ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
als (particularly in the case of claims for damages or appeals against decisions of the supervisory author - ity). 1.8 Enforcement Proceedings and Fines As mentioned in 1.7 Regulators , GPDP inspections may be triggered by the authority itself (on the basis of an inspection plan adopted and published every six months, or following the notification of a personal data breach) or by data subjects or other third parties (in the case of complaints or reports). Preliminary Investigation In the event of a complaint by a data subject, the GPDP shall verify the correctness and completeness of the complaint and, if necessary, grant the complain - ant a period of time to amend it, normally not exceed - ing 15 days. In the event of a correct and complete complaint (or in the event of an investigation on its own accord, such as following the notification of a personal data breach), the GPDP shall start a prelimi - nary investigation, during which the documentation received is examined and/or further information is requested from the data controller or data processor. In that scenario, inspections may also be carried out, during which the entity subject to inspection may be assisted by its trusted advisers and reserve the right to produce the documentation that is not immediately available within a reasonable period (as a rule, not exceeding 30 days). A record of the activity carried out shall also be drawn up, with particular reference to the statements made and the documents acquired, and a copy shall be given to the subject under inspection. Closing of the Preliminary Investigation and Archiving At the end of the preliminary investigation, the com - petent department within the GPDP may conclude its examination of the complaint by archiving it, when: • the issue examined does not appear to be related to the protection of personal data or the tasks entrusted to the GPDP; • there is no evidence of a breach of the relevant data protection regulations;
• the claim set out in the complaint is excessive, due in particular to its specious or repetitive character; or • the issue raised by the complaint has already been examined by the GPDP. In the case of a complaint, feedback is provided to the applicant, briefly stating the reasons why no action is being taken. Initiation of Proceedings If the matter is not dismissed following the prelimi - nary investigation, the competent department shall initiate proceedings for the adoption of measures by the board of the GPDP, by means of its own commu - nication to the data controller and/or data processor. The communication shall contain: • a concise description of the facts and alleged breaches of the relevant data protection rules, as well as the relevant sanctioning provisions; • an indication of the competent organisational unit where a copy of the investigative documents may be inspected and extracted; and • the indication that, within 30 days of receipt of the notice, it is possible to send the GPDP defence papers or documents, and to ask to be heard by the GPDP. Right of Defence The addressee of the notice may exercise the right of defence by submitting written statements and docu - ments within 30 days from the date of notification of the communication, as well as a personal testimony regarding the facts of the notice, where requested. The addressee of the notice may request a short extension by specifically and duly motivating the request. The extension shall normally not exceed 15 days, and may be granted according to proportionality criteria and criteria relating to the operational/dimen - sional characteristics of the addressees themselves and to the complexity of the matter under examina - tion. The addressee of the notice may also request a hearing before the GPDP.
205 CHAMBERS.COM
Powered by FlippingBook