June 2020 – Page 7 – Privacy Design®

June 28, 2020June 29, 2020

publishable_de_berlin_2019-01_databreach_summarypublic.pdf

Summary Final Decision Art 60
Data breach notification

No violation

Background information
Date of final decision: 25 January 2019
LSA: DE (Berlin)
CSAs: AT, DE (Lower Saxony), FI, FR, IT, SE, NO
Controller: Delivery Hero SE
Legal Reference: Personal data breach (Articles 33 and 34), Security of processing (Article 32

Decision: No infringement
Key words: Data Breach Notification

Summary of the Decision
Origin of the case
The controller was informed about a flaw in their service for exporting a user’s personal data. This flaw allowed a specific user to export the data of some additional users (30) of in total seven member states. To prevent further data leakage, the function for exporting a user’s personal data was temporarily disabled until the problem could be fixed. The controller notified the SA of the data breach within due time.

Findings
The controller provided all the required information and acted promptly. Following a general recommendation given by the LSA, contained in an automatic reply after receiving a breach notification, the affected data subjects were notified despite the initial reasoning provided by the controller where it deemed that the requirements of Art. 34.1 GDPR are not met.

Decision
Taking into account that only one data recipient received the data and that the breach was properly notified, the case was closed without any corrective measures being imposed on the controller.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_de_berlin_2019-01_databreach_summarypublic.pdf

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_baden-wurttemberg_2020-01_right_to_erasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No infringement of the GDPR

Background information
Date of final decision: 24 September 2019
LSA: DE -Baden-Wuerttemberg
CSAs: All SAs
Legal Reference: Transparency (Article 12), Right to erasure (Article 17)

Decision: No infringement of the GDPR
Key words: Exercise of data subjects rights, Erasure request

Summary of the Decision
Origin of the case
The complainant alleged that the controller did not comply with her erasure request.

Findings
The LSA found that the controller deleted the complainant’s personal data. However, the controller did not do so within the timeframe provided by the GDPR. In its reply to the LSA, the controller described the measures taken to avoid delays in the future.

Decision
The LSA found that the controller complied with its obligations under the GDPR and closed the case.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_baden-wurttemberg_2020-01_personal_data_breach_summarypublic.pdf

Summary Final Decision Art 60
Data Breach Notification

No infringement of the GDPR

Background information
Date of final decision: 27 January 2020
LSA: DE-Baden-Wuerttemberg
CSAs: All SAs
Legal Reference: Personal data breach (Articles 33 and 34)

Decision: No infringement of the GDPR
Key words: Personal data breach, Phishing emails

Summary of the Decision
Origin of the case
The controller stated that a phishing attack had been launched on their central servers. The email address of a subsidiary’s manager had been compromised and used to send phishing emails to employees and clients.

Findings
The LSA found that the controller had carried out an investigation and a risk assessment of the breach, before communicating it to the LSA within 72 hours of becoming aware of it, as well as to the data subjects. Further, the password of the affected account was immediately changed. They also stated that the employees had been informed about the phishing attempt.

Decision
The LSA found that the controller complied with its obligations under the GDPR and closed the case.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cz_2019-10_lawfulness_of_processing_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Compliance order

Background information
Date of final decision: 7 October 2019
LSA: CZ
CSAs: AT, DE-All, HR, SI, SK
Legal Reference: Lawfulness of the processing (Article 6)

Decision: Order to the controller, Infringement of the GDPR
Key words: Lawfulness of processing, Legitimate interest, Data subject rights

Summary of the Decision

Origin of the case
The data subjects filed a complaint with one of the CSAs alleging that the controller published his personal data on its social media page without a legal basis.

Findings
The controller published on its social media page information concerning the complainant and other data subjects, referring to debts which the controller was in charge of collecting. The abbreviated first name and the entire surname of the data subjects, as well as the status of debtor and the amount owed by them were specified. Through a balancing test between the data subjects’ interests and basic rights with the controller’s interests, it was concluded that the controller did not rely on any lawful basis pursuant to Art. 6 GDPR. More specifically, the data subject had not expressed his/her consent; moreover, in the balancing between the legitimate interest pursued by the controller and the interests and rights of the data subject, the latter prevailed, given the significant risk of adverse impact arising
from the publication of negative information about the data subjects’ financial situation.

