GARANTE PER LA PROTEZIONE DEI DATI PERSONALI
In today’s meeting, with the participation of ,
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 (hereinafter the ‘Regulation’);
Having regard to legislative decree No 196 of 30 June 2003 (Personal Data Protection Code,
hereinafter ‘Italian DP Code’ or the ‘Code’) as amended by legislative decree No 101 of 10 August
2018 containing ‘Provisions to adapt the national legal system to Regulation (EU) 2016/679
(GDPR)’;
Having regard to Regulation 1/2019 concerning internal procedures having external impact as
related to discharge of the tasks and exercise of the powers committed to the Garante per la
protezione dei dati personali, as approved by resolution No 98 of 4 April 2019 and published in Italy’s
Official Journal No 106 of 8 May 2019 and at www.gpdp.it (web document No 9107633) (hereinafter
the ‘Garante’s Regulation No 1/2019’ or ‘Regulation 1/2019’);
Having regard to the complaint lodged with the Garante on 24 June 2020 by an
Italian national, against regarding the receipt of marketing communications in spite
of the complainant’s having requested that his personal data be erased, whereby the complainant
also reported the unavailability of the privacy notice on the website that is owned
by the said company;
Having regard to the preliminary European cooperation procedure under Article 56 of the
Regulation whereby the case was submitted for assessment under the OSS-regime;
Taking note that the procedure started by the Garante under Article 56 of the Regulation led the
Berlin Supervisory Authority to accept acting as the lead supervisory authority in the case at hand
since the relevant controller has its single establishment in Berlin, and that the case was accordingly
managed pursuant to the OSS-mechanism within the meaning of Article 60 of the Regulation;
Having regard to the mutual assistance procedure under Article 61 of the Regulation whereby the
lead supervisory authority requested the Garante to supplement the complaint by providing the
attachments referred to therein along with the evidence that unsolicited communications had been
received after the complainant had requested the company to erase his personal data;
Having regard to the letter dated 5 March 2021 whereby the Office of the Garante requested the
complainant to submit the additional documents in question;
Taking note that the complainant failed to provide any feedback to the above request;
Taking note that the Garante provided the attachments requested by the lead supervisory authority
within the framework of the aforementioned mutual assistance procedure and also informed the said
authority that the complainant had failed to reply to the request made by the Office of the Garante;
1
Having regard to the cooperation procedure within the meaning of Article 60(3) of the Regulation
whereby the lead supervisory authority submitted a draft decision to the supervisory authorities
concerned under Article 4(22) of the Regulation for their opinion;
Whereas the lead supervisory authority proposed that the complaint be dismissed on the following
grounds:
‘Based on the complainant´s description, three possible breaches of the GDPR could – in theory - be
investigated:
1. A breach of Article 12 (3) and 17 GDPR because of late erasure,
2. A breach of Articles 6 (1), and 17, 21 or 7 (3) GDPR, because of marketing e-mails after objection
or withdrawal of consent or erasure re-quest,
3. A breach of Article 13 because the privacy policy was not available.
Unfortunately, the attachments provided are not sufficient to start any of these investigations.
In order to investigate a breach of Articles 12 (3) and 17 GDPR (late erasure), the Berlin DPA
requires additional data, such as a copy of the earlier erasure requests. At least the Berlin DPA needs to
know the approximate time frame in which the request(s) was/were made, in order to conduct a
preliminary assessment whether Article 12 (3) GDPR was breached and confront the controller with it.
In order to investigate a breach of Articles 6 (1), and 17, 21 or 7 (3) GDPR, (marketing e-mails
after an erasure request, objection or withdrawal of con-sent), the Berlin DPA requires a copy of either an
objection or withdrawal of consent or erasure request raised before May 13th, 9 am or a copy of an
advertisement e-mail received after May 13th, 2020.
Regarding the privacy settings page, which the complainant states was not reachable, the Berlin
DPA found that currently, there´s a privacy policy available in Italian under
The web archives show that the page was existent in June 2017 and
August 2020. If the page was not available in the time in-between, the Berlin DPA requires screen-shots
to prove this.
The Berlin DPA requested additional information and the Italian Supervisory Authority contacted
the complainant in order to procure the additional information, but without success: The complainant did
not provide the re-quested information. Therefore, the Berlin DPA cannot start the investigation and
discontinues the proceedings.’
Taking note that no relevant and reasoned objection was raised by the Garante and/or the other
supervisory authorities concerned in respect of the said draft decision and that the latter is
accordingly to be regarded as binding in pursuance of Article 60(6) of the Regulation;
Finding accordingly that a final decision is to be adopted under the terms of Article 60(8) of the
Regulation in line with the aforementioned draft decision where the lead supervisory authority has
held that the case is to be dismissed on the grounds mentioned in the foregoing paragraphs;
Having regard to Section 18(5) of the Garante’s Regulation No 1/2019, which provides that the
proceeding shall be concluded in accordance with Article 60(8) of the Regulation by way of the
adoption of the order referred to in Sections 14 to 16 of the said Regulation No 1/2019 whenever the
Garante is a supervisory authority concerned on account of having received a complaint;
Having regard to the records on file;
2
Having regard to the considerations submitted by the Secretary General in pursuance of Section 15
of the Garante’s Regulation No 1/2000;
Acting on the report submitted by ;
BASED ON THE ABOVE PREMISES, THE GARANTE
PROVIDES
That the complaint lodged by on 24 June 2020 against shall be
dismissed within the meaning of Article 60(8) of the Regulation on the grounds set out in the
preamble hereof.
This order may be challenged under the terms of Article 78 of the Regulation as applied jointly with
Section 152 of the Code and Section 10 of legislative decree No 150 of 1 September 2011 by lodging
an appeal with the court of the place where the controller is resident or has an establishment or else
with the court of the data subject’s place of residence by thirty days from notification hereof, or by
sixty days if the appellant is resident abroad.
Rome, 24 March 2022
THE PRESIDENT
THE RAPPORTEUR
THE SECRETARY GENERAL
3