DPA case 9885177 – Dismissed (Italy, 2023)

A data subject in Italy received by mail a credit card from a bank based in the Netherlands. Since they had never had any contact with the financial institute, the data subject made an access request under Article 15 GDPR which was never answered. A complaint was therefore filed with the Italian DPA. The latter transferred the complaint to the Dutch DPA in the context of the cooperation mechanism envisaged by Article 60 GDPR. The Dutch DPA, considered itself leading supervisory authority pursuant to Article 56 GDPR, and asked the controller to clarify some points. The controller claimed to have received a request for the creation of a bank account by a an individual using the complainant's personal data. Whilst the account creation had meanwhile been interrupted due to suspicion of fraudulent behaviour by the applicant, the credit card had nonetheless already been sent to the data subject’s address. Furthermore, the controller claimed not to have received a proper request from the data subject. The Dutch DPA considered these elements sufficient to exclude any GDPR violations. The Dutch DPA issued a draft decision which dismissed the complaint. The Italian DPA agreed with the content of the decision. Therefore, the decision became binding for all the DPAs pursuant to Article 60(6) GDPR. Under Article 60(8) GDPR, the Italian DPA adopted the final decision and notified it to the complainant.