Final decision
The Luxembourg Supervisory Authority (“CNPD”) refers to the complaint of . (hereinafter
“ ”) lodged with the supervisory authority of Spain.
The initial wording of the complaint on IMI stated that:
“The complainant has made a request of access to , but this company has not answered to
this request. The reason for making the request is that his National Id number, his address and
even his IP have been blocked by therefore he is not able to create an user
account in order to consume the services offered by this website. He wants to know the reason, so
he asks for Access to all the data related to him in the systems.”
Based on said complaint, the CNPD requested the controller (hereinafter ) to provide a
detailed description of the issue relating to the processing of the complainant’s data as per Article
58.1(a) GDPR, in particular as regards the limitation of the complainant’s .
The CNPD received the requested information within the set timeframe.
Following an enquiry by the CNPD, has demonstrated that:
- ’s access request related to his status as a ,
which is a service owned and operated by
.
- As requested, provided with access to the data concerning him in that
capacity related to his account linked to the email address XXX, and a copy of the
data. also provided the CNPD with a copy of the communication sent to the
complainant in response to his access request.
In addition, has described the context regarding the rejections of ’s attempts to open
a account, so that the Supervisory authority/ies can gain a complete understanding of the
rationale for the subject access request:
- On 31 January 2013, opened a account on This account was
suspended on 27 November 2016 due to non-compliance with
policies for (the corresponding section of
these policies is attached as Document 2), resulting in the
. As indicated to on 29 November 2016, he was required
to appeal the decision and provide a valid plan of action in order to have the possibility to
continue using . Following the suspension of his main account,
proceeded to open multiple new accounts to bypass the suspension ,
which contravenes policies (the corresponding section of these
policies is attached as Document 3). When identified this conduct, all other
accounts opened by were closed in line with policies from the end
of November 2016 to January 2017. As tried to bypass policy
multiple times, decided not to reinstate ’s main account, as well as the new
accounts identified. Thus, as per policies, rejected ’s attempts to
open a new account.
In this case, processed the complainant’s information for fraud prevention purposes in
accordance with its privacy policy. nevertheless permitted the complainant to reopen a
account on 3 January 2019.
Thus, based on the above-mentioned explanations, the CNPD did not identify any infringement of
the obligations set out in Regulation (EU) 2016/679 (GDPR) by .
As the complaint has only a limited personal impact, the CNPD has consulted the Spanish SA to
determine whether the case could be dismissed. The CNPD and the Spanish SA agreed that, in
view of the above, no further action is required and that the cross-border complaint (national
reference 138660/2018) should be closed.
A draft decision has been submitted by the CNPD on 3 April 2019 to the other supervisory
authorities concerned as per Article 60.3 GDPR (IMI entry number .
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities shall be
deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission