Italian DPA Fines La Patria €20,000 for Mishandling GDPR Data Subject Access Requests
La Patria S.p.A. violated GDPR Articles 12, 13, and 15 by failing to properly respond to data subject access requests (DSARs), incorrectly interpreting them through the lens of national labor law rather than GDPR obligations. This misclassification led to inadequate or incorrect information being provided to data subjects, depriving them of their fundamental right to know how their personal data is being processed. The Garante reinforced that controllers must recognize DSARs regardless of whether the request explicitly cites GDPR, and must always communicate refusal reasons along with the data subject's right to judicial remedy. This case highlights the organizational risk of siloing privacy compliance within HR or legal teams unfamiliar with GDPR's broader obligations, rather than embedding it into a dedicated data protection function.
Tactical Insight
Immediate actions
- Establish a centralized DSAR intake process with a dedicated team trained specifically on GDPR Articles 12, 13, and 15 obligations.
- Audit all recent data subject requests to ensure responses were compliant with GDPR, not just national labor or sector-specific law.
- Create standardized DSAR response templates that include legally required elements such as refusal reasons and judicial remedy rights.
Long-term improvements
- Implement ongoing GDPR training for HR, legal, and compliance teams to ensure they can correctly identify and route DSARs under EU privacy law.
- Appoint or empower a Data Protection Officer (DPO) to oversee and quality-control all DSAR responses before they are sent.
- Develop a DSAR policy that explicitly clarifies GDPR takes precedence over national labor law interpretations for privacy requests.
Detection & monitoring measures
- Track all incoming DSARs in a dedicated register with timestamps to ensure responses meet the 30-day GDPR deadline under Article 12.
- Schedule periodic internal audits of DSAR handling procedures to identify procedural gaps before a supervisory authority investigation occurs.
- Implement escalation workflows that flag ambiguous or disputed requests to the DPO or external counsel for review.