Accuracy – Privacy Design®

June 28, 2020June 29, 2020

publishable_uk_2019-08_right_to_object_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Failure to comply with the accuracy principle

Background information
Date of final decision: 3 August 2019

LSA: UK

CSAs: DK, FR, IT, SE

Legal Reference: Principles relating to processing of personal data (Article 5), Right to rectification (Article 16), Right to object (Article 21)

Decision: Failure to comply; no regulatory action.

Key words: Accuracy, e-commerce, individual rights

Summary of the Decision

Origin of the case
A French complainant contacted the controller three times between July and October 2018 asking for his phone number to be disassociated from another person’s account, as he had been receiving text message updates on orders he had never made.

Findings
Although the complainant’s phone number was eventually removed from the other user’s account, the UK SA found that the controller did not comply with its obligations under the GDPR as it did not take sufficient action to assure itself of the accuracy of the personal data it was processing. However,
the UK SA recognised that the controller’s standard operating policies and procedures were not followed by the staff in this case and that the controller provided assurances that it reminded its staff of the importance of adhering to such policies.

Decision
The UK SA decided not to take any regulatory action on this complaint.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_uk_2019-08_right_to_object_summarypublic.pdf

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_uk_2019-08_rightofaccess_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Failure to comply with the accuracy principle

Background information
Date of final decision: 3 August 2019

LSA: UK

CSAs: DK, FR, IT, SE

Legal Reference: Principles relating to processing of personal data (Article 5), Right to rectification (Article 16), Right to object (Article 21)

Decision: Failure to comply; No regulatory action.

Key words: Accuracy, E-commerce, Individual rights

Summary of the Decision

Findings
Although the complainant’s phone number was eventually removed from the other user’s account, the UK SA found that the controller did not comply with its obligations under the GDPR as it did not take sufficient action to assure itself of the accuracy of the personal data it was processing. However, the UK SA recognised that the controller’s standard operating policies and procedures were not followed by the staff in this case and that the controller provided assurances that it reminded its staff of the importance of adhering to such policies.

Decision
The UK SA decided not to take any regulatory action on this complaint.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_mt_2019-06_righttoerasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Compliance Order to Controller

Background information
Date of final decision: 7 June 2019

LSA: MT
CSAs: ES

Legal Reference: Right to erasure (Article 17)

Decision: Compliance order to controller

Key words: Right to erasure, Data subject rights, Accuracy

Summary of the Decision

Origin of the case
A Spanish data subject filed a complaint with the Spanish SA as she was receiving unsolicited phone calls even after having filed an erasure request and such erasure had been confirmed by the data controller.

Findings
The complainant’s phone number was fraudulently provided to the controller by one of its clients.
Since the controller was not aware of this, it tried to contact the client on such phone number. The complainant filed a right of erasure request. During a phone call, the controller erroneously informed the complainant of the need to submit a second erasure request to delete the number from another database held by the controller, whereas only one database existed. Form the call logs provided by the controller it transpires that the complainant phone number was erased from the controller’s database immediately after the first erasure request. All the erasure requests from the complainant were followed by erasure confirmations sent by the controller. The controller couldn’t exclude the possibility that the complainant’s residence’s phone number was fraudulently provided by the same client, also to other entities/lenders and that these entities/lenders may make use of it.

Decision
The LSA instructed the data controller to implement the appropriate technical and organisational measures to make sure that personal data are accurate and, where necessary, kept up to date, and that every reasonable step is taken to ensure that personal data that are inaccurate, having regards to the purposes for which they are processed, are erased or rectified without delay.