Decision
The LSA ordered the controller to cease processing the complainant’s personal data and to remove the published personal data within ten business days of the decision. The LSA also ordered the controller to submit a report to LSA on the implementation of the order within five business days of its completion.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cz_2019-08_databreach_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprimand to controller

Background information
Date of final decision: 26 August 2019
LSA: CZ
CSAs: All SAs
Legal Reference: Security of processing (Article 32), Notification of a personal data breach to the supervisory authority (Article 33)

Decision: Reprimand to controller
Key words: Data breach, Request for compliance, Mitigating circumstances

Summary of the Decision

Origin of the case
The complainant, a website’s user, alleged that access to their personal information had been disclosed to another user.

Findings
The LSA found that there had been a data breach because a customer support officer accidentally copied the link to a complainant’s reservation and sent it to another customer. The controller therefore infringed the obligation to adopt appropriate security measures under art. 32 GDPR as well as the obligations set out by art. 33 GDPR in connection with data breaches. This incident had not been reported by the customer support officer in charge, contrary to the website owner’s internal regulations.
After the controller received the LSA’s communication, they investigated the incident and began adapting their technical and organisational measures in place and making new ones.

Decision
Also on the basis of the objections received, the LSA decided that although there had been an infringement by the controller of Articles 32 and 33, the imposition of a fine would not have been reasonable, given the mitigating circumstances, especially in connection to the fact that the isolated incident occurred as a result of a particular employee’s misconduct rather than of systemic non-compliance. Therefore, no sanctions were imposed, but a request for compliance and reprimand regarding infringement was sent to the controller.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cz_2019-07_lawfulnessoftheprocessing_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Violation of Article 24(1)

Background information
Date of final decision: 11 July 2019
LSA: CZ
CSAs: All
Legal Reference: Principles relating to processing of personal data (Article 5); Lawfulness of the processing (Article 6); Responsibility of the controller (Article 24)

Decision: Violation
Key words: Concept of personal data, Accountability, Consumers

Summary of the Decision

Origin of the case
A complaint was filed with the Dutch SA concerning the processing of personal data of the users of the antivirus software provided by the controller, and specifically the protection granted to users of the free version of the software compared to that granted to the paying users.

Findings
In its inspection report, the LSA concluded that the inspected party failed to comply with Articles 5(2) and 24(1) GDPR, which was interpreted as the obligation to take into account all relevant circumstances surrounding the processing and to adopt a set of measures to ensure that all personal data processing is carried out exclusively under pre-defined conditions that the controller is able to regularly check and enforce. This stemmed from the conclusion that the inspected party, despite its assertions to the contrary, was indeed processing personal data (e.g. IP addresses), based on the Court of Justice case law, and was acting as a data controller.
The controller filed several objections to the inspection report, arguing inter alia that no processing of personal data was involved, that it was not to be universally considered as a data controller, and that sufficient information to properly show compliance with Articles 5(2) and 24(1) GDPR was provided.
The last objection was partially accommodated by the LSA, which concluded that only an infringement of Article 24(1) GDPR had been ascertained, whereas no specific breach of Article 5(2) followed from the documentation.

Decision
The controller was found to have violated Article 24(1) GDPR.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cy_2020-01_right_of_access_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Infringement of the GDPR

Background information
Date of final decision: 22 January 2020
LSA: CY
CSAs: DE-Berlin, DK, ES, FR, PL, UK
Controller: Royal Forex Limited (GMO Trading)
Legal Reference: Transparency (Article 12), Right of access (Article 15)

Decision: Infringement of the GDPR, Order to comply
Key words: Access request

Summary of the Decision

Origin of the case
The complainant requested to have access to any copy of letters, emails, telephone or text messages she and the controller exchanged. After having receiving no reply, she sent a reminder to the controller. As the controller did not acknowledge this reminder, she lodged a complaint to one ofthe CSAs.

Findings
The LSA found that the controller complied with the complainant’s access request only after a year since the request has been lodged. The controller’s failure to provide any information on the actions taken within the timeframe provided by the GDPR was due to the misplacement of the complainants’ file during the handover of open GDPR related enquiries. Moreover, the controller had to communicate with external advisors regarding the possible interference of the access request with third party data protection rights, thus delaying further any action.

