Die Landesbeauftragte für Datenschutz
und Informationsfreiheit
Fritz-Dobisch-Straße 12 • 66111 Saarbrücken
Die Landesbeauftragte für Datenschutz und Informationsfreiheit Postfach 10 26 31 • 66026 Saarbrücken
Fritz-Dobisch-Straße 12 • 66111 Saarbrücken Telefon 0681 94781-0
Fax 0681 94781-29
E-Mail [email protected]
Internet www.datenschutz.saarland.de
www.informationsfreiheit.saarland.de
Saarbrücken, 7 March 2019
Ref. No.: B 3800/181
Contact
Supervision pursuant to § 40 German Federal Data Protection Act (BDSG) in conjunction
with Art. 57 ff General Data Protection Regulation (GDPR)
Subject: Termination of proceedings
Dear
We refer to our letter dated 26 February 2019 in which we had requested your position on the complaint
made by a , which was passed on to this office by the French data protection authority
(CNIL) on the basis of Art. 56 General Data Protection Regulation (GDPR). In his complaint, the
complainant asserted that he had asked you in two emails sent to on 25 October 2017
and 14 November 2017 respectively to delete his account on and on its servers. You
allegedly did not respond to these erase requests.
You informed us that there were indeed data of the complainant still in existence and that you had failed
to delete them, stating that the following data of the complainant were still stored: username, email
address, the point in time at which the account was created, a password hash and an anonymous session
ID to log into the website. You claimed that registering on had no longer been possible
since 2015, which is why you did not give adequate consideration to requests for support from old,
already existing users. You informed us that, subsequent to receiving the letter sent by our office, the
personal data of the complainant was immediately deleted and the complainant had also been notified
thereof. You have apparently taken organisational measures to ensure that you take note of deletion
requests promptly in the future so that they can also be processed within the statutory period permitted.
Within the scope of Art. 58 Subsection 2 of the GDPR, the supervisory authority has the power to decide
whether further measures are to be taken in a particular case (so-called discretion in decision-making). In
this case, I deem further measures by this office to be unnecessary, especially in consideration of the
information which you have provided and the willingness to cooperate expressed in this respect. You
complied with the request made by the complainant – after we had been brought it to your attention –
and deleted the data. You have also taken appropriate measures to ensure that requests relating to the
GDPR will be promptly processed in the future. Also to be taken into consideration was the fact that this
was a first infringement. Moreover, the consequences for the person concerned of the delay in processing
the deletion request were not serious as only less sensitive data of the person concerned were stored.
Finally, I would like to point out that we reserve the right to take further action if we receive additional
complaints.
Yours sincerely
pp
-2-