A-1080 Vienna, Wickenburggasse 8
Tel.: +43-1-52152 30258
E-Mail: [email protected]
DVR: 0000027
Ref. No. DSB-D130.081/0001-DSB/2019 clerk:
Data protection complaint (erasure)
Decision of the data protection authority
DECISION
SPEECH
The data protection authority decides on the data protection complaint of
(complainant) of 12.6.2018 against (respondent) for violation of the right to
erasure as follows:
- The complaint is dismissed.
Legal basis: § 24 para. 1 and para. 5 Data Protection Act (DSG), BGBl. I No. 165/1999 as
amended; Art. 17, Art. 60 para. 8 and Art. 77 of Regulation (EU) 2016/679 (General Data
Protection Regulation - GDPR), OJ No. L 119, 4.5.2016, p. 1.
JUSTIFICATION
A. Arguments of the parties and course of proceedings
1. By complaint of 12 June 2018, improved by submission of 27 June 2018, the complainant
alleged a violation of the right to erasure and essentially alleged that he had received e-mails
from the respondent to his e-mail address for almost two years now.
His extrajudicial and judicial injunctive relief was systematically ignored. In the legally binding
default judgment of 18 October 2017, the District Court Innere Stadt Wien had ruled that the
respondent had to refrain from sending electronic mail to the complainant for advertising
purposes in the case of any other execution. He therefore applied to the respondent for his e-
mail address to be deleted.
2. Since the matter is a cross-border one and the defendant's principal place of business or
only place of business is in the United Kingdom, the proceedings were suspended by
decision of the data protection authority of 27 September 2018, Ref. No. DSB
D130.081/0002-DSB/2018, from 30 August 2018 until it was determined which authority was
responsible for the content of the proceedings (lead supervisory authority) or until a decision
by a lead supervisory authority or the European Data Protection Committee had been issued.
3. Subsequently, the British data protection authority (ICO) declared itself to be the lead
supervisory authority and submitted the complaint to the respondent for comment.
In summary, the respondent informed the UK data protection authority that the e-mail
address used by the complainant for his application had not been
set up to receive messages. This had meanwhile been remedied. The postal address used
had been out of date, so that the respondent had not received the complainant's letters. In
the meantime, the complainant had removed the complainant from the marketing mailing list.
With this in mind, the UK data protection authority stated that the complaint would have to be
rejected because of the deletion.
4. The respondent's opinion was transmitted to the complainant during the hearing of the
parties. No opinion was received from the complainant within the time limit set.
5. With regard to the decision of the lead supervisory authority, the decision of the data
protection authority suspending the proceedings was rectified by today's decision.
B. Subject-matter of the complaint
In the present case, the question arises whether the complainant's right to erasure has been
infringed.
C. Establishment of the facts
In the past, the respondent has sent several e-mails to the complainant for advertising
purposes.
In the meantime, the respondent has removed the complainant's e-mail address from the
marketing mailing list.
Evidence assessment: The findings are based on the submissions of the parties to the
proceedings and on the contents of the file.
D. From a legal point of view, it follows:
Pursuant to Art. 17 para. 1 GDPR, a data subject has the right to obtain from the controller
the erasure of personal data concerning him or her without undue delay and the controller
shall have the obligation to erase personal data without undue delay if one of the reasons
stated in Art. 17 para. 1 GDPR applies.
As can be seen from the findings, the respondent has in the meantime fully complied with the
complainant's request and deleted the e-mail address.
The complaint therefore had to be dismissed for lack of complaint.
Pursuant to Art. 60 para. 8 GDPR, the supervisory authority with which the complaint was
filed decides if a complaint is rejected or rejected.
LEGAL NOTICE
An appeal against this decision may be lodged in writing with the Federal Administrative
Court within four weeks of notification. The complaint must be lodged with the data protection
authority and must be
- the name of the contested decision (GZ, subject)
- the name of the authority being prosecuted,
- the grounds on which the allegation of illegality is based,
- desire and
- the information necessary to assess whether the complaint has been lodged in good time,
must be included.
The data protection authority may within two months either amend its decision by means of a
preliminary decision on the complaint or submit the complaint with the files of the
proceedings to the Federal Administrative Court.
The appeal against this decision is subject to a fee. The fixed fee for a corresponding
submission including enclosures is 30 euros. The fee is to be paid into the account of the tax
office for fees, transaction taxes and gambling
, whereby the respective appeal procedure (business number of the notice) is
to be stated as the purpose of payment on the payment order.
In the case of electronic transfer of the appeal fee with the "tax office payment", the tax office
for fees, transaction taxes and gambling (IBAN as before) must be stated or selected as the
recipient. In addition, the tax number/tax account number the tax type "
, the date of the notice as the period and the amount must be stated.
The payment of the fee must be proven to the data protection authority when the complaint is
lodged by means of a original payment receipt confirmed by a postal office or a credit
institution, which must be attached to the submission. If the fee is not paid or not paid in full,
a report is sent to the competent tax office.
A timely filed and admissible appeal to the Federal Administrative Court has suspensive
effect. The suspensive effect may have been excluded in the ruling of the decision or may
have been excluded by a separate decision.
7 March 2019
For the head of the data protection authority: