DPA case 65/2022 – Complaint Upheld (Greece, 2022)

In this case an individual, the data subject, who had taken part in a phone call with a polling company, the controller, submitted an access request (Article 15 GDPR) to obtain a copy of the recorded conversation. The company did not respond to her request and, subsequently, she filed a complaint with the Greek DPA. When asked to provide submissions to the DPA, the controller responded to the complaint by stating, firstly, that it is not a commercial sales company and therefore does not record conversations or collect personal data in any way. Secondly, they explained that they have a three-month period for which they keep personal data on their files and so, had there been any collection of the data as suggested, it would have been deleted. The company also speculated that the subject’s access request (submitted via email) probably ended up in a “pile of unwanted corporate correspondence”. Issuing its decision, the DPA acknowledged the two arguments put forward by the controller. In response to both of these claims, the authority held that “the controller is not released from its obligation to inform the data subject merely because the data in question does not exist in a file kept by [them]”.  Therefore, as the company did not respond to the data subject’s request in any way, they had violated Article 12 and 15 GDPR. The decision also found that the investigation, and the controller’s comments, demonstrated that the company does not appear to have any methods in place to deal with these sorts of requests. Regarding the exercise of corrective powers, the DPA observed that the effects of the infringement were de minimis, that the company did not derive any benefit from it, and that there are have been no prior infringements by the controller. Therefore, in accordance with Article 58 GDPR, the DPA issued a reprimand to the controller, and imposed an order instructing the company to establish, within two months from the receipt of this notice, procedures to ensure t