FCA Italia s.p.a. – €40,000 Fine (Italy, 2022)

A former employee (the complainant) asked his former company FCA Italy s.p.a. (the data controller), to access his personal data processed in the context of their employment relationship and held in his personal file. Since the company did not reply, on 22 March 2021, the complainant filed a complaint with the Italian DPA, who then requested the company to provide feedback in this regard. The company provided a first defense note stating that the complainant used to have conversations with the H.R. department and that, after receiving the access request, the data controllerhad considered it possible to resolve the issue in a meeting which, however, due to the COVID-19 emergency, had been postponed several times. Furthermore, according to the company, the data that the complainant requested was already in his possession. On 05 August 2021, the complainant stated in a note that the feedback provided by the data controller was unsuitable and reiterated his request. The company responded to have carried out the complainant's demands and that the requested documents were already available to the complainant. As the data controller declared itself to have been collaborative by sending what was requested with transparency, it requested the DPA to express a preliminary opinion on the admissibility of the appeal presented by the complainant considering itself not responsible and therefore not punishable. On 08 April 2022, the Italian DPA notified the data controller of the alleged violations of the GDPR that had been found, specifically of Article 12 GDPR and Article 15 GDPR, and stated that the complaint by the complainant was admissible. Following a request from the data controller, a hearing took place on 24 May 2022 during which the data controller declared that since November 2020, the data controller had a portal dedicated to the exercise of the rights of interested parties, both employees and customers, which could be accessed also from the company's website. Furthermore, the aforementioned link was automatically sent every time someone wrote to the data controller's DPO. Additionally, on the data controller intranet, after registering on the "The Hub" portal, employees could access their personal file and download them. At the time of submitting the access request, the complainant was registered with "The Hub" since 27 November 2020. The data controller had also made available both a telephone service and a physical counter through which it was possible to request information and exercise the right of access. It was ascertained that the telephone service was used 15 times by the complainant, always receiving a response on the same day the request was made. The complainant had also requested on various occasions for meetings with the data controller which was organised together with the union representative, and during which he had made a request for documents that the company had provided to him. Lastly, it submitted that there was an "obvious conflict" between the company and the complainant, given the constant request for meetings by the complainant. Following the hearing and an examination of the documentation acquired, the Italian DPA ascertained that the data controller carried out treatments that did not comply with the legislation. In fact, it emerged that on 5 Januray 2021 the complainant had sent a request aimed at obtaining some information to which, however, the company had not provided any response. Only after the complaint was submitted and the relevant procedure was started did the company become available and collaborative by sending the requested documents to the complainant. The data controller believed it could provide feedback to the complainant's request during a meeting with representatives of H.R., based on a practice established with the complainant. However, this meeting did not take place due to the COVID-19 emergency. However, according to DPA, this conduct did not comply with the provisions of the GDPR. In fact, the data controller is required to facilitate the exercise of the complainant's rights and to provide him with information in relation to the action taken without unjustified delay and in any case within 1 month of receiving the request. Furthermore, the requested information must be provided in writing or by other means. Therefore, the data controller should have responded to the complainant in the manner and within the foreseen deadlines, under Article 12(1) GDPR, Article 12(2) GDPR, Article 12(3) GDPR and Article 12(4) GDPR. The DPA further stated that regarding the fact that the complainant had already used the tools made available by the data controller, the DPA found that not all the requested information is available through them. Furthermore, the request for access to personal data, pursuant to Article 15 GDPR, can also be requested in relation to data which the interested party already has or which has already been delivered to him. In closing, if a complainant makes a request and the data controller does not comply with his request, the controller is required to inform him within 30 days of receiving the request of the reasons for non-compliance and the possibility of filing a complaint with the DPA. In this case, therefore, the data controller should have informed the complainant of the reasons why his request was not followed up. Following the violations of the abovementioned articles of the GDPR, the DPA sanctioned the data controller €40,000 , considering the nature, severity and duration of the violation, the intentional or negligent nature of the violation and a previous provision issued against the company but positively evaluating its cooperation.