BlnBDI
( ) Entwurf gefertigt (von/am) Vor Abgang z.K. ( ) Chefin ( ) AbtL
( ) Reinschrift (von/am)
( ) anonymisiert in Grundsatzvorgang abzulegen Nach Abgang z.K. ( ) Chefin ( ) AbtL
( ) Durchschrift senden an
( ) behördlichen / betrieblichen Datenschutzbeauftragten entworfen (von/am) schlussgezeichnet von
( )
( )
( ) Anlage(n) abgeschickt (von/am)
Geschäftszeichen:
Chal-Tec GmbH (bitte angeben)
521.9685.10
Wallstraße 16 IB
Abteilung:
10179 Berlin
Bearbeiter(in):
Telefon:
Durchwahl-Nr.:
Datum: December 3rd, 2018
Reprimand
Your letter of August 15th, 2018
To whom it may concern,
we hereby reprimand your company for a violation of the General Data Protection Regulation
(GDPR) in the processing of personal data in your area of responsibility.
Explanatory memorandum:
Our decision is based on the following considerations:
I.
We have established the following facts: On March 24th, 2018, the complainant opened an account
on the electronic star website, which is operated by your company. He placed an order which he
canceled on the same day. Along with the cancellation, he asked for his account to be deleted. The
cancellation and the deactivation of his account were confirmed immediately. Since the complainant
could still log in to his account after the confirmation, he asked, why his account had not been deac-
tivated against the assertion of your employees. In an e-mail on the 27th of March your customer
care explained that for legal reasons they were not able to delete the account, but could deactivate
it.
You responded to our request for information from the 10th of July 2018, by informing us, that it was
a mistake. The account of the complainant was now permanently deleted, but only after our request
for information had reached you. Before that, the complainant’s request was not handled. This is due
to the fact, that you keep two separate data bases: A customer data base, which your customer care
-2-
administers, and a customer user data base, which your in-house shop management administers.
The customer care took all necessary steps to deactivate the profile in the customer data base, but
they did not forward the request to the shop management. You therefore stated, the reply to the
complainant was unclear and by now obsolete.
II.
The reprimand is based on Article 58 paragraph 2 letter b of the GDPR. There was a violation of the
GDPR in your area of responsibility, since you deleted the complainant’s account with a delay. The
GDPR is applicable, as the account was not deleted by the 25th of May, 2018.
Personal data is to be deleted according to Article 17 paragraph 1 letter a, b, and c of the GDPR, if it
is no longer necessary for the data controllers’ purposes that it was retrieved for, the consent is with-
drawn and there are no overriding legitimate grounds for the processing. With the request for eras-
ure, the complainant expressed, that he is not interested in maintaining an account. Therefore his
data is no longer necessary to maintain a contract relationship. At the same time, his request is to be
viewed as a withdrawal of his consent. There are no overriding legitimate ground for processing his
data, as the complainant canceled his order in an early stage, so his information is not necessary for
tax reasons.
The deletion should be carried out within a month after receiving the request, about which the com-
plainant is to be informed, Article 12 paragraph 3 sentence 1 in connection with 17 GDPR. The com-
plainant requested the deletion of his account on the 24th of March, but it was only executed on the
10th of July. As data controller, you have to make sure that the rights of the people concerned are
effectively implemented. This means you must make sure that you take all necessary technical and
organizational measures as well as sufficiently informing your employees.
Taking the specific circumstances of the facts determined into account, we consider a reprimand to
be appropriate after the completion of our investigation. We have found a violation on your part for
the first time. As a reaction to our hearing, you showed understanding and announced that you
would comply with GDPR and put an end to the reprimanded conduct. You now deleted the com-
plainant’s account.
Note: If you disregard this reprimand or continue to violate the GDPR, we will consider additional
measures, such as imposing a data processing restriction, including a ban, or a fine on you. We are
also authorized to bring infringements of the GDPR to the attention of the judicial authorities and, if
necessary, to initiate legal proceedings in order to enforce the provisions of the GDPR.
This reprimand has been coordinated with the supervisory authorities of Belgium and Mecklenburg-
Western Pomerania.
With kind regards