Gestore Dei Servizi Energeticic – Gse S.p.A. – €30,000 Fine (Italy, 2024)

A data subject lodged a complaint with the DPA against Gestore Dei Servizi Energetici – Gse S.p.A. (‘controller’), his former employer. The data subject made an access request to his personal performance evaluation from 2019 and 2020. On 27 October 2021, the data subject sent an e-mail to the company’s general e-mail address and also CCd a director of the human resources. As the controller did not respond, on 6 December 2021, the data subject sent a reminder. On 28 March 2022, the data subject sent the same request to the DPO designated by the controller. In its response on 21 April 2022, the DPO stated that the competent Human Resources (‘HR’) functions of the controller took charge of his request for access and will provide the data subject with the information requested. After a further period of time had elapsed without a response to the request, on 12 May 2022, the data subject asked the DPA to order the controller to comply with the request. The controller argued that the first two e-mails sent by the data subject did not go through their officially certified mailbox of the DPO which is set up for this purpose. Additionally they noted that the data requested was already known to the data subject, given that he became aware of it during his feedback interview. On 19 September 2022, the HR department provided the data subject with the requested information. The DPA established that the controller failed to timely provide the data subject with a copy of his personal performance evaluation file despite his several attempts to access the information. In fact, the controller forwarded the documents to the data subject only after learning that the data subject lodged a formal complaint and with a considerable delay in breach of obligations prescribed in Article 12 and 15 GDPR. The DPA rejected the controller’s defence statement that the initial access requests were not sent to the DPO's official mailbox set up for this purpose. The controller cannot be absolved from liability because a) the data subject was not informed that the access requests should have been channelled to the DPO’s address and b) the access request was finally complied with on 19 September 2022 by the HR Department – the addressee of the initial access requests. Therefore, it appears that the competent person in relation to this type of request is the Head of HR department. Regarding the controller’s argument that the data subject was already informed of his performance during the feedback interview, the DPA stated that access requested may well be submitted also in relation to data already in the possession of the data subject or already known to him. In fact, Article 15 GDPR does not provide for any limitation as to the information relating to the data subject that may be accessed. The GDPR expressly provides for the possibility for the data subject to submit more than one request for access, unless the requests become excessive or repetitive in nature. For the violations of Article 12 and 15 GDPR, the DPA imposed a fine to the controller in the amount of €30,000.