Tag: Lawfulness of the processing

Posted on

publishable_lu_2019-05_lawfulnessoftheprocessing_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No violation

Background information
Date of final decision: 10 May 2019

LSA: LU
CSAs: CZ, DK, ES, FR

Legal Reference: Lawfulness of the processing (Article 6), principles relating to the processing of personal data (Article 5), Security of processing (Article 32)

Decision: No violation

Key words: Lawfulness of the processing, Third party access to personal data, Rights of data subjects, Security of processing, e-commerce

Summary of the Decision
Origin of the case
The complainant states that they received a telegram sent by a third party in which their full name and address were included, as well as an order number. The third party claimed that a parcel purchased by him on the controller website had been sent to the complainant. The complainant states that their personal data may have been provided by the controller to the third party, thus violating the claimant’s rights under GDPR.

Findings
Following an inquiry by the LSA, the controller has demonstrated that it was the courier who provided the complainant’s details to the third party. The controller did not find any account on its website containing the personal details of the complainant, and there was no further evidence that the controller provided the personal data of the complainant either to the third party or to the courier.
Therefore, it seems that the personal data relating to the complainant must have already been stored by the courier and got connected (by the courier) to the order made by the third party.

Decision
The LSA did not identify any infringement of the obligations set out in Regulation (EU) 2016/679 (GDPR) by the controller. The data controller did not provide the third party with the complainant’s personal details and therefore the cross-border complaint should be closed, since no further action is required.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_lu_2019-05_lawfulnessoftheprocessing_summarypublic.pdf

Please see also EDPB Copyright page

Posted on

publishable_li_2019-08_noviolation_summarypublic_0.pdf

Summary Final Decision Art 60
Complaint

No violation

Background information
Date of final decision: 12 August 2019
LSA: LI
CSAs: DE-Brandenburg
Legal Reference: Lawfulness of the processing (Article 6), Conditions for consent (Article 7),

Principles relating to processing of personal data (Article 5)
Decision: No violation
Key words: Advertising, Lawfulness of the processing, Lack of evidence

Summary of the Decision

Origin of the case
The complainant alleged he had received unwanted advertising. After requesting access to his personal data, he received a screenshot from the controller showing the information he had allegedly shared in order to participate in an online competition. This included his address and contact details.
The complainant argued that he had in fact not participated in the online competition and did not provide his consent, so he lodged a complaint assuming that a third party entered his contact details.

Findings
The LSA sent a request for further information to the complainant, which remained unanswered.

Decision
The case was rejected as no evidence was submitted by the complainant.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_li_2019-08_noviolation_summarypublic_0.pdf

Please see also EDPB Copyright page

Posted on

publishable_fr_2019-08_lawfulness_of_the_processing_summarypublic_0.pdf

Summary Final Decision Art 60
Complaint

No violation

Background information
Date of final decision: 9 August 2019
LSA: FR
CSAs: ES, IT
Legal Reference: Lawfulness of the processing (Article 6 GDPR)

Decision: No violation
Key words: lawfulness of the processing, right to object, spam emails, unsolicited communication, rights of the data subject

Summary of the Decision

Origin of the case
The complainant alleged he faced difficulties when he tried to exercise his right to object to unsolicited marketing emails.

Findings
The LSA found that the complainant had consented to receiving marketing emails and that the controller removed the complainant’s data from their database, following the request. The controller’s reaction to the request was delayed, due to an internal dysfunction, which has since been resolved.

Decision
The LSA found no infringement.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_fr_2019-08_lawfulness_of_the_processing_summarypublic_0.pdf

Please see also EDPB Copyright page

Posted on

publishable_de_berlin_2019-04_rightoerasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprimand to controller

Background information
Date of final decision: 3 December 2018
LSA: DE – Berlin
CSAs: BE, DE-Mecklenburg-Western Pomerania
Controller: Chal-Tec GmbH
Legal Reference: Right to erasure (Article 17), Lawfulness of processing (Article 6), Transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12)

Decision: Reprimand
Key words: Right to erasure, exercise of the rights of the data subject, lawfulness of the processing, e-Commerce

Summary of the Decision
Origin of the case
The complainant created an account on the controller’s website, and the same day he asked for its deletion. Despite receiving a confirmation e-mail about the deletion, the complainant could still log in to his account. In an e-mail, the data controller told the complainant that for legal reasons the account could not be deleted, but only deactivated.

Findings
Following a request for information by the LSA, the data controller deleted the account. The improper handling of the data subject’s request was due to keeping two separate databases, each handled by a different department of the controller which had miscommunicated in this case.

Decision
The LSA decided to reprimand the data controller as the removal of the complainant’s personal data was not carried out by the time it was due, i.e. per art. 58(2)(b) GDPR.

Comments
Even though the request was submitted by the complainant prior to the entry into force of the GDPR, on 25 May 2018 the account had not been deleted yet and therefore, the LSA states that the GDPR is applicable.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_de_berlin_2019-04_rightoerasure_summarypublic.pdf

Please see also EDPB Copyright page

Posted on

publishable_de_berlin_2019-04_reprimandtocontroller_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprim and to co ntro ll erBackground information
Date of final decision: 31 October 2018
LSA: DE- Berlin
CSAs: AT, BE, DK, LU, SE, DE- Bavaria, DE-Hesse, DE-Lower Saxony, DE-Mecklenburg-Western Pomerania , DE-Saarland
Controller: Outfittery GmbH
Legal Reference: Right to erasure (Article 17), Right to object (Article 21)

Decision: Reprimand to controller
Key words: Lawfulness of the processing, Rights of data subjects, Right to erasure, advertising

Summary of the Decision
Origin of the case
The complainant sent an e-mail to the controller requesting that he no longer receives any further emails, in particular advertising e-mails, and that he requests access to and erasure of his personal data. The complainant subsequently received further advertising e-mails. Information on the personal data processed and the notice of erasure were sent to the complainant.

Findings
The LSA considered that the controller had violated art. 17(1)(c) in conjunction with art. 21(2) GDPR because according to it the data subject has the right to require the data controller to erase his personal data as well as to object to its processing for advertising purposes. The controller must comply with such a request immediately. However, the controller did not comply with the request until much later.

Decision
The LSA decided to reprimand the controller.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_de_berlin_2019-04_reprimandtocontroller_summarypublic.pdf

Please see also EDPB Copyright page