Immobiliare Pianezza S.r.l.s. – €5,000 Fine (Italy, 2024)

The data subject received an unwanted call from Company X. After an access and deletion request, the Company X distanced itself from the calls and traced them back to the real estate agency Studio Immobiliare S.r.l.s., the controller. The data subject advanced a complaint and, subsequently, the Italian DPA advanced a request for access in its investigation. The controller stated that the data subject´s data was retrieved from a data base containing the phone contact of the data subject that had been acquired years prior from a provider. It also stated, on the phone, that the use of this information by an employee was improper and that it would proceed to the erasure of the data, which however was not confirmed in written form. The DPA only initiated proceedings against Studio Immobiliare S.r.l.s., the controller, and deemed the involvement of Company X too superficial to be relevant in the investigation. It appeared that the data subject´s phone number came into the controller´s possession for unknown reasons, likely connected to some unspecified operations by previous managers. In fact, so-acquired personal data, without any legal basis, were stored, without any care, for an indefinite time period on an unattended paper filing system, which is problematic in light of Article 32(1)(b) and (d), as well as (2) GDPR. The “human error” claim would be per se indicative of insufficient organizational measures from the controller, indicating a violation of the accountability principle under Article 5(1)(f), (2) and 24 GDPR. Moreover, the access request was answered by the controller late and only partially, as the legal basis was not explicated nor specifically explained. Therefore, the access request was not satisfied in violation of Articles 12 and 13 GDPR. Within this context, the DPA found a violation of Articles 12(3), 15 as well as Articles 6(1)(a) and 7 GDPR. As a consequence of these violations, the DPA found it appropriate to impose a fine of €5,000 to the co