Emme ci.service s.r.l. – €2,000 Fine (Italy, 2024)

Two of the former employees, technicians of Emme ci.service s.r.l. (‘controller’) filed a complaint with the DPA due to the processing of their personal data after the termination of the employment relationship with the controller. The data processing involved the use of their names and contact details in the header of the company’s bulletins. The processing occurred after informing the controller of this situation, too. Additionally, the controller kept the data subject’s e-mail accounts active for 7 months after the termination of the employment contract. Lastly, the data subjects stated that the controller failed to deliver certificates of attendance at a basic course for the driving of elevating platforms which took place in 2009. The controller claimed that, firstly, in view of the sudden and unforeseen resignation of the employees, the company continued using the old bulletins until the new ones arrived which no longer made any reference to the data subjects. The controller highlighted that they promptly removed their details from the bulletins upon a request of the data subjects’ lawyer. Secondly, they never had access to the data subjects' e-mail accounts during their employment nor the period after the termination of the employment. The controller argued that the data subjects e-mail accounts do not constitute a ‘company account’ in a strict sense as it was not provided or created by the controller but the data subjects themselves. The address was not used for the official communications on behalf of the controller and the data subjects could have deleted the account at any time. Thirdly, the controller claimed that they were not in possession of the certificates of attendance and emphasized that the certificates were only valid for four years. For that reason, the controller held the course in an updated form in 2018 and was not obliged to keep the expired certificates for such a long period. Moreover, the controller argued that the request for certificates was sent by the data subject’s lawyer, a third party. In their view, such request cannot be regarded as a right to access under Article 15 GDPR. Regarding the processing of data subject’s data in the header of company’s bulletins, the DPA ascertained that the continuation of such processing even after the end of employment constituted a breach of Article 6(1)(b) GDPR and Article 6(1)(c) GDPR. At that time, the controller lacked an appropriate legal basis due to a lack of any binding employment contract or obligations arising from the sectoral labor regulations. The DPA also noted that this conduct is not in accordance with the principle of fairness under Article 5(1)(a) GDPR as well as provisions of Articles 12 and 17 GDPR. As the employer processed data that was no longer necessary outside the employment relationship, the controller was supposed to meet the obligations for erasure under Article 17 GDPR. The controller shall facilitate the exercise of data subjects right as per Article 12 GDPR which did not happen in this case. In fact, the controller continued to use their data on the bulletins subsequent to the request for erasure by the data subjects' lawyer which stems from the documentation provided. Regarding the controller’s retention of the data subjects’ e-mail accounts, the DPA considered that no evidence of a breach of data protection rules has emerged. Regarding the data subject’s request for course certificates, the DPA found a violation of Articles 12 and 15 GDPR. It was established that the controller did not provide adequate feedback to the request for access to the certificates. More specifically, the controller was obliged to inform the data subject that they were unable to provide the certificates in question and state the reasons for non-compliance with their right to access. In the present case, the controller was not in possession of the requested document as they expired more than ten years ago. However, these circumstances do not relief the controller from its duty to respond to data subject and inform them of the possibility to lodge a complaint with the DPA. Lastly, the DPA rejected the argument of the controller that there was no obligation to respond to request sent by a third party, the data subjects’ lawyer. In fact, the controller, with respect to the [https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf Guidelines 01/2022 on data subjects’ rights], may verify the identity of the third party acting in the name and on behalf of the data subject. Although the right of access is generally exercised by data subjects’ themselves, it is possible to authorize a proxy acting on their behalf. In the light of the above, the DPA imposed a fine of €2,000 for violations of Article 5(1)(a), 6, 12, 15 and 17 GPDR.