June 2020 – Page 6 – Privacy Design®

June 28, 2020June 29, 2020

publishable_de_hessen_2019-09_right_of_access_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No infringement of the GDPR

Background information
Date of final decision: 12 September 2019
LSA: DE-Hessen
CSAs: CY, DK, ES, FR, SE
Legal Reference: Right of Access (Article 15), Exercise of Data Subject Rights (Article 12)

Decision: No infringement of the GDPR
Key words: Right of access, Exercise of data subject rights

Summary of the Decision

Origin of the case
The complainant alleged that he did not receive a response to his request to access a copy of his personal data, processed by the controller, within the one-month timeframe set by the GDPR.

Findings
The LSA found that at the time of the complaint, the controller was faced with an important amount of data protection related queries, justifying the need for an extension of the timeframe.
In a first reply to the request, the controller gave access only to a part of the personal data requested. The complainant reiterated the request for the remaining personal data. A second reply was sent to the complainant, which the complainant never received. Once the complaint was made to the LSA, the controller sent the letter again, which the complainant received this time. The controller also improved their internal processes for future responses to such requests.

Decision
No infringement of the GDPR was found, since appropriate action had been undertaken by the controller.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_de_hessen_2019-09_right_of_access_summarypublic.pdf

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_hessen_2019-09_right_of_access_summarypublic_0.pdf

Summary Final Decision Art 60
Complaint

No infringement of the GDPR

Background information
Date of final decision: 12 September 2019
LSA: DE-Hessen
CSAs: CY, DK, ES, FR, SE
Legal Reference: Right of Access (Article 15), Exercise of Data Subject Rights (Article 12)

Decision: No infringement of the GDPR
Key words: Right of access, Exercise of data subject rights

Summary of the Decision
Origin of the case
The complainant alleged that he did not receive a response to his request to access a copy of his personal data, processed by the controller, within the one-month timeframe set by the GDPR.

Decision
No infringement of the GDPR was found, since appropriate action had been undertaken by the controller.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de-brandenburg_2019-10_right_of_access_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No infringement of the GDPR

Background information
Date of final decision: 2 October 2019
LSA: DE-Brandenburg
CSAs: AT, BE, DE-Berlin, DE-Hesse, DE-Lower Saxony, DE-Mecklenburg-Western Pomerania, DE-North Rhine-Westphalia, DE-Saarland, DE-Thuringia, DK, ES, FR, HU, IT, LU, NO, PL

Legal Reference: Right of access (Article 15), Principles relating to processing of personal data
(Article 5)

Decision: No infringement of the GDPR
Key words: Right of Access, Legal Age, Verification Process

Summary of the Decision
Origin of the case
The complainant requested access to his personal data processed by the controller. The controller verified the data subject’s identity, and subsequently informed the complainant that his account had been suspended due to a discrepancy between the information concerning his age on his account and the information he had provided for the verification of his identity for the request.
Since he was 15 years old at the time and thus a minor, he was also asked to send parental consent, a copy of his ID card and of his birth certificate, in order to access his personal data. The complainant filed a complaint to the CSA on the basis that the information he had provided for the verification process was wrongly used to suspend his account, instead of being used for the process of giving access to personal information.

Findings
The controller underlined that at the time of the request there was no standardised process in place within the company for requests by minors, since the contractual relationship between the controller and the data subjects depends on the fact that the data subjects are adults. Quickly after the controller requested additional documentation for parental consent, this request was set aside and access to personal data was in fact given to the complainant. Finally, further measures were taken by the controller to improve the data access process.

Decision
The request for information was answered in due time and the controller’s verification process has been modified in a suitable manner. The LSA therefore found that there was no infringement of the GDPR.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de-berlin_2020-02_article_16_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Infringement of the GDPR

Background information
Date of final decision: 19 February 2020
LSA: DE-Berlin
CSAs: AT, BE, DE, ES, FR, IE, PL, PT, UK
Controller: Sandbox Interactive GmbH
Legal Reference: Transparency (Article 12), Right to erasure (Article 17)

Decision: Infringement of the GDPR, Reprimand
Key words: Right to erasure, User account, Identity

Summary of the Decision
Origin of the case
The complainant requested to have his player account deleted from the controller database of the online game he had previously bought. The controller requested additional information in order to process the erasure request, which it eventually granted nine months after the complainant’s request and after being notified by the Berlin DPA.

