Decision No 48 of 2 March
2023
GARANTE PER LA PROTEZIONE DEI DATI PERSONALI
In today’s meeting, with the participation of ;
; and ,
; and , ;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 (hereinafter the ‘GDPR’);
Having regard to legislative decree No 196 of 30 June 2003 (Personal Data Protection
Code, hereinafter ‘Italian DP Code’ or the ‘Code’) as amended by legislative decree No 101 of
10 August 2018 containing ‘Provisions to adapt the national legal system to Regulation (EU)
2016/679 (GDPR)’;
Having regard to the complaint lodged by with the Austrian supervisory
authority (SA) regarding the allegedly unlawful processing of data concerning him and, in
particular, the failure to respond to his request for deletion of personal data;
Taking account of IMI Article 56 procedure No 306560, which was opened by the
Austrian SA insofar as an instance of cross-border data processing was at issue;
Taking account that the Italian SA accepted to act as the lead supervisory authority in the
said procedure since the controller has its main establishment in Italy;
Having regard to the draft decision approved by the Garante’s Panel of Commissioners
at the meeting of 5 August 2022, which was shared with the other supervisory authorities
concerned in compliance with the cooperation and consistency principles set out in Article 60
of the GDPR;
Having regard to the records on file;
Having regard to the considerations submitted by the Secretary General in pursuance of
Section 15 of the Garante’s Regulations No 1/2000;
Acting on the report submitted by ;
WHEREAS
1. The complaint and the relevant inquiries
On 25 February 2021, lodged a complaint with the Austrian SA
under Article 77 of the GDPR alleging the failure by to reply to his 13 January
2021 request for erasure of his personal data. is a small company having its
registered office in Italy and operating in the publishing and website development sectors.
1
The Italian SA (Garante per la protezione dei dati personali, hereinafter the ‘Garante’)
received the above complaint from the Austrian SA via IMI A56 Procedure No 306560 and
accepted to act as the lead supervisory authority (LSA) on 19 July 2021.
2. Assessment by the Garante and Final Decision
By way of a letter dated 23 August 2021, which was re-sent to a PEC [Certified Email]
account on 1 December 2021 following the failure to deliver the letter to the company’s physical
address, was invited to provide the Garante with any and all information
regarding the processing of s personal data which had allegedly infringed Article
12(3) and (4) and Article 17 of the GDPR.
Further to the above request for information, the controller replied by a letter dated 2
December 2021 and addressed both to the Garante and to to the effect that ‘it
had duly replied to the user from and it had also immediately erased all his
data on the same day. This is proven by s having received no additional
communications from us thereafter.’ The data subject had reportedly submitted no further
complaints.
In the letter that was also sent to the data subject, provided information on the
source of the data and the processing arrangements and apologised for any inconvenience it
might have caused.
Having considered the information received and the circumstances of the case at hand, in
particular the statement by the controller whereby the data subject’s requests had been granted,
this SA decided to share the information in question and its views with the other CSAs via IMI
informal consultation (IC) procedure No 352887.
In particular, the controller’s response (English translation) was uploaded along with
information on the SA’s intention to deal with the case by way of an ‘amicable settlement’
based on the assessment of that response and in accordance with the EDPB ‘Guidelines 6/2022
on the practical implementation of the amicable settlements’.
The Austrian SA, which had received the complaint, informed this SA that it had sent
’s response to the data subject and invited the latter to submit any objections or remarks
within two weeks – in compliance with the principles underpinning cooperation procedures
and, in particular, the data subject’s right to be heard.
Since the data subject failed to challenge the controller’s statements, the Austrian SA
informed the Garante that it shared the proposal to close the case by way of an ‘amicable
settlement’ decision.
In particular, both authorities agree that the alleged violation of data protection legislation
can be considered remedied following removal of the possible cause of the action through the
active collaboration demonstrated by the controller (providing feedback to the data subject and
providing for the erasure of his data) and in the light of the satisfaction shown by the data
subject, who did not raise objections after having been duly informed and placed in a position
to contest the reply by the controller.
Such a decision is based on the shared acceptance of the solution achieved and the mutual
satisfaction of the parties involved. The outcome of the procedure should be regarded as a due
diligence approach due to the margin of discretion afforded to all SAs in handling cases (see
Guidelines 6/2002, para. 30).
2
Accordingly, the Italian SA submitted the Draft Decision related to the case to the other
concerned SAs (A60 DD Procedure No 450005) pursuant to Article 60(3) GDPR.
Under Article 60(6) GDPR, the said draft decision became binding on the CSAs and the
Garante as no relevant and reasoned objections were submitted in accordance with Article 60(4)
GDPR;
BASED ON THE FOREGOING PREMISES, THE GARANTE
in the light of the findings from the inquiries carried out and taking note of the response
provided by the company – which is without prejudice to Section 168 of the Italian DP Code in
case of false representations – as well as of the failure by the complainant to submit additional
objections or remarks, and pursuant to Articles 57(1)(f) and 60(7) GDPR as well as pursuant to
Section 143(3) of the Italian DP Code and Sections 14 and 18 of the ‘Garante’s Regulations
No 1/2019 concerning internal procedures having external relevance, aimed at carrying out
the tasks and exercising the powers delegated to the ‘Garante’, finds that the complaint was
settled amicably and accordingly closes the relevant procedure by way of this decision.
In accordance with Article 60(7) GDPR, this decision shall be notified to the data
controller, who may challenge it under the terms of Article 78 of the GDPR as applied jointly
with Section 152 of the Code and Section 10 of legislative decree No 150 of 1 September 2011
by lodging an appeal with the court of the place where the controller is resident or has an
establishment or else with the court of the data subject’s place of residence by thirty days from
notification hereof, or by sixty days if the appellant is resident abroad.
Under Article 60(7) GDPR, the supervisory authority with which the complaint was
lodged (the Austrian SA) shall inform the complainant on this decision.
Rome, 23February 2023
[signed]
THE PRESIDENT
THE RAPPORTEUR
THE SECRETARY GENERAL
3