[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVuF1_oyupCFOKJXUIbg0brZZI6NeJl11GtWT8aY5lZA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47},"172d546c-e420-4019-a192-98ac9fbfdc8b","italian-dpa-fines-la-patria-20000-for-mishandling-gdpr-data-subject-access-requests","a006ca1f-7edc-4c4e-a8ee-503fc90fb22e","Italian DPA Fines La Patria €20,000 for Mishandling GDPR Data Subject Access Requests","La Patria S.p.A. violated GDPR Articles 12, 13, and 15 by failing to properly respond to data subject access requests (DSARs), incorrectly interpreting them through the lens of national labor law rather than GDPR obligations. This misclassification led to inadequate or incorrect information being provided to data subjects, depriving them of their fundamental right to know how their personal data is being processed. The Garante reinforced that controllers must recognize DSARs regardless of whether the request explicitly cites GDPR, and must always communicate refusal reasons along with the data subject's right to judicial remedy. This case highlights the organizational risk of siloing privacy compliance within HR or legal teams unfamiliar with GDPR's broader obligations, rather than embedding it into a dedicated data protection function.","**Immediate actions:**\n- Establish a centralized DSAR intake process with a dedicated team trained specifically on GDPR Articles 12, 13, and 15 obligations.\n- Audit all recent data subject requests to ensure responses were compliant with GDPR, not just national labor or sector-specific law.\n- Create standardized DSAR response templates that include legally required elements such as refusal reasons and judicial remedy rights.\n\n**Long-term improvements:**\n- Implement ongoing GDPR training for HR, legal, and compliance teams to ensure they can correctly identify and route DSARs under EU privacy law.\n- Appoint or empower a Data Protection Officer (DPO) to oversee and quality-control all DSAR responses before they are sent.\n- Develop a DSAR policy that explicitly clarifies GDPR takes precedence over national labor law interpretations for privacy requests.\n\n**Detection & monitoring measures:**\n- Track all incoming DSARs in a dedicated register with timestamps to ensure responses meet the 30-day GDPR deadline under Article 12.\n- Schedule periodic internal audits of DSAR handling procedures to identify procedural gaps before a supervisory authority investigation occurs.\n- Implement escalation workflows that flag ambiguous or disputed requests to the DPO or external counsel for review.",[12,13,14,15,16,17,18,19,20],"GDPR Article 12 – Transparent information and communication","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 77 – Right to lodge a complaint with a supervisory authority","NIST SP 800-53 IP-1 (Individual Access)","NIST SP 800-53 IP-2 (Individual Redress)","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Operation – Request Fulfilment Process","published","2026-09-21T14:21:20.056234+00:00","2026-09-21T14:21:19.953+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_585\u002F2026&diff=53118&oldid=0","garante-per-la-protezione-dei-dati-personali-italy-585-2026-9ca496","Garante per la protezione dei dati personali (Italy) - 585\u002F2026",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]