Ryanair DAC

Summary of opinions received from “supervisory authorities concerned” 23. The DPC received formal relevant and reasoned objections in relation to the draft decision, pursuant to Article 60(4) of the GDPR, from three supervisory authorities concerned; • Berliner Beaftragte für Datenschutz und Informationsfreiheit (Berlin DPA); • Comissão Nacional de Protecção de Dados (Portuguese DPA); and • the Office of Personal Data Protection (UODO) of Poland. 24. The DPC also received a number of opinions, which were not expressed as formal objections, in relation to the draft decision from five other supervisory authorities concerned; • Garante Per La Protezione Dei Dati Personali (the Italian DPA); • Nemzeti Adatvédelmi és Információszabadság Hatóság (the Hungarian DPA); • Datatilsynet (Danish DPA); • Autorité de Protection de Données (Belgian DPA); and • Autoriteit Persoonsgegevens (Dutch DPA). 25. In its relevant and reasoned objection the Berlin DPA opined that the DPC’s draft decision failed to make a substantive assessment of what it considered to be additional infringements by Ryanair DAC of Article 32(1) and Article 32(4) of the GDPR. The Berlin DPA stated that, due to Ryanair DAC’s insufficient technical, organisational and human resource measures to ensure the security of data processing, the information provided to the complainant was incomplete. 26. In its opinion, the Italian DPA stated that the human error that led to the failure to reply to the subject access request within the statutory timeframe clearly shows that organisational and technical issues existed internally, such as to give rise to an accountability issue under Article 24(1). 27.