Roy De Vita – €4,000 Fine (Italy, 2024)

The data subject contacted a doctor, the controller, requesting access to pictures taken before and after their plastic surgery, as provided for under Article 15 GDPR. The controller never responded to such request, thus the data subject filed a complaint with the DPA for the infringement of Article 15 GDPR. Prior to initiating a procedure against the controller, the Italian DPA requested the controller to comply with the data subject’s request twice and additionally requested specified copy of the information to be provided by the controller to data subjects under Article 13 GDPR. As the controller did not reply to those requests, the DPA initiated a proceeding and invited the controller to share their defence. Additionally, the DPA again asked the controller to provide the Article 15 GDPR information. The controller did not react to either the invite of sharing their defence or to respond to the access request. The DPA established that, by never replying to the multiple requests, the controller maintained a negligent behaviour which violated [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196~art157 Article 157 of the Italian Data Protection Code] (Codice in materia di protezione dei dati personali). Thus, the DPA considered the imposition of a fine under Article 83(5) GDPR, and in line with its powers under Article 58 GDPR, appropriate. The Italian DPA considered two elements to determine the fine: the lack of previous violations as per Article 83(2)(e) GDPR and the controller´s non-cooperation as per Article 83(2)(f) GDPR. On the basis of these two elements, the Italian DPA set a fine of €4.000 .