Avis Budget Italia S.p.A. – Complaint Upheld (Italy, 2024)

Two Norwegian citizens (the data subjects) rented a car at Venice airport, from a car rental company (the controller). After going back to Norway, the data subjects received from the Italian authorities a car fine and a letter stating they had not paid the toll for a highway. However, the data subjects noticed that these two documents referred to a period of time in which they had already gone back to Norway. After sending some emails to the controller, they filed a complaint with the Norwegian DPA (Datatilsynet). Since the main establishment of the controller is in Italy, the complaint was forwarded to the Italian DPA (Garante per la protezione dei dati personali) pursuant to Article 56(1) GDPR. The controller argued that, due to human error, the data subjects' data were confused with the person that was actually driving the car while the traffic code violations happened. Therefore, their names were wrongly sent to the authorities that, then, issued the fines to the data subjects. Moreover, the controller pointed out that, for car rentals, communicating the name of the driver to competent authorities is a legal obligation under several Italian laws. After the mistake was pointed out, the controller contacted the authorities issuing the fines in order to ensure that the latter were addressed to the right person. Therefore, the data subjects did not eventually have to pay the fine. First, the DPA noted that the controller lawfully collected the data subjects’ personal data since that was necessary for the performance of a contract under Article 6(1)(b) GDPR. Second, the DPA pointed out that, in principle, the controller can rely on Article 6(1)(c) GDPR to communicate the data to the competent authorities after being notified that the rented car was involved in a traffic code violation. However, in the case at hand, the controller communicated the wrong name. According to the DPA, this event falls into the definition of a data breach pursuant to Article 4(12) GDPR. Thirdly, the DPA noted that the data breach at hand was not caused by any technical problem but by an occasional human error. Fourthly, the DPA welcomed the fact that the controller had improved its technical and organizational measures to avoid this type of incidents. Fifthly, the DPA noted that the controller mitigated the negative consequences of the breach by contacting the authorities and making sure the data subjects were not the addressee of the fine anymore. Therefore, the DPA believed that no corrective measure under Article 58(2) GDPR was needed. Pursuant to Article 60(4) GDPR, the Italian DPA forwarded the draft decision to the Norwegian DPA. Since the latter did not object, the decision became final according to Article 60(6) GDPR.