Findings
The LSA found that the complainant requested to have his account deleted via the support function of his account, after logging in using his registration data. Although the controller may only request additional information in case of reasonable doubt regarding the identity of the natural person, the controller, in this case, did not explain why he had doubts regarding the complainant’s identity. Hence, the request for additional data was not only unnecessary, but also made it more difficult for the complainant to exercise his right to erasure. Furthermore, the LSA found that not only the controller did not inform the complainant about whether they are processing the erasure request or if there is an extension of the deadline imposed by the GDPR, but also granted the erasure request with a significant delay after the end of the legal deadline.
Following the LSA’s inquiry, the controller modified his process for the deletion of user accounts.

Decision
The LSA found that the controller did not comply with his obligations under the GDPR and issued a reprimand.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de-berlin_2019_12_data_breach_summarypublic.pdf

Summary Final Decision Art 60
Data Breach Notification

No Infringement of the GDPR

Background information
Date of final decision: 17 December 2019
LSA: DE-Berlin
CSAs: BE, DE-Rhineland-Palatinate, DE-Saarland, DE-Lower Saxony, DK, ES, FR, HU, LU, NO, SE, SK DE-Berlin
Controller: Schwarzkopf-Stiftung Junges Europa
Legal Reference: Personal Data Breach (Articles 33 and 34)

Decision: No infringement of the GDPR
Key words: Personal data breach, Hacker attack

Summary of the Decision
Origin of the case
One of the controller’s member platforms was attacked by a malicious code, which enabled unauthorised redirect to third party websites. The controller immediately asked the processor to inactivate the platform.

Findings
The LSA found that appropriate security measures, such as the update of number of software components and the request to change users’ passwords, were taken by the controller after the incident. Additionally, specific technical and organisational measures were undertaken by the controller to remedy the data breach. Such measures included the automatic check of the content uploaded by users, as well as regular manual check of the platform activity.
The LSA found that all the security measures were appropriate. Additionally, the LSA found that a second data breach that followed did not occur because of inadequate security measures and that data breaches in the future could be avoided to a reasonable degree, based on these measures.

Decision
The LSA found that the controller complied with their obligations under the GDPR and closed the case.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de-berlin_2019-08_right_of_access_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No infringement of the GDPR

Background information
Date of final decision: 3 September 2019
LSA: DE-Berlin
CSAs: AT, BE, CY, DE-Lower Saxony, DE-Saarland, DK, ES, FI, FR, HU, IT, NO, PL, SK
Controller: MZ Denmark GmbH (Mozilla)
Legal Reference: Transparency (Article 12), Information to be provided where personal data are collected from the data subject (Article 13), Information to be provided where personal data have not been obtained from the data subject (Article 14), Right of access (Article 15)

Decision: No infringement of the GDPR
Key words: Right of access, Transparency and Information

Summary of the Decision
Origin of the case
The complainant requested to have access to his information without having to send a postal request to the controller’s address in the United States. No other contact options such as an email address or web form were listed in the controller’s privacy policy.

Findings
The controller communicated to the LSA that, due to a human error, the email address was not included in the privacy policy. This error was immediately rectified following the correspondence with the LSA. The controller also created a portal for enquiries from data subjects. A link to this portal was integrated in the privacy policy.

Decision
The LSA did not find it necessary to establish whether an infringement had taken place, as the controller had complied with his obligations under the GDPR.
Furthermore, the LSA was informed by the SA receiving the complaint that the complainant had withdrawn his complaint.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_berlin_2019-07_rightofaccess_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprimand to controller

Background information
Date of final decision: 2 July 2019
LSA: DE-Berlin
CSAs: AT, DE-Rhineland-Palatinate, DE-Hesse, DE-Saarland, DE-North Rhine-Westphalia, FR
Controller: Billpay GmbH
Legal Reference: Right of access (Article 15), Responsibility of the controller (Article 24), Transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12)

Decision: Reprimand to controller
Key words: Right of access, Exercise of the rights of the data subjects, Reprimand, Data Subject Rights not respected

Summary of the Decision
Origin of the case
The complainant sent an e-mail to the controller, stating his current address, requesting access to his personal data in accordance with Article 15 GDPR. The controller attempted to provide the complainant with the requested information by a registered letter, but it used another postal address than the one specified by the complainant. Therefore, the letter was not delivered to the complainant.
The controller sent an e-mail to the complainant requesting his current address. As a result, the complainant was provided with the information about his personal data four months after the deadline established under Article 12 (3) GDPR.

