Information and Data Protection Commissioner
CDP/IMI/LSA/22/2021
vs
COMPLAINT
1. On the 24th June 2021, (the “complainant”) lodged a complaint with
Österreichische Datenschutzbehörde, the Austrian Supervisory Authority, against
1 (the “controller”) pursuant to article 77(1) of the General Data Protection
Regulation2 (the “Regulation”).
2. The complainant contended that, on the 5th May 2021, she had exercised the right to access her
personal data in accordance with article 15 of the Regulation. However, the controller failed to
provide the complainant with information about the action taken within the time-frame
stipulated by law. The complainant further argued that she was not informed if the controller
needed an extension to reply to her request.
3. On the 22nd September 2021, the Austrian Supervisory Authority informed the Information and
Data Protection Commissioner (the “Commissioner”) about the complaint pursuant to article
56(3) of the Regulation. Following an assessment carried out by the Commissioner, it was
established that the controller has its main establishment in Malta. Thus, the Commissioner
proceeded to handle the case as the lead supervisory authority.
1
is a private limited company registered under the laws of M alta with number ,
having its registered address at .
2
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movem ent of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation).
Page 1 of 6
INVESTIGATION
4. Pursuant to article 58(1)(a) of the Regulation, the Commissioner requested the controller to
provide any information which it deemed necessary and relevant to defend itself against the
allegation raised by the complainant. In terms of this Office’s internal investigation procedure,
the controller was provided with a copy of the complaint, together with all the supporting
documentation, provided by the complainant.
5. On the 2nd December 2021, the controller submitted the following principal legal arguments for
the Commissioner, to consider during the legal analysis of this case:
a. that, on the 5th May 2021, the controller “received an email from the law firm
”, where “[t]he law firm requested access to personal data for the player
”;
b. that the controller failed to comply with the subject access request submitted by the
complainant within the stipulated time-frame “due to the massive inundation of data
subject access requests that the relevant company has received as of late, thereby not
allowing for the company to be able to reply within the stipulated period in this
particular case”;
c. that, by means of an email dated the 19th June 20213, the controller informed the lawyer
acting on behalf of the complainant, that her request has been processed and requested
confirmation to send the requested data via Wetransfer;
d. that the controller did not receive a reply to the email dated the 19th June 2021, and, as
a result, the controller did not provide a copy of the personal data undergoing
processing to the complainant.
3
The controller provided a copy of the email dated the 19th June 2021 in German (original text) and English
(translation). The English translation read “May we send you the requested data via the service provider
"WeTransfer"?
Page 2 of 6
LEGAL ANALYSIS AND DECISION
The Timing of the Reply
6. The protection of natural persons in relation to the processing of their personal data is a
fundamental right recognised by article 8(1) of the Charter of Fundamental Rights of the
European Union. Within this context, the rights of the data subjects as set forth in articles 12 to
22 of the Regulation are the fulcrum of the law, and their role is absolutely crucial to ensure the
utmost protection of personal data processed by controllers. In this regard, the Commissioner
emphasises the importance attributed to the right of access as laid down in article 15 of the
Regulation, in particular, its special feature, which is derived from the fact that it is often a
means, prerequisite or condition to enable data subjects to oversee and control their personal
data, and consequently, exercise other data subjects, such as the right to erasure or rectification4 .
7. The right of access as enshrined in article 15 of the Regulation contains three (3) components:
(i) confirmation of the processing of personal data; (ii) information about the processing itself;
and (iii) access to a copy of personal data undergoing processing. Article 15(1) of the
Regulation enables the data subject to “obtain from the controller confirmation as to whether
or not personal data concerning him or her are being processed and, where that is the case,
access to the personal data”, as well as other supplementary information pursuant to article
15(1)(a) to (h) and article 15(2) of the Regulation. Further to this, article 15(3) of the
Regulation, which is more prescriptive, states that “the controller shall provide a copy of the
personal data undergoing processing”.
8. In this connection, article 12 of the Regulation ensures that substantive rights of data subjects
are safeguarded by establishing clear, proportionate and effective conditions as to how and
when data subjects shall exercise their rights. For this reason, article 12 of the Regulation
provides the modalities for the exercise of the data subjects’ rights and establishes an obligation
upon the controller to facilitate the exercise of these rights.
9. In particular, article 12(3) of the Regulation aims at ensuring the efficient exercise of
information and access rights, and obliges the controller to “provide information on action
4
CJEU, C-434/16, Nowak, para. 56
Page 3 of 6
taken on a request under Articles 15 to 22 to the data subject without undue delay and in any
event within one month of receipt of the request”. Within this set timeframe, the controller shall
either (i) comply with the request; (ii) extend the deadline to two (2) further months and provide
the reasons for such extension; or (iii) refuse to act on the request in terms of article 12(5)(b)
of the Regulation and inform the data subject accordingly.
