Decision No 92 of 23 March
2023
GARANTE PER LA PROTEZIONE DEI DATI PERSONALI
In today’s meeting, with the participation of , ;
; and ,
; and , ;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 (hereinafter the ‘GDPR’);
Having regard to legislative decree No 196 of 30 June 2003 (Personal Data Protection
Code, hereinafter ‘Italian DP Code’ or the ‘Code’) as amended by legislative decree No 101 of
10 August 2018 containing ‘Provisions to adapt the national legal system to Regulation (EU)
2016/679 (GDPR)’;
Having regard to the complaint lodged by with this supervisory
authority (SA) against ;
Taking account of IMI Article 56 procedure No 350195, which was opened by this
Authority (Garante per la protezione dei dati personali, hereinafter the ‘Garante’) insofar as an
instance of cross-border data processing was at issue, and which was notified to the other
European concerned supervisory authorities on 27 December 2021;
Taking account that the Dutch SA, “Autoriteit Persoonsgegevens”, accepted to act as the
lead supervisory authority in the said procedure since the controller has its main establishment
in The Netherlands;
Having regard to the draft decision No 470953 and revised draft decision No 480872
adopted by the Dutch SA and shared with the other supervisory authorities concerned (France,
German Land of Rhineland-Palatinate, Spain) in compliance with the cooperation and
consistency principles set out in Article 60 of the GDPR;
Having regard to the records on file;
Having regard to the considerations submitted by the Secretary General in pursuance of
Section 15 of the Garante’s Regulations No 1/2000;
Acting on the report submitted by ;
WHEREAS
1. The complaint and the relevant inquiries
On 19 July 2021, lodged a complaint, through her lawyer, with the Italian
SA under Article 77 of the GDPR against (hereinafter, “ ”), complaining
that on 19 February 2021 she had received a credit card registered in her name by post from
, although she had never applied for a credit card and never provided any information to
1
. Moreover, she alleged the failure by to reply to her access request according to
art. 15 GDPR, sent by certified e-mail on 21 April 2021, and to her subsequent reminder.
Since the controller, , has its main establishment in Amsterdam, The Netherlands,
the Italian SA activated the cooperation procedures as required by Article 60 of GDPR and
transmitted the complaint to the Dutch SA on 27 December 2021. The Dutch SA accepted to
act as the lead supervisory authority (LSA), being competent accordingly for starting the
relevant inquiries and determining lawfulness of the processing at issue.
By way of a letter dated 1 September 2022, the controller was invited to provide the Dutch
SA with any and all information regarding the processing of ’s personal data.
Further to the above request for information, the controller replied by a letter dated 12
September 2022, which was transmitted to the Garante on 19 September 2022 together with the
initial assessment by the Dutch SA.
In its letter clarified the following:
a) a request for opening a account was received on 30.1.2021 in the name of the
complainant; a week later (6.2.2021), following the outcome of the identity
verification procedure for anti-fraud purposes, the account was reported as fraudulent
in connection with a possible identity theft;
b) as a result, the account opened in the name of the complainant was immediately
blocked and still remains blocked;
c) during the week in which the account was open, a card bearing the complainant’s
name was sent to the address indicated in the account. The card has never been
activated and no transaction has taken place;
d) moreover, the Dutch supervisory authority highlighted how it could not contribute to
prosecuting the perpetrator of the fraudulent act, being in no way competent in this
regard.
Regarding the data access request by the data subject pursuant to art. 15 of GDPR, the
internal investigation carried out by in its systems showed that there was no request
from the complainant or any communication between the latter and ; in this regard,
the Dutch supervisory authority asked to carry out the relevant checks on the basis
of the name of the complainant and of her lawyer. In any case, the Dutch authority believes
that the complainant's request was not submitted in the form of a proper request for access
pursuant to art. 15 of the GDPR. Indeed, the letter to , dated 21 April 2021, contained
a generic request ‘to communicate the details of the owner and the person responsible for
data processing’, reserving the right to take legal action regarding the unlawful processing
of data and warning the company not to use and/or disseminate the complainant’s data;
therefore, there was apparently no breach of art. 15 GDPR.
