Cooperjob S.p.A – €20,000 Fine (Italy, 2023)

The data subject had provided his data to a job-seeking company so that they could be presented as a candidate for job offers. On 11/08/21 the data subject sent a request asking to be removed from the controller 's database under Article 17 as they no longer wanted to reveive job offers. The controller did not respond and so the data subject filed a complaint to the Italian DPA on 12/09/21. The DPA sent a message urging the controller to comply on the 21/10/21. 86 days after the initial request from the data subject and only after intervention from the DPA, did the controller respond and delete the data subject's personal data on the 04/11/21. The DPA held that the controller failed to provide a response within the timeframe provided in Article 12(3) GDPR which stipulates that a response must be no later than one month from receipt of the request. The controller’s initial failure to delete the data subject’s data also violated the right to be forgotten under Article 17. While the DPA did not charge the controller under Article 12(4) GDPR, they reminded the controller that in the event of non-compliance, the controller must notify the subject and inform the data subject of the possibility of lodging a complaint with the supervisory authority as well as available judicial remedies. The DPA fined the company 20,000 euros under Article 58(2)(i) and 83(2).