A Hostile Request Is Still a Request

An employee facing disciplinary proceedings sends an email: they want to see everything the company holds about them. Most management teams read it as a litigation tactic and park it. In October, the Italian regulator showed what parking it costs, and France's CNIL confirmed that unanswered requests from job applicants end the same way.

What happened in Italy

A former employee of La Patria S.p.A., an Italian security company, twice asked for access to the documents from his disciplinary proceedings. Among other things, he wanted the data from the GPS unit in the company car he had been assigned. He needed it to defend himself in proceedings that ended in his dismissal. The company did not respond as it should have.

The Italian data protection authority (Garante) decided the case on 6 August 2026, and the EDPB published the decision on 9 October 2026. The fine is EUR 39,000: EUR 22,000 for breaching the right of access and EUR 17,000 for failing to inform employees properly.

Three findings apply to every employer in the EU:

• The request does not have to mention the GDPR. The regulator stated expressly that an employee need not refer to the Regulation for the request to count as an exercise of the right of access. An email saying "send me the file on my disciplinary case" is enough.
• A refusal must come with reasons. If the company does not comply, it must tell the employee why and inform them that they can complain to the supervisory authority or go to court. Silence is not a refusal. It is a breach.
• GPS in a company car is personal data. The vehicle's location can be indirectly linked to the person driving it. The company had not properly informed employees about the processing of location data.

The regulator also found something common in practice: the privacy notice listed special categories of data, such as philosophical beliefs and sex life, which the company did not process at all. It was an inherited template nobody had checked against reality.

The fine was reduced because the company fixed the shortcomings during the proceedings. That is good news and a warning at once: the regulator credited the remediation but imposed the fine anyway.

Applicants and former employees are the usual requesters

On 21 July 2026, the French data protection authority (CNIL) fined EXTIA EUR 300,000. The company recruits IT consultants, and in 2024 it received 265 erasure requests, mostly from job applicants and occasionally from former employees. More than three quarters were either not handled at all or not handled properly.

The figures from the decision:

• 12 erasure requests were never processed,
• 166 people were never told what the company had done with their request,
• 27 people were told after the one-month deadline, some of them months late.

The company argued that applicant data is deleted automatically. The CNIL replied that automatic deletion does not relieve the company of the duty to tell the requester the outcome. In other words, you can do the right thing technically and still breach the Regulation because you told nobody. The fine also reflected that the CNIL had already reminded the company of its obligations twice.

For a company that hires dozens of people a year, this is a realistic scenario. Requests land with HR, with a recruitment agency, in a general inbox or directly with a line manager. Nobody logs them centrally and nobody watches the deadline.

What the GDPR actually says

The rules sit in Articles 12 and 15 of the General Data Protection Regulation:

• The deadline is one month from receipt of the request (Article 12(3)). It can be extended by two further months, taking into account complexity and the number of requests, but you must tell the requester about the extension and the reasons within the first month.
• If you do not act on the request, you must tell the requester without delay, and at the latest within one month, why, and that they can lodge a complaint or seek a judicial remedy (Article 12(4)).
• You must facilitate the exercise of rights (Article 12(2)). You cannot insist on a form, an in-person visit or a specific channel if the request arrived another way.
• The first copy is free (Article 15(3)). A reasonable fee may be charged for further copies.
• Rights of others (Article 15(4)): the copy must not adversely affect the rights and freedoms of others. That is a reason to redact colleagues' or witnesses' details, not a reason to refuse the whole request.

National employment law adds another layer. In Czechia, Section 316 of the Labour Code requires an employer that introduces monitoring of employees for a serious reason arising from the specific nature of its activities, such as tracking company vehicles, to inform employees directly about the scope and methods of that monitoring. The Italian case therefore translates directly to Czech companies: missing information about GPS would be a problem under both the GDPR and the Labour Code.

"He only wants it for the tribunal"

This is the objection management raises most often. The motive behind a request is, as a rule, irrelevant to how you handle it. The right of access carries no condition that the employee must not use it in a dispute with you.

In its judgment of 19 March 2026 in C-526/24 (Brillen Rottler), the Court of Justice of the EU accepted that even a first request can be excessive under Article 12(5) GDPR if it amounts to an abuse of rights. That case, however, concerned a person who systematically signed up for newsletters, filed access requests and then claimed damages. The Court stressed that the threshold is high and that the burden of proof lies with the controller. An employee who wants to see the evidence behind their dismissal does not fall into that category.

The same judgment carries the opposite warning too: an unjustified refusal of an access request can, on its own, give rise to a claim for non-material damages under Article 82 GDPR. In a dispute with an employee, an unanswered request therefore means a second claim on the table as well as the risk of a regulatory fine.

Where it breaks down inside companies

The problem is rarely bad faith. It is how the work is split:

• The request lands in the wrong place. The line manager treats it as part of the dispute and passes it to the lawyer. The lawyer is handling the dismissal, not the GDPR. The clock keeps running.
• The data sits in five systems. HR software, time and attendance, email, fleet telematics, CCTV footage, internal chat. Nobody has an overview of where an employee's data lives.
• The employee privacy notice is a template. It does not match what the company actually processes. GPS is missing, and categories nobody collects are listed.
• Nobody records how the request was handled. When the regulator asks, the company cannot show when the request arrived, who dealt with it and what the requester received.

Disclosure has two failure modes. Handing over too much, without checking whose data is in the file, is its own exposure, as we wrote in A Subpoena Is Not a Permission Slip. Data subject requests are where these gaps surface fastest, because they come with a fixed deadline and a specific person waiting for an answer.

How to set it up so it works

The answer is not another policy in a drawer. It is a process that holds up when HR is overloaded and management is busy with the dispute:

1. One intake point for requests. However a request arrives, it must end up in one place with a date of receipt and a deadline.
2. A map of employee data. Know which systems hold data on employees and applicants, including telematics, cameras and attendance. Without it, you will not make the one-month deadline.
3. Separate the dispute from the request. The lawyer handles the employment dispute. The GDPR request follows its own track and its own statutory deadline, whatever happens in the dispute.
4. A notice that matches reality. Check the employee privacy notice against actual processing. If you track vehicles, it must say so, and in Czechia Section 316 of the Labour Code requires you to tell employees directly.
5. Train the front line. Managers, reception, HR. People need to recognise a request even when the word GDPR never appears.
6. An evidence trail. When the request arrived, who handled it, what was sent and when. That is exactly what the regulator will ask for.

How VPoint helps

Most companies run this with a shared inbox, a spreadsheet and the memory of one person in HR. It works until that person is on holiday or three requests arrive in the same week.

In the GDPR and data protection module of the VPoint platform, you log data subject requests in one place, with statutory deadline tracking and an audit log of every step. The same place holds your records of processing activities, so when a request comes in you know which systems to search. Managers and HR can be trained through AI-generated training that you focus on exactly this: how to recognise a request and whom to pass it to. And because VPoint also covers whistleblowing, internal policies and AI governance, you do not need a separate tool for each obligation.

Summary: what to check this week

• Do you know how many requests from employees and applicants you received in the past year, and whether every one was answered within a month?
• Is it clear who receives requests and who watches the deadline, even when they arrive through a manager or an agency?
• Does your employee privacy notice match what you actually process, including GPS, cameras and attendance?
• Do you inform employees directly about monitoring, as national employment law requires (in Czechia, Section 316 of the Labour Code)?
• Can your managers recognise an access request even when the word GDPR is not in it?
• Could you show the regulator when you received a request and what you sent?

If you answer "not sure" to two or more of these, book a short demo. We will show you what request logging with deadline tracking looks like in practice, at a predictable price with no per-user fees.