Amazon Italia Logistica – €20,000 Fine (Italy, 2022)

This case concerns access requests made by an employee, the data subject, to their employer Amazon Italia Logistica (Amazon), the controller. The data subject submitted the access request on 23 August 2020 pursuant to Article 15 GDPR, in order to receive copies of their professional certificates obtained during the employment relationship. These certifications included, for example, their: “PLE pallet elevator certificate”; “certificate for the management and programming of the palletiser robot”; and “PES and PAV” certificates. The data subject was not afforded access to these certificates and subsequently, on 21 September 2020, filed a complaint with the Italian DPA. The data subject argued that they have the right to access their personal data contained in the company’s records. The controller’s refusal to provide the data would constitute a violation of the GDPR. Responding to the complaint, made the following points. Firstly, the company confirmed that the data subject had, on 23 August 2020, contacted the HR department, requesting a copy of the certificates, and had sent a follow up request on 1 September 2020. Dealing with the issues raised by the complaint the controller argued, firstly, that the professional certificates requested – with the exemption of the PES and PAV certificates – were from internal Amazon courses for which there is no physical certificate, and they have no value beyond internal authorization to carry out assigned tasks. Secondly, they asserted that the data subject did not send their requests to the correct email address. The first request was sent to the HR department, the second request to an employee without any management powers, who was not competent to follow up on the request. The complainant did not send the requests to Amazon’s dedicated email address for Article 15 GDPR access requests (EU-staff-privacy@amazon.com) which was provided to all employees through the issuance of a privacy policy. Thirdly, Amazon argued that the complainant did not in any way specify that these were access requests pursuant to Article 15 GDPR. The controller did acknowledge errors had been made in responding to the requests, stating that “unfortunately, due to an unfortunate negative contingency” they failed to provide the subject with the necessary clarifications and inform him of the impossibility of issuing the certificates, and they did not provide the PES and PEV certificates. They emphasized that any infringement was not carried out in bad faith, apologised for the lack of accuracy, and stated that the company did not intend to do any harm to the data subject. After investigating the complaint, the DPA ascertained that the Company did not adequately respond to the request for access pursuant to Article 15 GDPR. Responding to the controller’s first argument (impossible to provide internal certificates), the DPA explained that, even though it was impossible to provide certification of the internal authorisation, the controller was under a duty to inform, and explain, this to the data subject. According to Article 12(4) GDPR, in situations where the controller is unable to take action on the data subject request, they must “inform the interested party without delay, and at the latest within one month of receipt of the request, of the reasons for non-compliance”. Regarding the second argument (request sent to wrong email address), the DPA investigation revealed that the complainant had sent the first request to the HR department as well as the email address EU-candidate-privacy@amazon.com. Also, while their follow up request was sent to another employee without management power, this employee forwarded the request to the HR department. The DPA also found that there is no evidence that the privacy policy was sent to the employee and that, in any case, the document cited quotes the HR email as an alternative option for employees to obtain further information on their rights regarding the protection of personal data. Therefore, these cannot be considered circumstances such as to justify the absence of a reply. Addressing the third argument (data subject did not specify Article 15 access request), the DPA outlined that, under the GDPR, the burden of specifying the legal basis of the request does not fall on the data subject. Furthermore, if the data controller has doubts about the right that the interested party intends to exercise, they must ask the data subject to specify it. The controller was under the obligation to facilitate the exercise of data subject rights and they failed to do so. In light of the above, the DPA held that the controller acted in violation of the GDPR, in particular Articles 12 and 15. Pursuant to its powers under Article 58(2)(i) GDPR, and in accordance with Article 83 GDPR, they imposed an administrative fine of €20,000 upon the controller.