Case No.: NAIH/2020/
Antecedent case No.: NAIH/2019/405.
In charge:
Dear Sirs,
As you have already been informed by the Nemzeti Adatvédelmi és Információszabadság Hatóság
(Hungarian National Authority for Data Protection and Freedom of Information, hereinafter: the
Authority) based on the notification of (hereinafter: the Complainant) an
investigation was launched pursuant to Article 57(1)(f) of the General Data Protection Regulation
(hereinafter: GDPR), and Section 38(3)(a) of Act CXII of 2011 on the Right to Informational Self-
Determination and the Freedom of Information (hereinafter: Privacy Act).
I. The course of the procedure
(hereinafter: the Complainant) notified the Information Commissioner’s Office of
the United Kingdom (hereinafter: ICO), complaining that he requested (which
has since been transformed into (hereinafter: the Company)) in vain to erase
the user account registered with his e-mail address as the Company failed to meet his request.
On 8 December 2018, ICO initiated a procedure to determine the lead supervisory authority and the
supervisory authorities concerned according to Article 56 of GDPR. In the course of this, it was
established that the lead supervisory authority in this case is the Authority as the decisions
concerning the purposes and instruments of processing personal data are made in Hungary within
the Company’s organisation.
To clarify the statements in the complaint, the Authority called upon the Company to make a
statement on 7 February 2019 and at the same time, notify the Complainant electronically using the
e-mail address , as well as by mail that an investigation was launched in the case.
The Company received the request of the Authority on 15 February 2019, and it requested the
Authority to extend the deadline on 17 February 2019. The Authority granted the request of the
Company and extended the deadline of responding until 12 March 2019. The statement of the
Company was received by the Authority on 13 March 2019.
Based on the statement of the Company, clarification of additional issues were deemed necessary
by the Authority, hence it called upon the Company to make additional statements in its letter of 18
June 2019,, which the Company received on 26 June 2019. The Company requested an extension
of the due date for responding by 15 days on the same day. The Authority granted the request and
specified the deadline for responding as 31 July 2019. The Company’s statement was received by
the Authority on 29 July 2019.
II. The facts of the case
In his complaint lodged with ICO, whose exact date is not known to the Authority, the Complainant
presented that he was unable to create a account with his name and e-mail address,
because his e-mail address was already in use. Earlier, his wife registered an account –
– using his e-mail address in the name of his mother-in-law when she bought a for her
from the Company.
The Complainant first requested the Company to erase the user account registered with his e-mail
address in a letter sent to the e-mail address by e-mail on
22 March 2018 as that account was not his. A customer service staff member of the Company
informed him of having indicated the problem to their IT Department and the account would be
erased within a few days; however, no measure of merit took place thereafter and the account was
not erased. In an e-mail sent to on 30 June 2018, the Complainant
indicated that the account whose erasure he had requested was still active. In an e-mail of 9 July
2018, the customer service staff member informed him that he would again take up contact with the
IT Department to erase the account. In his letter of 15 July 2018, the Complainant requested the
Company to notify him of the erasure as he would like to buy a .
On 30 July 2018, the Complainant logged in to account No. and lodged a complaint
with the Company on account of not having complied with his request to erase.
In relation to account No. , the Company processed the following data:
- e-mail address:
- name:
- address:
- phone number:
- IP address:
The account No. was erased on 25 October 2018, but as a result of an administrative
error, the Company failed to inform the Complainant of this, and he was informed of that only on
7 December 2018 after contacting the Company again on e-mail address
on account of erasing the account on 6 December 2018.
III. The findings of the Authority
III.1. Applicable legal regulations
The General Data Protection Regulation became applicable as from 25 May 2018. The Complainant
lodged his first request for erasure with the Company on 22 March 2018, hence on the basis of this
request to erase, the Authority is not entitled to adjudge the appropriateness of the measures taken
by the Company or the failure of taking measures as a lead supervisory authority according to Article
56(1) of GDPR.
The Complainant’s query of 30 June 2018 can, however, be interpreted as a repeated or maintained
request to erase, which took place after GDPR became applicable, thus the measures taken by the
Company can be evaluated according to the provisions of GDPR on that basis.
