Late response to an access request

Case Overview:

A data subject submitted a request for access to a recorded phone call that involved a customer service issue with a global technology company. The request, filed under Article 15 of the GDPR, was not addressed within the required time frame, prompting the data subject to lodge a formal complaint with the Data Protection Commission (DPC).

Actions Taken:

Upon receiving the complaint, the DPC initiated contact with the company to highlight the issue and sought clarification on the steps being taken to resolve it.

Resolution:

In response, the company swiftly provided the requested phone call recording to the data subject. Satisfied with the company’s prompt action, the data subject agreed to settle the matter amicably. Consequently, the DPC determined that no further regulatory action was necessary.

Key Insights:

This case highlights the critical importance of adhering to GDPR’s deadlines for responding to access requests. Prompt compliance not only resolves potential issues quickly but also helps avoid escalations or regulatory intervention.