Findings
The LSA determined that the controller infringed Article 12(3) GDPR by exceeding the deadline to answer the complainant’s access request, since it was technically possible and reasonable for the controller to send the information to the address given by the complainant, without further delay.

Decision
Taking into account the circumstances of the case and the fact that the controller, after being contacted by the LSA, showed understanding and its willingness to comply with data protection regulations, the LSA issued a reprimand based on Article 58(2)(b) GDPR for violating the complainant’s right of access under Article 15 GDPR.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_berlin_2019-05_databreach_summarypublic_0.pdf

Summary Final Decision Art 60
Data Breach Notification

No violation

Background information
Date of final decision: 3 April 2019
LSA: DE-Berlin
CSAs: DE-Lower Saxony, UK
Controller: AWIN AG
Legal Reference: Notification of a personal data breach to the supervisory authority (Article 33), Communication of a personal data breach to the data subject (Article 34)

Decision: No violation
Key words: Data breach

Summary of the Decision
Origin of the case
The controller reported a data breach to the LSA after some laptops were stolen. The laptops contained personal data of business partners, but the majority of the laptops had encrypted hard disks.

Findings
Only 4 laptops could have included personal data, 3 of which were located in Germany and one in the UK. The controller posted breach notifications online following the recommendations by the LSA as per Article 34(3)(c) GDPR.

Decision
The case was closed as the controller followed the recommendations of the LSA.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_berlin_2019-04_rightoerasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprimand to controller

Background information
Date of final decision: 3 December 2018
LSA: DE – Berlin
CSAs: BE, DE-Mecklenburg-Western Pomerania
Controller: Chal-Tec GmbH
Legal Reference: Right to erasure (Article 17), Lawfulness of processing (Article 6), Transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12)

Decision: Reprimand
Key words: Right to erasure, exercise of the rights of the data subject, lawfulness of the processing, e-Commerce

Summary of the Decision
Origin of the case
The complainant created an account on the controller’s website, and the same day he asked for its deletion. Despite receiving a confirmation e-mail about the deletion, the complainant could still log in to his account. In an e-mail, the data controller told the complainant that for legal reasons the account could not be deleted, but only deactivated.

Findings
Following a request for information by the LSA, the data controller deleted the account. The improper handling of the data subject’s request was due to keeping two separate databases, each handled by a different department of the controller which had miscommunicated in this case.

Decision
The LSA decided to reprimand the data controller as the removal of the complainant’s personal data was not carried out by the time it was due, i.e. per art. 58(2)(b) GDPR.

Comments
Even though the request was submitted by the complainant prior to the entry into force of the GDPR, on 25 May 2018 the account had not been deleted yet and therefore, the LSA states that the GDPR is applicable.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_berlin_2019-04_reprimandtocontroller_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprim and to co ntro ll erBackground information
Date of final decision: 31 October 2018
LSA: DE- Berlin
CSAs: AT, BE, DK, LU, SE, DE- Bavaria, DE-Hesse, DE-Lower Saxony, DE-Mecklenburg-Western Pomerania , DE-Saarland
Controller: Outfittery GmbH
Legal Reference: Right to erasure (Article 17), Right to object (Article 21)

Decision: Reprimand to controller
Key words: Lawfulness of the processing, Rights of data subjects, Right to erasure, advertising

Summary of the Decision
Origin of the case
The complainant sent an e-mail to the controller requesting that he no longer receives any further emails, in particular advertising e-mails, and that he requests access to and erasure of his personal data. The complainant subsequently received further advertising e-mails. Information on the personal data processed and the notice of erasure were sent to the complainant.

Findings
The LSA considered that the controller had violated art. 17(1)(c) in conjunction with art. 21(2) GDPR because according to it the data subject has the right to require the data controller to erase his personal data as well as to object to its processing for advertising purposes. The controller must comply with such a request immediately. However, the controller did not comply with the request until much later.

Decision
The LSA decided to reprimand the controller.