The Italian authority sanctions a company for its failure to respond to an information request, emphasizing that non-compliance with the authority's investigative powers constitutes a separate and punishable violation of the GDPR, regardless of the initial breaches towards the data subject.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) issued a sanction decision against the company Fluyda Srl Società Benefit in liquidazione, including the imposition of a fine of €1,000, for failing to cooperate with the supervisory authority.

The case originated from a complaint by a data subject who received no response to multiple requests to delete their account on an e-commerce platform.

Grounds for the decision

• Obligation to cooperate with the supervisory authority (Article 58(1)(a) of the GDPR): The authority found that the company provided no response to its official information request, sent to its registered address. This silence was interpreted as a direct violation of the obligation to cooperate with the authority in the exercise of its investigative tasks. The authority emphasized that this failure not only hindered its own investigations but also prevented compliance with the data subject's initial request, which was considered an aggravating circumstance.

Authority's decision

Consequently, the authority imposed a fine of €1,000 on Fluyda Srl Società Benefit in liquidazione.

Furthermore, the authority ordered the company to comply with the complainant's exercise of rights request and to inform her within 30 days. The publication of the decision was also ordered.

Lessons learned

This decision reminds that:

• Failure to respond to an information request from a supervisory authority constitutes an autonomous and punishable infringement, regardless of the initial violation of the data subject's rights.
• Obstruction of the authority's investigative tasks, by preventing it from effectively handling a complaint, is considered an aggravating circumstance when determining the sanction.
• The status of a company, including its liquidation or classification as a microenterprise, may be taken into account as a mitigating factor in determining the amount of the fine but does not exempt it from its obligations under the GDPR.
• The obligation to cooperate with the supervisory authority applies strictly, even when the underlying processing concerns only common personal data, such as identification and contact data.