idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONERS
Information and Data Protection Commissioner
vs
# COMPLAINT
Reference is made to the complaint (registered internally with file number CDP/IMI/LSA/4/2019) received from the Data Protection Commission of Ireland concerning ("the complainant") who is alleging that "the controller" or "the Bank") breached her data protection rights, as enshrined under the General Data Protection Regulation – Regulation (EU) 2016/679 ("GDPR" or "the Regulation). The complainant contended that the controller did not accede to the right of access request made to the personal data processed about her and also that the exercise of her right of erasure was not entirely satisfied.
# INVESTIGATION
As part of the investigation process, through an email dated 20th December 2018, the Commissioner requested the controller to put forward its submissions on the allegation raised by the complainant. Submissions were received on the 21st of December 2018 and included the following principal arguments:
- the right of access and right of erasure requests were first received by the controller on 23rd September, 2018. On the 24th of September, "[redacted]" acknowledged the complainant's request and informed her that "there may be the need to undergo an identification process". This process was required since [redacted] first communication with the Bank was made by using an email address that does not pertain to the data controller. The controller made several attempts to verify the complainant's identity by sending her five (5) emails, between the 22nd of October and the 20th December 2018, but no reply was forthcoming. It is to be noted that [redacted] last communication with the Bank was on 2nd October 2018. All the personal data concerning the complainant being processed by the controller, including copies of the relevant documents, are ready to be sent to [redacted] once the Bank is able to verify her identity;
- through an email dated 12th December 2018, the controller gave the complainant different options to confirm her identity as follows: a telephone number, a valid identification card to be sent by email, a skype call.
Always House, Second Floor
High Street, Sliema SLM 1549
MALTA.
(+356) 2328 7100
www.idpc.org.mt
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
- there is a “Compromise Agreement” between [REDACTED] and the complainant which is and will remain valid when taking into account that it contains ongoing and biding obligations between the parties;
- the controller complied with the right of erasure request to the extent allowed by the above-mentioned “Compromise Agreement” and as per [REDACTED] data retention policy;
- the complainant’s HR file has been segregated with access to key persons only.
# DECISION
On the basis of the foregoing and when taking into consideration:
- that, in terms of Recital 64 of the GDPR, “the controller should use all the reasonable measures to verify the identity of a data subject who submits a right of access request;
- that the Bank took all the necessary steps to handle the complainant’s right of access and the only reason why the information was not provided to [REDACTED] evolves around her failure to verify with the Bank her identity, given that she was using an email address that was not known to the Bank;
- that, Article 17.3 of the GDPR provides for the non-applicability of the data subject’s right to have personal data concerning him or her erased by the controller, in particular, when the processing is necessary for compliance with a legal obligation to which the controller is subject;
- that the Bank satisfied the complainant’s right of erasure request to the extent permissible by the applicable laws, including but not limited to, employment legislation;
The Commissioner hereby decides that the controller did not infringe the provisions of the Regulation and, consequently the complaint is dismissed.
A copy of this decision is also being sent the Data Protection Commission of Ireland.
Information and Data Protection Commissioner
Today, the 4th day of March, 2019