The Italian authority recalled that a pre-existing conflictual context with a data subject does not exempt a controller from its obligation to respond formally and within deadlines to a request to exercise rights, notably an access request.

Facts and context

The Italian data protection authority (GPDP) published a decision noting breaches against the company Cocontest S.r.l. for failures related to the management of an access request and the information provided to users of its platform gopillar.com.

The case originated from a complaint by a user who complained about receiving unsolicited promotional communications by email and via a messaging application, and about not having received a response to his access request to his personal data.

Grounds of the decision

The authority first dismissed the complaints related to promotional communications, qualifying the single email as "soft spam" within the meaning of article 130, paragraph 4, of the Italian Data Protection Code, and the message via the messaging application as technical information. However, it upheld the following breaches:

• Obligation of transparency and information (articles 12 and 13 of the GDPR): The authority found that the site's privacy policy was non-compliant. Written in English from a generic, non-personalized template, it omitted essential information such as specific purposes, corresponding legal bases, recipients of the data, retention periods, and modalities for exercising rights. This deficiency was deemed contrary to the transparency principle, as defined in articles 5, paragraph 1, point a), 12, paragraph 1, and 13 of the GDPR.
• Obligation to respond to an access request (articles 12 and 15 of the GDPR): The company did not respond to the complainant's formal access request, who wished to obtain complete information about the data processed about him, including the origin of his phone number. The company justified its silence by prior telephone exchanges related to a commercial dispute, wrongly considering that these discussions exempted it from a formal response. The authority rejected this argument, recalling that any request to exercise rights must receive a specific and timely response, which constitutes a violation of the controller's obligations.

Authority's decision

Consequently, the authority concluded that the company Cocontest S.r.l. had violated articles 12 and 13, as well as articles 12 and 15 of the GDPR.

Lessons learned

This decision reminds that:

• a commercial dispute context or prior informal communications with a data subject never exempt a controller from its obligation to respond formally and within deadlines to a request to exercise rights.
• a privacy policy must be personalized, complete, and written in a language easily understandable by data subjects; the use of a generic, uncompleted template in a foreign language does not satisfy the transparency obligation.
• the collection of data mandatory for providing a service, such as a phone number, must be clearly explained to the user, and the absence of visibility of this data in their personal space must not create ambiguity about its processing.