III.2. The right of the Complainant to erasure and evaluation of the request
III.2.1. The extent of the right to erasure due to the Complainant
Pursuant to Article 4(1) of GDPR personal data means any information relating to an identified or
identifiable natural person; an identifiable natural person is one, who can be identified directly or
2
indirectly in particular by reference to an identifier, such as a name, identification number, location
data, an online identifier or to one or more factors specific to that natural person.
There is no doubt that the e-mail address registered with the user account qualifies as the personal
data of the Complainant, but the additional data recorded for the account are not data that can be
related to the complainant; the Complainant is not identifiable on their basis. Therefore, the
Complainant could only have requested the erasure of his e-mail address, not that of the entire
account.
When submitting his request for erasure, the Complainant presented that it was not him who gave
his e-mail address at the time of the registration of the account, it was not him who disposed of his
personal data, i.e. his right to informational self-determination was violated already when his e-mail
address was given to the Company.
Pursuant to the Company’s Privacy Statement and their statement, the Company processes the
personal data provided in the course of the registration of the account in accordance with Article
6(1)(b) of GDPR.1 The contractual legal basis can be rightfully applied, if the data subject is party to
the contract. In relation to the registration of account No. , the Complainant was not a
party, also substantiated by the fact that he requested the erasure of the account and his e-mail
address in order to be able to register an account for himself, i.e. to enable him to enter into contract
with the Company.
The Company processed the e-mail address of the Complainant in the period from the registration
of account No. until the Complainant’s request to erase through no fault of its own and
without a legal basis, but the Company learned of the illegal data processing upon receipt of the first
request to erase from the Complainant on 22 March 2018.
Pursuant to Article 17(1)(d) of GDPR, the data subject is entitled to request from the controller
erasure of his personal data without undue delay and the controller has the obligation to erase the
personal data without undue delay when the personal data have been unlawfully processed. Hence
the Complainant had the right to request the erasure of his e-mail address from the Company.
III.2.2. Compliance with erasure requests by the Company
In spite of its promise, the Company did not take any action as a result of the Complainant’s request
of 30 June 2018, which can be taken into account in the course of the procedure as a repeated
request for erasure within one month from lodging the request. Having logged in to the user account,
the Complainant repeatedly requested the erasure of this account on 30 July 2018 presenting the
antecedents of the case. The Company finally erased the account on the basis of the request
submitted through the user account on 25 October 2018.
Consequently, the Company breached Article 12(3) of GDPR as it failed to take any action within a
month from receiving the erasure requests, and after having erased the account, it failed to notify
the Complainant of the erasure as its action taken for an additional one-and-a-half months until the
inquiry by the Complainant.
Beyond this, the Complainant’s right to erasure according to Article 17(1) of GDPR was also infringed
as the Company complied with the erasure requests only with a substantial delay even though it
1
The Authority did not examine the lawfulness of the applicability of Article 6(1)(b) of GDPR in the current procedure.
3
should have immediately erased the inaccurate personal data registered for the user account linked
to his e-mail address according to Article 5(1)(d) of GDPR.
IV. Legal consequences
The Authority establishes that the Company has breached Article 12(3) of GDPR, when it failed to
take action within a month on the basis of the Complainant’s erasure request and when it failed to
notify the Complainant of the fact of the erasure.
The Authority also establishes that the Company has breached Article 17 of GDPR as it met its
erasure obligation only with a substantial delay.
The Authority – based on the Article 58(2)(b) of GDPR – issues a reprimand to the Company for
the abovementioned infringements of GDPR.
In view, however, of the fact that the Company did erase the Complainant’s user account on 25
October 2018 and it did notify the Complainant thereof on 7 December 2018, the Authority will not
apply additional legal consequences and terminates the investigation on the basis of Article 53(5)(b)
of the Privacy Act as the circumstance giving rise to conducting the investigation no longer exists.
Budapest, 29th June 2020.
Yours sincerely,
Dr. Attila Péterfalvi
President
Honorary university
professor
4