OUTFITTERY GmbH
Leuschnerdamm 31
10999 Berlin
Reprimand
Your letter of 27 September 2018
Ladies and Gentlemen,
We hereby reprimand your company for a violation of the GDPR with regard to the processing of
personal data in your responsibility.
Reasons:
Our decision is based on the following considerations:
I.
We have established the following facts:
On 3 July 2018 (at 15:06), the complainant sent an e-mail to OUTFITTERY GmbH, addressed to
[email protected], requesting that OUTFITTERY GmbH no longer sends him any further e-
mails, in particular advertising e-mails, and that he requests access to and erasure of his personal
data. The complainant received further advertising e-mails from OUTFITTERY GmbH on 19 July
2018 and 3 August 2018. Information on the personal data processed and the notice of erasure were
sent to the complainant on 28 August 2018.
II.
The reprimand is based on Article 58(2)(b) of the GDPR. There has been a violation of the GDPR
in your responsibility.
Under Article 17(1)(c) 2nd Alternative GDPR, the data subject has the right to require the controller
to erase personal data relating to him or her without delay. The data controller is also obliged to
erase the personal data immediately if the data subject has objected to the processing of his/her
personal data for advertising purposes pursuant to Article 21 (2) GDPR.
By his request on 3 July 2018, the complainant stated that he was not interested in further
advertising information from OUTFITTERY GmbH. Consequently its behavior is to be understood
as advertising objection in the meaning of the art. 21 Abs. 2 GDPR. Such an advertising objection
leads to a deletion obligation according to Article 17 (1)(c) 2nd alternative GDPR. The timeframe to
be applied here is "immediately".
However, a deletion from the distribution list did not take place. OUTFITTERY GmbH did not
fulfil its obligation to delete the e-mail address for advertising purposes until 28 August 2018 and
sent further advertising e-mails to the complainant on 19 July 2018 and 3 August 2018.
If the data subject exercises the right to object in the case of direct marketing in accordance with
Art. 21 ( 2), further processing is automatically and unconditionally unlawful in accordance with
Art. 21 ( 3) GDPR when the objection is raised.
According to article 12 ( 3 ) GDPR the controller has to provide the information required according
to article 15 and/or article 17 GDPR usually immediately, in each case within one month after
receipt of the application. This period may exceptionally be extended by a further two months if this
is necessary taking into account the complexity and number of requests. However, a standard and
general extension of the period without examination of the individual case is not intended by the
GDPR. OUTFITTERY GmbH did not comply with its obligation to give access to the personal data
concerning the complainant in due time and did not provide this information before 28 August
2018.
Taking into account the specific circumstances of the case, we consider a reprimand to be
appropriate after completion of our investigation. For the first time, we have identified a violation
of the GDPR by the controller. Upon our intervention, you showed understanding and announced
that you would comply with data protection regulations and stop the reprimanded conduct.
Yours sincerely