Tag: Exercise of the rights of the data subjects

Posted on

updated_publishable_be_2019-05_rightoferasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Compliance order to controller

Background information
Date of final decision: 17 May 2019
LSA: BE
CSAs: NL, SE
Legal Reference: Right to erasure (Article 17), Transparent information, communication and modalities for the exercise of the rights of data subjects (Article 12)
Decision: Compliance order to controller
Key words: Right to erasure, Exercise of the rights of the data subjects

Summary of the Decision
Origin of the case
The complaint concerned the failure of the controller to comply with the request of a data subject concerning the exercise of his right of erasure. After two submissions of the webform in order to have his data removed, the complainant also sent e-mails with the same request on 28/06/2018.
The complainant still did not receive any reply and asserted that the controller did not respond within a month following the request.

Findings
The controller has failed to comply with the request of the data subject, thus violating its obligations under Article 12.3 GDPR. The LSA considers that the deadline to answer the request “has been exceeded at all levels”.

Decision
The LSA decided to order the controller to comply with the data subject’s request concerning the exercise of the right of erasure.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/updated_publishable_be_2019-05_rightoferasure_summarypublic.pdf

Please see also EDPB Copyright page

Posted on

publishable_mt_2019-07_rightoferasurearticle_17_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No violation

Background information
Date of final decision: 4 March 2019
LSA: MT
CSAs: IE
Legal Reference: Right to erasure (Article 17)
Decision: No violation
Key words: Right to erasure, right of access request, exercise of the rights of the data subjects

Summary of the Decision

Origin of the case
The complainant made a right to access/erasure request to the controller. The controller requested the complainant to confirm her identity but she failed to do so.
The controller has erased the complainant’s personal data accordingly to its privacy policy and taking into consideration a still existing “Compromise Agreement” between the controller and the complainant. Concerning the right of access request, the only reason why the information was not provided revolves around the complainant’s failure to verify her identity with the controller. The complainant then contended that the controller did not accede to the right of access request.

Findings
The LSA assessed that the controller satisfied the complainant’s right of erasure request to the extent permissible by the applicable laws, including but not limited to, employment legislation.

The LSA found that the controller took all the necessary steps to handle the complainant’s right of access. The only reason why the information was not provided, was due to the complainant’s failure to verify her identity with the controller (the email she was using was not known to the controller).

Decision
The LSA decided that the controller did not infringe the provisions of the GDPR, and consequently dismissed the compliant.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_mt_2019-07_rightoferasurearticle_17_summarypublic.pdf

Please see also EDPB Copyright page

Posted on

publishable_de_berlin_2019-07_rightofaccess_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprimand to controller

Background information
Date of final decision: 2 July 2019
LSA: DE-Berlin
CSAs: AT, DE-Rhineland-Palatinate, DE-Hesse, DE-Saarland, DE-North Rhine-Westphalia, FR
Controller: Billpay GmbH
Legal Reference: Right of access (Article 15), Responsibility of the controller (Article 24), Transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12)

Decision: Reprimand to controller
Key words: Right of access, Exercise of the rights of the data subjects, Reprimand, Data Subject Rights not respected

Summary of the Decision
Origin of the case
The complainant sent an e-mail to the controller, stating his current address, requesting access to his personal data in accordance with Article 15 GDPR. The controller attempted to provide the complainant with the requested information by a registered letter, but it used another postal address than the one specified by the complainant. Therefore, the letter was not delivered to the complainant.
The controller sent an e-mail to the complainant requesting his current address. As a result, the complainant was provided with the information about his personal data four months after the deadline established under Article 12 (3) GDPR.

Findings
The LSA determined that the controller infringed Article 12(3) GDPR by exceeding the deadline to answer the complainant’s access request, since it was technically possible and reasonable for the controller to send the information to the address given by the complainant, without further delay.

Decision
Taking into account the circumstances of the case and the fact that the controller, after being contacted by the LSA, showed understanding and its willingness to comply with data protection regulations, the LSA issued a reprimand based on Article 58(2)(b) GDPR for violating the complainant’s right of access under Article 15 GDPR.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_de_berlin_2019-07_rightofaccess_summarypublic.pdf

Please see also EDPB Copyright page