10. On this aspect, with particular reference to the handling of data protection requests, the
European Data Protection Board5 emphasises that “[t]he controller shall react and, as a general
rule, provide the information under Art. 15 without undue delay, which in other words means
that the information should be given as soon as possible. This means that, if it is possible to
provide the requested information in a shorter amount of time than one month, the controller
should do so”.
11. After assessing the circumstances of the case, the Commissioner determined that, on the 5th
May 2021, the complainant exercised her right to access her personal data pursuant to article
15 of the Regulation. In the submissions provided to this Office on the 2nd December 2021, the
controller declared that it had contacted the lawyer of the complainant on the 19th June 2021
and that “due to the massive inundation of data subject access requests that the relevant
company has received as of late, thereby not allowing for the company to be able to reply within
the stipulated period in this particular case”. Thus, the Commissioner established that the
controller failed to provide information to the complainant on the action taken on the request
to access her personal data within one (1) month of receipt of the request.
Making the information available
12. In the email dated the 19th June 2021, the controller informed the complainant that her request
has been processed and requested the complainant to confirm whether the response could be
sent by means of the service provided by Wetransfer.
13. For this purpose, the Commissioner analysed article 12(1) of the Regulation, which establishes
that the information shall be provided, where appropriate, by electronic means, in conjunction
with the principle of integrity and confidentiality as set forth in article 5(1)(f) of the Regulation.
5EDPB Guidelines 01/2022 on data subject rights - Right of access - Version 1.0 - Adopted on 18 January 2022
– Paragraph 156
Page 4 of 6
14. In this regard, the Commissioner noted that when the controller makes personal data available
to the data subject, this is deemed to be a processing operation, and therefore, the controller is
obliged to implement appropriate technical and organisational measures to ensure a level of
security appropriate to the risk of the processing in terms of article 32(1) of the Regulation.
In addition, the Commissioner considered article 15(3) of the Regulation, which states that
where the data subject makes the request by electronic means, and unless otherwise requested
by the data subject, the information shall be provided in a commonly used electronic form.
15. The Regulation does not specify what is a commonly used electronic form, and thus, there are
several conceivable formats that could be used by the controller. However, it is important to
ensure that the format must enable the information to be presented in a way that is both
intelligible and easily accessible. This naturally means that when the controller chooses the
means of how to transmit the electronic file to the data subject, the controller shall ensure that
the data subject is able to download the information in a commonly used electronic form.
16. Furthermore, recital 63 of the Regulation establishes that “[w]here possible, the controller
should be able to provide remote access to a secure system which would provide the data
subject with direct access to his or her personal data”.
17. It therefore follows that it is the responsibility of the controller to decide about the appropriate
form in which the personal data shall be provided to the data subject and this is also in light of
the accountability principle as held in article 5(2) of the Regulation.
On the basis of the foregoing considerations, the Commissioner hereby decides that the controller
infringed:
i. article 12(3) of the Regulation, when it failed to provide the complainant with information
on the action taken on her subject access request within one (1) month from the date of
receipt of request; and
ii. article 15(1), article 15(2) and article 15(3) of the Regulation, when it failed to provide the
complainant with a copy of her personal data undergoing processing and the information
concerning the processing.
Page 5 of 6
By virtue of article 58(2)(b) of the Regulation, the controller is hereby being served with a
reprimand. Furthermore, in terms of article 58(2)(c) of the Regulation, the controller is hereby
being ordered to comply with the request and provide the complainant with the information
prescribed under article 15(1)(a) to (h) and article 15(2) of the Regulation and also with a copy of
her personal data undergoing processing at the time of submitting the request pursuant to article
15(3) thereof.
The controller shall comply with this order within ten (10) days from the date of receipt of this
legally binding decision. Non-compliance with the order of the Commissioner within the
stipulated timeframe shall result in the imposition of an administrative fine in terms of article
83(6) of the Regulation.
In terms of article 26(1) of the Data Protection Act (Cap. 586 of the Laws of Malta), any party to this
decision shall have the right to an effective judicial remedy by filing an appeal in writing before the
Information and Data Protection Appeal Tribunal within twenty (20) days from the service of this
decision6 .
Digitally signed
(Signature) Date:
2022.12.27
(Signature) 12:45:50 +01'00'
Information and Data Protection Commissioner
6 More information about the Tribunal and the appeals procedure is accessible on https://idpc.org.mt/appeals-
tribunal/
Page 6 of 6