Lidl Fined for GDPR Obstruction: Why Your Internal Forms Can't Trump Data Access Rights

When 'Just Fill Out This Form' Becomes a GDPR Violation

If you think a well-designed internal procedure can shield you from GDPR liability, think again. The Italian Data Protection Authority (Garante) recently fined Lidl Italia for obstructing an employee's right to access personal data—specifically, video surveillance footage. The case is a stark reminder that no amount of paperwork can override the fundamental rights granted by Article 15 of the GDPR.

Featured Snippet Bait: Can an employer require a specific form to process a GDPR access request? No. The Lidl case confirms that internal procedures cannot limit or delay the exercise of data subject rights. Any form or process that creates an obstacle is itself a violation.

The Case: What Lidl Did Wrong

An employee requested access to video surveillance recordings that captured their image. Lidl responded by asking the employee to fill out a specific internal form and provide additional details. The Garante ruled that this constituted an obstacle to the exercise of the right of access, as the GDPR does not require any particular format for such requests.

Think of it like this: if a customer wants to return a defective product, you can't demand they fill out a three-page form in triplicate just to get a refund. The same logic applies to data access requests—simplicity is key.

Key Takeaways for Businesses

1. No Formalities Required

The GDPR does not mandate a specific form or channel for access requests. Any communication—email, verbal, or even a handwritten note—is valid. Requiring a particular form can be seen as an obstacle.

2. Video Surveillance Is Not Exempt

Many companies mistakenly believe that video footage is somehow outside the scope of GDPR access rights. It's not. If the footage contains personal data (e.g., an identifiable person), the data subject has a right to access it, subject to limitations like the rights of others.

3. Act Promptly and Transparently

The GDPR requires responses to access requests without undue delay, and at the latest within one month. Lidl's delay in providing the footage—partly due to its internal form requirement—was a factor in the fine.

Practical Steps to Avoid a Similar Fate

• Review your internal procedures for handling data subject requests. Remove any unnecessary steps or documentation requirements.
• Train your staff to recognize and process access requests from any channel.
• For video surveillance, establish a clear process for retrieving and redacting footage to protect third-party privacy.
• Document your response times and reasons for any delays.

For more details, refer to the GDPR text on EUR-Lex.

FAQ