Reprimand
Your letter of 16 July 2018
Ladies and gentlemen,
We hereby reprimand your company for a violation of the General Data Protection Regulation
(GDPR) in the processing of personal data in your area of responsibility.
Reason:
Our decision is based on the following considerations:
I.
We have established the following facts:
On 11 January 2018, the above-mentioned complainant requested that their personal data may be
deleted by sending an e-mail to [email protected] This deletion was confirmed on 15 January 2018.
Nevertheless, he/she received e-mails from Just Fabulous GmbH on 1 June 2018 ("Updating our data
protection guidelines") and 16 June 2018 ("Your feedback is important to us").
The complainant has submitted proof of this correspondence and the e-mails to us. We will enclose
this as proof to this letter.
II.
The reprimand is based on Art. 58 para. 2 letter b of the GDPR. There was a violation of the GDPR in
your area of responsibility.
According to Article 17, paragraph 1, letter a of the GDPR, the person concerned has the right to
demand that the controller delete personal data concerning him or her without delay. The data
controller is obliged to delete the personal data without undue delay if the personal data are no
longer necessary for the purposes for which they were collected or processed.
By the request for deletion on 11 January 2018, the above-mentioned complainant expressed that
he/she is not interested in a further business relationship with Just Fabulous GmbH. The further
storage of their data is therefore no longer necessary for the fulfilment of the business purpose, i.e.
the fulfilment of the contractual relationship with Just Fabulous GmbH.
Although Just Fabulous GmbH confirmed the deletion on 15 January 2018, Just Fabulous GmbH did
not fulfil its obligation under Article 17 para. 1 letter a GDPR and sent the complainant new e-mails
on 1 June 2018 and 16 June 2018. Just Fabulous GmbH does not fulfil its obligation to delete personal
data.
Taking into account the specific circumstances of the facts determined, we consider a reprimand to
be appropriate after completion of our investigation. We have found a violation on your part for the
first time. As a reaction to our hearing, you showed understanding and announced that you would
comply with GDPR and put an end to the reprimanded conduct.
Note: If you disregard this reprimand or continue to violate the GDPR, we will consider additional
measures, such as imposing a data processing restriction, including a ban, or a fine on you. We are
also authorised to bring infringements of the GDPR to the attention of the judicial authorities and, if
necessary, to initiate legal proceedings in order to enforce the provisions of the GDPR.
This reprimand has been coordinated with the supervisory authorities of Austria, Denmark, France,
Spain, Sweden as well as the German supervisory authorities Bayern, Hessen, Niedersachsen and
Saarland.
With kind regards