Summary Final Decision Art 60
Complaint
No infringement of the GDPR
Background information
Date of final decision: 17 December 2019
LSA: UK
CSAs: AT, DE-Berlin, DE-Saarland, DE-Bavaria (Private sector), DK, ES, IT, NO, SE, SK
Legal Reference: Lawfulness of the processing (Article 6), Right to erasure (Article 17)
Decision: No infringement of the GDPR
Key words: Right of erasure, Legal obligation, Anti-Money Laundering Directive
Summary of the Decision
Origin of the case
The complainant requested to have his personal data erased, but his request was rejected.
Findings
The LSA found that the controller replied to the complainant’s erasure request within a month. In his reply, the controller explained that, in light of his legal obligation under the fourth Anti-Money Laundering Directive, he was obliged to retain the complainant’s personal data for 5 years after the end of the business relationship.
However, the LSA found that the controller did not properly inform the complainant of his right to complain to the relevant supervisory authority and his right to seek a judicial review. In fact, the LSA considered that providing a link to the privacy policy containing the contact details of the relevant supervisory authority was not enough.
Decision
The LSA asked the controller to improve the information given to all data subjects, by introducing relevant information on the data subjects’ rights to lodge complaint to an SA or seek for judicial review in the privacy policy.
—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_uk_2019-12_right_to_erasure_summarypublic.pdf
Please see also EDPB Copyright page