the malfunctioning of the
vehicle had been settled or not;
- Article 23 of the GDPR empowers Member States to restrict, in specific cases, the
exercise of data subjects’ right of access providing that the data subjects’ right to be
informed about the restriction is ensured, among other things. Section 2-l of
legislative decree No 196/2003 (as amended by legislative decree No 101/2018) lists
accordingly the cases where exercise of the data subjects’ rights may be restricted and
provides that the data subject ‘shall be informed’ by the controller ‘of the relevant
reasons without delay’. In the case at issue, the information provided in this respect
to the data subject was incomplete; indeed, only in the pleadings submitted of late to
the Garante were the relevant restrictions mentioned without actually providing
adequate arguments to support them as it was alleged that access was denied for as
long as necessary to exercise legal claims.
3
In the light of the foregoing considerations, the Garante’s Office found the processing by
to be unlawful and notified the company under Section 166(5) of the Italian
DP Code of the infringements found with regard to Articles 12(3) and (4) and 15 of the
GDPR; the company was called upon to submit pleadings or documents to the Garante or to
request to be heard by the Garante (under Section 166(6) and (7) of the DP Code and in
pursuance of Section 18(1) of Law No 689 of 24 November 1981).
By way of a letter received on 15 November 2019, requested to be heard by
the Garante. Such hearing took place on 5 October 2020, following a complex procedure
relating to access to document requests and to the stay of the proceeding due to the health
emergency. The company sent their pleadings by a letter dated 2 October 2020 where they
alleged the following:
- had not infringed personal data protection legislation as the company had
replied to all the requests made by the data subject within the deadlines set out in the
GDPR and the Italian DP Code; they had explained in those replies that they would
not be in a position to provide him either with the recordings of the phone calls
between him and the customer centre (which were not recorded) or with the so-called
‘case notes’. Regarding the latter, the company had explained that – pursuant to
Section 8(3), letter e) corresponding to Section 2-l, letter e) of the Italian DP Code –
disclosing such notes would be prejudicial to the exercise of a legal claim by the
company since the complainant had repeatedly indicated he was planning to apply to
the Motor Ombudsman;
- As the complainant’s request was dated 14 May 2018, i.e. it bore a date prior to the
entry into force of the GDPR, the legislation previously in force as per legislative
decree No 196/2003 was applicable to the case at issue;
- As the complainant had requested the imposition of corrective measures, not of
sanctions, in his submission to ICO, the Garante was expected to only decide in
respect of the former; in any case, the applicable fining regime was the one previously
in force under legislative decree No 196/2003, which provided the regulatory
framework applicable at the time the data subject had requested access.
During the hearing held at the Garante’s premises on 5 October 2020, the company
referenced their pleadings and declared the following:
- The company had replied to the complainant’s request to access his personal data
‘promptly’, since the call centre operator had not rejected the access request but had
postponed the reply until such time as the dispute would be settled;
- The applicable legislation was in any case the one in force at the time when the facts
occurred, i.e. as of the date the complainant had requested access; accordingly, the
regulatory framework provided for in legislative decree No 196/2003 was applicable;
- If legislative decree No 196/2003 was applicable, the alleged infringements would not
exist as the right of access could be restricted by the company’s right to exercise a
legal claim under Section 8(2), letter e) of the Italian DP Code.
Furthermore, the company requested that the Garante would not publish its final decision,
if any, and that account be taken of the more lenient approach envisaged in the so-called
‘grace period’ as for the initial application of the fining provisions laid down in the GDPR.
4
3. Assessment of the case by the Garante
In the light of the foregoing considerations, it should be pointed out that the controller’s
statements as made in the pleadings and in the course of the hearing – for whose
truthfulness one is liable under Section 168 of the Italian DP Code – are relevant, however
they do not override the allegations made by the Garante’s office by way of the initial
statement of claim and do not allow dismissing the case; in particular, none of the conditions
is fulfilled as mentioned in Section 11 of the Garante’s Rules of Procedure No 1/2019 on
internal procedures having external impact.
More specifically, consideration should given to the following:
- Contrary to the allegations made by the company in their pleadings, the legislation
applicable to the case at hand is Regulation (EU) 2016/679 along with the Italian DP
Code as amended by legislative decree No 101/2018. Although the complainant’s
request was filed with a few days in advance of the entry into force of the
Regulation, the complaint as such was lodged with ICO thereafter – namely, on 31
May 2018; this circumstance entails per se that the complaint is to be handled in
accordance with the supervening legislation. An even weightier argument supporting
the applicability of the Regulation to the case at issue is that the failure to reply to
the complainant’s requests gave rise to an infringement of personal data protection
law that started prior to 25 May 2018 but continued actually after the entry into force
of the Regulation. Having received the complainant’s request, the controller ought to
have replied at the latest by 14 June 2018 – i.e., at a time when the Regulation was
fully in force - in pursuance of Articles 15 and 12 of the Regulation. Since ‘processing
already under way on the date of application of (…) Regulation should be brought into
conformity with (…) Regulation’ (see Recital 171), the point in time determining the
applicable law is the time of commission of the infringement by the controller.
