T.S.M. Srl. – €40,000 Fine (Italy, 2022)

The data subject was contacted by cleaning tool company T.S.M. Srl. (the controller) to take part in a professional course, and received various forms to be filled in. The company was not able to answer the data subject properly regarding its involvement in the processing of the data required in the forms. The data subject decided to address the company with requests to exercise their rights to access, to object and to erasure of personal data. T.S.M. replied confirming the deletion of personal data, but did not provide a proper response regarding the right of access and the right to object. Based on the company's lack of response to these requests, the data subject filed a complaint with the Italian DPA (Garante). The Garante noted T.S.M.'s lack of participation in the proceedings, and neither asked to be heard, nor answered requests made in this sense by the Garante. The Garante held that this lack of cooperation was in breach of Articles 157 and 166 of the [https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9740796 Italian Code of Privacy]. Nevertheless, the Garante found that the documentation attached to the complaint was sufficient to prove the controller's responsibility in this case. According to the Garante, the mere deletion of the personal data pursuant to Article 17 GDPR did not exhaust the controller's duties regarding the data subject's requests. The Garante held that T.S.M. should have provided the data subject with information related to the origin of the personal data, the processing activities carried out, and any other recipients of the data, pursuant to Articles 13 and Article 15 GDPR. Additionally, the Garante highlighted that T.S.M. should have confirmed the receipt of the request to object to further processing, and granted the data subject's right under Article 21 GDPR. Based on these considerations, the Garante issued a fine of €40,000 on T.S.M. for the violation of Articles 13 and Article 15 and 21 GDPR, as well as the aforementioned Italian Privacy Code breaches. The Garante also ordered T.S.M. to ensure future compliance with its obligations to inform data subject's of its processing activities, to answer the complainant's pending right of access and objection requests, and to ensure that future processing of their personal data would not take place according their objection.