ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
Preliminary Investigation In the event of a complaint by a data subject, the GPDP shall verify the correctness and complete - ness of the complaint and, if necessary, grant the complainant a period of time to amend it, normally not exceeding 15 days. In the event of a correct and complete complaint (or in the event of an investigation on its own accord, such as following the notification of a personal data breach), the GPDP shall start a preliminary investigation during which the documentation received is examined and/or further information is requested from the data controller or data pro - cessor. In that scenario, inspections may also be carried out, during which the entity subject to inspec - tion may be assisted by its trusted advisers and reserve the right to produce the documenta - tion that is not immediately available within a reasonable period (as a rule, not exceeding 30 days). A record of the activity carried out shall also be drawn up, with particular reference to the statements made and the documents acquired, and a copy shall be given to the subject under inspection. Closing of the Preliminary Investigation and Archiving At the end of the preliminary investigation, the competent department within the GPDP may conclude its examination of the complaint by archiving it, when: • the issue examined does not appear to be related to the protection of personal data or the tasks entrusted to the GPDP; • there is no evidence of a breach of the rel - evant data protection regulations; • the claim set out in the complaint is exces - sive, due in particular to its specious or repetitive character; or
• the issue raised by the complaint has already been examined by the GPDP. In the case of a complaint, feedback is provided to the applicant, briefly stating the reasons why no action is taken. Initiation of Proceedings If the matter is not dismissed following the pre - liminary investigation, the competent depart - ment shall initiate proceedings for the adoption of measures by the board of the GPDP, by means of its own communication to the data controller and/or data processor. The communication shall contain: • a concise description of the facts and alleged breaches of the relevant data protection rules, as well as the relevant sanctioning provisions; • an indication of the competent organisational unit where a copy of the investigative docu - ments may be inspected and extracted; and • the indication that, within 30 days of receipt of the notice, it is possible to send the GPDP defence papers or documents, and to ask to be heard by the same GPDP. Right of Defence The addressee of the notice may exercise the right of defence by submitting written state - ments and documents within 30 days from the date of notification of the communication, as well as a personal testimony regarding the facts of the notice, where requested. The addressee of the notice may request a short extension by specifically and duly motivating the request. The extension shall normally not exceed 15 days and may be granted according to pro - portionality criteria and criteria relating to the operational/dimensional characteristics of the addressees themselves and to the complexity
224 CHAMBERS.COM
Powered by FlippingBook