Decision
The LSA found that the controller did not comply with its obligations under the GDPR and instructed it to adopt appropriate technical and organisational measures to comply with Article 12 GDPR and respond to all data subjects’ requests within the timeframe provided for by this Article.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cy_2019-11_right_of_access_and_right_to_erasure_not_granted_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Compliance order

Background information
Date of final decision: 12 November 2019
LSA: CY
CSAs: DE-Lower Saxony, DE-Rhineland Palatinate, ES, FR, HU, NO
Controller: Marikit Holdings Ltd.
Legal Reference: Right to erasure (Article 17), Information to be provided to the data subject (Articles 13 and 14)

Decision: Compliance order
Key words: Right to erasure, Compliance with legal obligations, Data subject rights

Summary of the Decision
Origin of the case
The complainant alleged that after opening an account on the controller’s website to participate in a competition, he was not given the possibility to exercise his right to erasure and delete his account.
When the complainant contacted the controller to request the erasure of his account, the controller initially replied that deletion was not possible, proposing to block the account for one year instead.

Findings
In its initial reply to the LSA, the controller alleged that the data subject could not be identified as s/he did not provide the relevant email address. Subsequently, the controller informed the LSA that it would retain the data until it would be reasonably sure that such data would not need to be produced as supporting evidence before regulatory bodies, which could request data for a wide range of purposes. The erasure request was eventually granted after verification that deleting the complainant’s personal data would not lead to an infringement of other legal obligations.

In addition, the LSA found that the information provided to the data subjects in the privacy policy was
insufficient to facilitate the exercise of their rights.

Decision
Since the controller reacted to the erasure request within the timeframe provided in the GDPR and eventually granted it, the LSA found that no corrective measures should be imposed.

Nevertheless, the LSA ordered the controller to revise their privacy policy accordingly and to inform
the LSA of the revision.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cy_2019-10_right_to_erasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No infringement of the GDPR

Background information
Date of final decision: 10 October 2019
LSA: CY
CSAs: DE-Hamburg
Controller: Seachefs Cruises Ltd
Legal Reference: Right to erasure (Article 17), Lawfulness of processing (Article 6)
Decision: No infringement of the GDPR
Key words: Right to erasure, Data retention, Legal claims, Compliance with a legal obligation

Summary of the Decision
Origin of the case
The complainant submitted an erasure request to the controller, who was his previous employer. The HR department of the controller replied that some of his data (e.g. his passport information, employment contract, salary information and dismissal records) were to be kept in order to comply with national law obligations and be able to exercise or defend legal claims. As a result, the complainant lodged a complaint requesting the deletion of all his data.

Findings
The LSA found that, pursuant to the applicable national social insurance and tax law, the controller was required to keep records of all expenses including salaries. In order to comply with this obligation, the controller was obliged to keep the complainant’s passport information, employment contract and salary information. Moreover, according to the national law on statute of limitations, the controller was allowed to keep the complainant’s dismissal records for a period of six years after the dismissal as the complainant could appeal the decision of the controller to the relevant court.

Decision
The LSA found no infringement of the GDPR made by the controller.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cy_2019-10_erasure_request_ignored_summarypublic_0.pdf

Summary Final Decision Art 60
Complaint

No infringement of the GDPR

Background information
Date of final decision: 10 October 2019
LSA: CY
CSAs: DE, DK, ES, FR, HU, IT, LT, SK, NO
Controller: Hostinger International Ltd
Legal Reference: Right of access (Article 15), Right to erasure (Article 17), Right to object (Article 21)

Decision: No infringement of the GDPR
Key words: Right to erasure, Right to object, Data subject request, Advertising and marketing purposes

Summary of the Decision
Origin of the case
Two complainants lodged complaints with two CSAs regarding the controller’s failure to comply with their requests. The first complainant demanded that his email and other account data would no longer be processed for advertising and marketing purposes. The second complainant aimed at exercising his right of access.

Findings
Through several investigations, the LSA found that the controller never received the data subject requests. However, following the interaction with the LSA, the controller fully complied with the complainants’ requests.

Decision
The LSA found that the controller ultimately complied with his obligations under the GDPR. No further action towards the controller was taken.