Avis Budget Italia S.p.A. – Complaint Upheld (Italy, 2024)

Two Norwegian citizens (the data subjects) rented a car at Venice airport, from a car rental company (the controller). After going back to Norway, the data subjects received from the Italian authorities a car fine and a letter stating they had not paid the toll for a highway. However, the data subjects noticed that these two documents referred to a period of time in which they had already gone back to Norway. After sending some emails to the controller, they filed a complaint with the Norwegian DPA (Datatilsynet). Since the main establishment of the controller is in Italy, the complaint was forwarded to the Italian DPA (Garante per la protezione dei dati personali) pursuant to Article 56(1) GDPR. The controller argued that, due to human error, the data subjects' data were confused with the person that was actually driving the car while the traffic code violations happened. Therefore, their names were wrongly sent to the authorities that, then, issued the fines to the data subjects. Moreover, the controller pointed out that, for car rentals, communicating the name of the driver to competent authorities is a legal obligation under several Italian laws. After the mistake was pointed out, the controller contacted the authorities issuing the fines in order to ensure that the latter were addressed to the right person. Therefore, the data subjects did not eventually have to pay the fine. First, the DPA noted that the controller lawfully collected the data subjects’ personal data since that was necessary for the performance of a contract under Article 6(1)(b) GDPR. Second, the DPA pointed out that, in principle, the controller can rely on Article 6(1)(c) GDPR to communicate the data to the competent authorities after being notified that the rented car was involved in a traffic code violation. However, in the case at hand, the controller communicated the wrong name. According to the DPA, this event falls into the definition of a data breach pursuant to Article 4(12) GDPR.