Banca popolari di Bari S.p.a. – €10,000 Fine (Italy, 2024)

On 31 July 2023 a data subject complained to the DPA against a bank - Banca popolari di Bari S.p.a. (‘controller’). The data subject made an access request as an heir to her deceased father. The request was based on Article 15 GDPR and [https://www.garanteprivacy.it/codice Article 2-terdecies of the Italian Data Protection Code] which makes a special reference to heirs who are beneficiaries of life insurance policies. The data subject claimed that despite repeated requests, the bank initially stated there were no accounts in her father's name. Later, the bank acknowledged their existence but failed to provide the requested information. After the Authority intervened, the bank partially responded, offering access to account statements for the last ten years but requiring a formal request under [https://www.bancaditalia.it/compiti/vigilanza/intermediari/Testo-Unico-Bancario.pdf Article 119 of Consolidated Bank Act no. 385/1993]. The complainant remained dissatisfied and insisted on the access to all data related to her father. Following this, the bank finally provided account statements of the deceased person. Nevertheless, the DPA initiated proceedings against the bank for violations of Articles 12(3), 12(4) and 12(5) GDPR related to the action taken on the request of the data subject. In the defense briefs, the bank explained that the failure to timely reply to the initial request of the data subject and to the subsequent reminders was caused by a series of operational misunderstandings. In particular, the data subject mistakenly directed their request to a different e-mail address rather than the one designated for the Data Protection Officer. Moreover, the bank initially believed that no accounts were held in the name of the deceased and subsequently, the organizational unit of the bank misclassified the request. All of this led to the failure to promptly handle the request within the prescribed timeframes. The bank promptly took steps to address the situation by committing to regular awareness-raising communications and provided guidance on its website for submitting data access requests. The DPA confirmed that the Bank did not provide a reply to the data subject’s request for access to personal data without undue delay or no later than one month from the receipt of the request as provided in Article 12(3) GDPR. Additionally, the controller also failed to inform the data subject within the same time limit of the reasons for non-compliance and of the possibility of lodging a complaint with a DPA or seek a judicial remedy as provided in Article 12(4) GDPR. The DPA dismissed the controller’s assertion that directing the access request to an e-mail address other than the one dedicated for such requests constituted the reason for the delay in response. The DPA recalled [https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf EDPB Guidelines 01/2022] on data subject rights which clarify that data subjects are not obliged to adopt a particular format for submitting requests to exercise their right of access. There are in fact no requirements under the GDPR that the data subjects must observe when choosing a communication channel through which they enter into contact with the controller. Therefore, for the failure to respond to the access request, the DPA ordered the controller to pay the sum of €10,000.