On the basis of the preliminary investigation conducted, and considering the
circumstances of the case, the Dutch SA concluded that the controller had provided an
adequate response to the request for information and that a violation of article 6 (1) of the
GDPR was not proved. In any case, the Dutch SA made itself available to assist the data
subject in any request for erasure of her data addressed to .
The Dutch SA, therefore, shared with this SA and with the other authorities concerned
its intention to close the case, having found no violations of the GDPR such as to justify the
continuation of the proceeding, by deciding to reject the complaint.
2
The Garante shares the Dutch authority’s conclusions, having decided likewise in a
similar manner on the complaint sent at the same time by the same data subject against
another controller – namely, a bank headquartered in Italy. As highlighted above, a violation
of personal data by the controller could not be found, whereas the facts would point to a
possible scam as the predicate offence in whose respect the processing of personal data
plays an ancillary role; indeed, the complainant informed this SA that she had already turned
to Italian judicial authorities in this regard (‘on 10.05.2021 she filed a police report against
unknown persons’).
By wat of a letter dated 10 November, 2022, both the reply from and the initial
assessments made by the Dutch SA and endorsed by this Authority were communicated to
the complainant.
The latter, via her lawyer, confirmed that a judicial proceeding was underway before
the Italian judicial authority concerning the possible fraud/scam and, whilst not contesting
the assessments by the Dutch supervisory authority, requested that the latter would make
sure that would retain her personal data for the whole duration of the investigations
by the Italian judicial authority, at the end of which the data would have to be cancelled.
Having received the data subject’s feedback, the Dutch supervisory authority ,
submitted a draft decision to the other supervisory authorities concerned pursuant to Article
60(3) GDPR, providing in particular as follows:
- following the investigation into the complaint against , the Dutch
supervisory authority did not find a violation of the requirements pursuant
to articles 6(1) and 15 of the GDPR; since a further continuation of the
procedure was not necessary, the authority rejected the complaint pursuant
to art. 60 (8) GDPR;
- moreover, the Dutch supervisory authority, as requested by the data
subject, gave assurances that it would ask to keep the information
relating to the data subject only for the purposes of the ongoing
investigation by the Italian Public Prosecutor's Office concerning the
alleged fraud, and to delete the data once the investigation was concluded.
Under Article 60(6) GDPR, the said draft decision – after being revised in the form of a
Revised Draft Decision following a comment added by this SA to clarify the scope of the
request submitted by the complainant - became binding on the CSAs including the Garante as
no relevant and reasoned objections were submitted in accordance with Article 60(4) GDPR.
2. Assessment by the Garante and decision
The Italian SA agrees to the revised draft decision in the light of the findings and the
assessment submitted by the Dutch SA.
BASED ON THE FOREGOING PREMISES, THE GARANTE
acting pursuant to Articles 57(1)(f) and 60(8) GDPR as well as pursuant to Section 143(3)
of the Italian DP Code and Sections 11, 14(1) and 18(5) of the ‘Garante’s Regulations No
1/2019 concerning internal procedures having external relevance, aimed at carrying out the
tasks and exercising the powers delegated to the ‘Garante’, in its capacity as complaint-
receiving SA competent for adopting the final decision,
3
rejects the complaint
on the foregoing grounds and decides to close the related proceeding.
In accordance with Article 60(8) GDPR, this decision will be notified to the complainant,
and the data controller will be informed thereof.
The complainant may challenge this decision under the terms of Article 78 of the GDPR
as applied jointly with Section 152 of the Code and Section 10 of legislative decree No 150 of
1 September 2011 by lodging an appeal with the court of the place where the controller is
resident or has an establishment or else with the court of the data subject’s place of residence
by thirty days from notification hereof, or by sixty days if the appellant is resident abroad.
Rome, 23 March 2023
[signed]
THE PRESIDENT
THE RAPPORTEUR
THE SECRETARY GENERAL
4