This decision illustrates that a controller cannot ignore a request to exercise rights, even if it responds late. Failure to respond within one month constitutes a separate violation, aggravated in this case by the lack of cooperation with the supervisory authority.

Facts and context

The Italian data protection authority (Garante per la protezione dei dati personali - GPDP) published a sanction decision against the Mediterranean University of Reggio Calabria, including the imposition of a fine of €4,000, for breaches related to the handling of a request to exercise rights.

The case originated from a complaint by a person whose personal data appeared on a 2016 electoral list, still accessible online, and whose erasure request remained unanswered by the university.

Reasons for the decision

• Obligation to respond to requests to exercise rights (Article 12, paragraphs 3 and 4 of the GDPR): The authority found that the university provided no response to the erasure request within the one-month deadline. It recalls that the controller must respond, even in case of refusal, informing the data subject of the reasons for inaction and possible remedies, which was not done in this case.
• Obligation to erase data (Article 17 of the GDPR): The data in question, relating to the 2016 elections, were clearly no longer necessary for the purposes for which they were collected. The university was therefore obliged to erase them without undue delay upon the data subject's request but only proceeded with deletion late, after the sanction procedure was initiated and two reminders from the authority.
• Obligation to process data lawfully, fairly and transparently (Article 5, paragraph 1, point a) of the GDPR): The total lack of communication towards the data subject, who was left without any information about the status of their request, as well as the failure to respond to the authority's inquiries, constitute a breach of the fundamental principles of fairness and transparency.

Decision of the authority

Consequently, the authority imposed a fine of €4,000 on the Mediterranean University of Reggio Calabria.

Furthermore, the authority ordered the publication of its decision on its website.

Lessons learned

This decision reminds that:

• The obligation to respond to a request to exercise rights within one month is mandatory; failure to respond, even in case of refusal to comply, constitutes a GDPR violation.
• Failure to cooperate with the supervisory authority during the investigation phase is an aggravating factor taken into account in determining the amount of the sanction.
• Personal data published for a specific purpose (such as an election) must be deleted when that purpose is achieved and they are no longer necessary; inaction in the face of a legitimate erasure request constitutes a breach.