The Italian data protection authority (Garante) declared unlawful the processing by a company for having responded late to a data access request from a former employee, considering its defense arguments inadmissible, notably the incorrect qualification of the request and its alleged lack of responsibility after the end of the employment contract.

Facts and context

The Italian data protection authority (Garante) today published a decision against Union Facility s.r.l. for breaches related to the handling of a data subject rights request.

The case originated from a complaint by a former employee who received no response to her access request to her personal data, made on July 28, 2023.

Reasons for the decision

• Obligation to respond to data subject rights requests within deadlines (Article 12, paragraph 3, of the GDPR) and to guarantee the right of access (Article 15 of the GDPR): The authority found that the company did not respond within one month to the complainant's request. It rejected the company's argument that the request, aimed at obtaining training certificates, did not constitute an access request within the meaning of the GDPR. The authority recalled that the request explicitly cited Article 15 of the GDPR and sought all information provided by that provision. Furthermore, it emphasized that training certificates do contain personal data (decisions no. 246 of 24/04/2024 and no. 571 of 11/09/2025). The argument that processing responsibility ends with the termination of the employment contract was also deemed unfounded, as the company remains responsible as long as it processes the data. The response was only provided on April 5, 2024, after the authority's intervention, confirming the violation.

Authority's decision

Consequently, the authority declared unlawful the processing carried out by Union Facility s.r.l. for violation of Articles 12, paragraph 3, and 15 of the GDPR.

Furthermore, the authority ordered the publication of this decision on its website.

Lessons learned

This decision reminds that:

• An employer's responsibility as controller does not end with the termination of the employment relationship; it continues as long as the former employee's data are processed.
• A data subject rights request explicitly citing a GDPR provision must be treated as such, even if the controller believes the data subject's intention is limited to obtaining a specific document.
• Documents related to an employee's professional training, such as certificates, contain personal data and fall within the scope of the right of access.
• The starting point for the deadline to challenge a violation by a supervisory authority is when it has full knowledge of the facts constituting the infringement, which may require further investigations after an initial response from the controller.