failed to respond to the complainant’s request also following the 14th of June, 2018;
accordingly, the infringement continued until it was remedied by Thus, one
cannot but conclude that the infringement was committed by the company when the
Regulation and the amended DP Code were in force; accordingly, the latter pieces of
legislation are relevant for establishing which regulatory framework is applicable
timewise by having regard to the infringement at issue;
- Therefore, the Regulation provides the reference legal framework also in order to
establish the applicable sanctions;
- The Garante does not concur with the arguments put forward by the company
whereby the complainant’s requests were dealt with ‘promptly’ (either via emails or
through the call centre), which arguments were also relied upon to account for the
negated disclosure of the documents at issue. As already pointed out, Section 2-l of
legislative decree No 196/2003 (as amended by legislative decree No 101/2018) is not
applicable to the case at hand. That section enables the controller to restrict, in
specific situations, the data subject’s right of access; however, the data subject ‘shall
be informed of the relevant reasons without delay’ in such cases. In the case at issue,
the information provided to the data subject was proven to be inadequate as well as
5
incomplete: indeed, only in the pleadings submitted of late to the Garante were the
relevant restrictions mentioned without actually providing adequate arguments to
support them as it was alleged that access was denied for as long as necessary to
exercise legal claims. Data subjects must be in a position to timely know about any
restrictions on the exercise of a right such as the one set forth in Article 15 of the
Regulation; accordingly, the reference made by the company to ‘privacy law’ may not
be considered sufficiently exhaustive in that respect. By the same token, the
detrimental effects allegedly caused to the controller’s right of defence solely on
account of the complainant’s having indicated his intention to apply to the Motor
Ombudsman are not such as to fulfil, per se, the conditions for restricting data subject
rights which are set out in Section 2-l(1), letter e), of the Italian DP Code. Therefore,
the decision to not disclose the requested information and to postpone such
disclosure is not supported by adequate arguments and results as such into a breach
of the aforementioned provisions.
Based on the foregoing considerations, the preliminary assessment by the Garante’s Office
is hereby confirmed to the effect that the company failed to comply with the obligation to
reply to the data subject’s access requests in pursuance of Article 12 of the Regulation, which
provides that ‘the controller shall provide information on action taken on a request under
Articles 15 to 22 to the data subject without undue delay and in any event within one month
of receipt of the request.’
The company’s conduct was in breach accordingly of Article 12 et seq. of the Regulation.
4. Order to pay
Under Article 58(2)(i) of the Regulation and Section 166 of the Italian DP Code, the Garante
is empowered to impose an administrative fine pursuant to Article 83(5) of the Regulation
by adopting an order to pay (in accordance with Section 18 of Law No 689 of 24 November
1981) in respect of the processing of personal data relating to the complainant, as it was
found that such processing was unlawful under the terms of Article 12 et seq. of the
Regulation. The above order may be adopted upon conclusion of the proceeding referred to
in Section 166(5) of the DP Code where the controller had the opportunity of being heard
(see paragraphs 1.2, 1.3, and 1.4 hereof).
As for the items referred to in Article 83(2) of the Regulation with a view to imposing an
administrative fine and determining the relevant amount, and taking into account that the
imposition of an administrative fine shall ‘in each individual case be effective, proportionate
and dissuasive’ pursuant to Article 83(1) of the Regulation, the Garante gave due regard to
the following factors in the case at hand.
As for the nature, gravity and duration of the infringement, the latter was considered to be
substantial by having regard to the provisions on the exercise of data subjects’ rights and to
the fact that the events at issue resulted mostly from the controller’s failure to implement
adequate measures to enable the data subject to access his personal data; it should be
considered additionally that the infringement continued from the date by which the
6
- within the deadline for appealing this decision as referred to in Section 10(3) of legislative
decree No 150 of 1 September 2011; and
PROVIDES
That this decision be published on the Garante’s website pursuant to Section 166(7) of the
Italian DP Code and Section 16(1) of the Garante’s Rules of Procedure No 1/2019, and finds
that the conditions mentioned in Section 17 of the Garante’s Rules of Procedure No 1/2019
are fulfilled.
is required hereby to communicate that it complied with the provisions
made herein and to submit documentary proof thereof under the terms of Section 157 of the
Italian DP Code by 90 days from the date of service. Failure to provide the aforementioned
information may entail imposition of the administrative fine envisaged in Article 83(5)(e) of
the Regulation.
In accordance with Article 78 of the Regulation, section 152 of the Italian DP Code, and
Section 10 of legislative decree No 150 of 1 September 2011, this decision may be challenged
by filing an appeal with the competent court within thirty days of the date when this decision
is communicated, or within sixty days of the said date if the appellant is resident abroad,
whereby an appeal filed past the said date shall be inadmissible.
Rome, 16 December 2021
THE PRESIDENT
[Signed]
THE RAPPORTEUR
[Signed]
THE SECRETARY GENERAL
[Signed]
8