Amazon Italia Transport s.r.l. – €40,000 Fine (Italy, 2023)

A data subject brought a complaint to the Italian DPA against Amazon Italia Transport s.r.l. (the controller). The complainant claimed that the controller, his former employer, did not provide a reply to his access request within the time limits laid down by Article 12(3) GDPR. Thus, on 26 January 2022, the DPA requested the controller to submit its observations on the matter. On 4 February 2022, the controller provided that because the complainant’s request was broad and generic, internal coordination between the various departments concerned was needed, which did not allow it to comply with the request within the time limits set by Article 12 GDPR. The personal data requested by the complainant and further information relating to the processing of the personal data were then provided by the controller. On the basis of the declarations made by the controller, the DPA notified it on 21 March 2022 of the initiation of the sanctioning procedure under [https://www.garanteprivacy.it/codice Article 166(5) of the Italian Privacy Code] in relation to the alleged breaches of Article 12(3) GDPR and Article 15 GDPR. In light of the information provided by the controller, the DPA noted that the controller responded to the complainant’s access request under Article 15 GDPR almost six months after the deadline set by the GDPR and only after the filing of the complaint and the opening of the enquiry by the DPA. The DPA also acknowledged that the controller declared to not have responded to the request in a timely manner due to the vastness and generality of the information requested by the complainant. Request that made it impossible for the controller to provide a more detailed response. However, referring to the [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en EDPB Guidelines 01/2022], the DPA reiterated that a controller who processes a large amount of information relating to the data subject may ask the data subject to specify the information to which the request relates, as also provided in Recital 63 GDPR. Not only did the controller fail to request specifications, but it also did not inform the complainant of the reasons for the delay, thereby failing to comply with Article 12(3) GDPR. Therefore, the DPA ruled that because the processing carried out by the controller breached Article 12 GDPR and Article 15 GDPR. Since the infringement could not be considered 'minor' taking into account its nature, seriousness and duration, the DPA fined the controller €40,000.