DPA case CDP/IMI/LSA/22/2021 – Complaint Upheld (Malta, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Information and Data Protection Commissioner in Malta upheld a complaint against a company for not responding to a user's request for access to their personal data in time. This matters because it emphasizes the importance of timely responses to data requests under GDPR. Companies must be prepared to handle such requests efficiently.
What happened
A company failed to respond to a user's access request within the required one-month timeframe.
Who was affected
A user who requested access to their personal data from the company.
What the authority found
The Maltese authority ruled that the company violated GDPR by not replying to the access request on time.
Why this matters
This ruling stresses the obligation for companies to respond promptly to personal data requests. It serves as a warning for businesses to improve their data handling processes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject had made an access request to a controller pursuant to Article 15 GDPR. The controller failed to provide information to the data subject on the action taken on the access request within one month as the GDPR foresees due to the large amount of access requests that the company had received. The data subject initially filed the complaint with the Austrian DPA, which informed the Maltese DPA about the complaint pursuant to Article 56(3) GDPR. The Maltese DPA confirmed it was the lead supervisory authority, as the controller had its main establishment in Malta. The controller sent an e-mail to the data subject's lawyer after one month and two weeks of the date of the access request. In the e-mail the controller informed the lawyer acting on behalf of the data subject that the request has been processed and asked for confirmation to send the relevant information via Wetransfer. As a result of not receiving a reply to the e-mail, the controller did not provide a copy of the processed ersonal data. The DPA stated that when a controller chooses the means of how to transmit the electronic file to the data subject, the controller shall ensure that the data subject is able to download the information in a commonly used electronic format. When a controller makes personal data available to the data subject, it is a processing operation, and therefore, the controller is must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing pursuant to Article 32(1) GDPR. The DPA held that the controller infringed Article 12(3) GDPR, when it failed to reply to an access request within one (1) month from the date of receipt of the request, and Articles 15(1), 15(2), 15(3) GDPR, when the controller failed to provide the data subject with a copy of their personal data and information about the processing. Eventually, the DPA issued a reprimand. Furthermore, the controller was ordered to comply with
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case CDP/IMI/LSA/22/2021 in MT
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
27 December 2022
Authority
Information and Data Protection Commissioner
GDPRhub ID
gdprhub-5910About this data
Cite as: Cookie Fines. DPA case CDP/IMI/LSA/22/2021 - Malta (2022). Retrieved from cookiefines.eu
Last updated: