In this case, the complainant initially submitted their complaint to the Information Commissioner’s Office (ICO) of the UK, which was thereafter received by the DPC, on 2 March 2019. The complaint related to the alleged failure by the Ryanair DAC (Ryanair) to comply with a subject access request submitted to it by the complainant on 26 September 2018 in accordance with Article 15 of the GDPR. The ICO provided the DPC with a copy of the complaint form submitted to the ICO by the complainant, a copy of the acknowledgement, dated 26 September 2018, that the complainant had received from the data controller when submitting the access request, and a copy of the complainant’s follow up email to the data controller requesting an update in relation to their request.

Acting in its capacity as Lead Supervisory Authority, the DPC commenced an examination of the complaint by contacting the data controller, outlining the details of the complaint and instructing the data controller to respond to the access request in full and to provide the DPC with a copy of the cover letter that issued to the complainant . Ryanair provided the complainant with access to copies of their personal data relating to the specific booking reference that the complainant had provided to the ICO and data relating to a separate complaint . Ryanair advised that it could not provide the complainant with a copy of the call recording they had requested as, due to the delay on Ryanair’s part in processing the request, the call recording had been deleted in accordance with company policy and they had been unable to retrieve it . Ryanair advised the DPC that it had previously informed the complainant of this via its online portal . Ryanair stated that at the time the request was submitted, due to the volume of data subjects who did not verify their email address, access requests were not assigned to the relevant department until the email was verified by the data subject . Ryanair advised the DPC that the complainant responded to the request, verifying their email address, but the agent who was working on the request had ceased working on the online portal and therefore the request had not been assigned to the relevant department .

Ryanair asserted that this error was not discovered until sometime later, when the request was then assigned to the customer services department to provide the necessary data, including the call recording, at which point the call record had been deleted in accordance with Ryanair’s retention policy . Ryanair provided the DPC with a copy of its retention policy, in which it states that call recordings are retained for a period of 90 days from the date of the call . Ryanair advised that, as the com- plainant’s call had been made on 5 September 2018, it would have been automatically deleted on 4 December 2018 . Ryanair further stated that it does not have the functionality to retrieve deleted call recordings . Pursuant to Section 109(2) of the Data Protection Act 2018, the DPC attempted to facilitate the amicable resolution of the complaint . However, the complainant was unwilling to accept Ryanair’s proposals in respect of same . As such, the matter fell to be decided by way of a decision under Article 60 of the GDPR .

1. Initial Draft Decision

As the complaint related to cross-border processing, the DPC was obliged, in accordance with the Article 60 process, to make a draft decision in respect of the complaint . In its initial version of the draft decision, the DPC made a finding of infringement of Article 15 of the GDPR in that Ryanair failed to provide the complainant with a copy their personal data that was undergoing processing at the time of the request . The DPC also found an infringement of Article 12(3) of the GDPR in that Ryanair failed to provide the complainant information on action taken on their request under Article 15 within the statutory timeframe of one month . The DPC provided the draft decision to Ryanair to allow it to make submissions . Ryanair subsequently provided a number of submissions, which (along with the DPC’s analysis thereof) were taken into account in the draft decision .

2. Provision of Draft Decision to Concerned Supervisory Authorities

In accordance with the Article 60 process, the DPC proceeded to submit its draft decision to the IMI to be circulated amongst the Concerned Supervisory Authorities (CSAs), pursuant to Article 60(3) of the GDPR . The DPC’s draft decision was uploaded to the IMI on 25 May 2020 and, pursuant to Article 60(4) of the GDPR, the CSAs were thereafter entitled to four weeks in which to submit any relevant and reasoned objections to the decision.

The DPC subsequently received a number of relevant and reasoned objections and comments in relation to its draft decision from the CSAs . In particular, certain CSAs argued that additional infringements of the GDPR ought to have been found, and in addition that a reprimand ought to have been imposed .

3. Revised Draft Decision

In accordance with Article 60(3) of the GDPR, the DPC is obliged to take due account of the CSAs’ views . In light of the objections and comments received from the CSAs, the DPC carefully considered each relevant and reasoned objection and comment received in respect of its draft decision . The DPC revised its draft decision to include a summary and analysis of the objections and comments expressed by the CSAs . In revising its initial draft, the DPC followed certain relevant and reasoned objections received, and declined to follow others . In the its revised draft decision, the DPC proposed to issue a reprimand to Ryanair, pursuant to Article 58(2) (b) of the GDPR . The DPC provided its revised draft decision to Ryanair to allow it to make final submissions. Ryanair noted that the DPC had found that it had infringed the GDPR, and that the DPC had exercised its powers in this case in line with Recital 129 and the due process requirements in Article 58 of the GDPR . Ryanair advised the DPC that it accepted the findings and the associated reprimand and did not wish to make any further submissions .

4. Provision of Revised Draft Decision to Concerned Supervisory Authorities

In accordance with Article 60(5) of the GDPR, once the DPC submitted its revised draft decision to the CSAs for their views, the CSAs were entitled to two further weeks in which to submit any further objections to the decision . Pursuant to Article 60(5) of the GDPR, the DPC submitted its revised draft decision to the CSAs for their opinion on 20 October 2020 . As the DPC received no further objections or comments in relation to the revised draft decision from the CSAs within the statutory period, the CSAs were deemed to be in agreement with the revised draft decision of the DPC and bound by it in accordance with Article 60(6) of the GDPR .

5. Adoption of Final Decision

Upon the passing of the deadline for receipt of any further objections, the DPC proceeded to adopt the final decision, in accordance with Article 60(7) of the GDPR . The DPC then uploaded its final decision to the IMI and communi- cated it to Ryanair. The final decision was uploaded on 11 November 2020 . Pursuant to Article 60(7), the ICO, with whom the complaint was initially lodged, was responsible for informing the complainant of the decision .

In summary, the DPC found infringements of Articles 12(3) and Article 15 of the GDPR in respect of this complaint ..