632.262.4
A56 ID 102760
Berlin Commissioner for
CR 111099 Data Protection and
DD 146580 Freedom of Information
Friedrichstr. 219
10969 Berlin
02 November 2020
Visitors’ entrance:
Puttkamer Str. 16-18
Final Decision
The building is fully accessible to
disabled members of the public.
The Berlin Commissioner for Data Protection and Freedom of Information
(Berlin DPA) issues a reprimand to Lavender Lingerie GmbH (the control- Contact us
ler) for a violation of the General Data Protection Regulation (GDPR).
Phone: +49 (0)30 13889-0
Fax: +49 (0)30 215 50 50
Use our encrypted contact form
The Berlin DPA bases the reprimand on the following considerations: for registering data protection
complaints:
www.datenschutz-berlin.de/be-
I. schwerde.html
The Berlin DPA has established the following facts: For all other enquiries, please
send an e-mail to:
[email protected]
The complainant requested the erasure of her personal data in an online
chat on 16 October 2019 and reminded the controller of her request for Fingerprint of our
PGP-Key:
erasure in an online chat on 18 November 2019. The controller submitted
to the Berlin DPA that it had deleted the complainant's data within 30 days D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
of receiving her request for erasure. The Berlin DPA considers the control-
ler‘s submission in this respect to be credible, at least on the basis of the
Office hours
documents available to the Berlin DPA. On the basis of the Berlin DPA‘s
current knowledge, there are no reasons to doubt this statement. Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
(or by appointment)
The complainant has not yet received any information about the erasure of
her data. How to find us
The underground line U6 to
II. Kochstraße / Bus number M29
In legal terms, the Berlin DPA assesses the facts of the case as follows. and 248
The controller has violated the General Data Protection Regulation.
Visit our Website
According to the first sentence of Art. 12(3) GDPR, the controller must pro- https://privacy.de
vide the data subject with information on the measures taken upon request
pursuant to Art. 15 to Art. 22 GDPR without delay, and in any event within
one month of receipt of the request. This means that the controller must
confirm the erasure or at least state why this is not possible within the
dead-line. This deadline may exceptionally be extended by a further two
months if necessary, taking into account the complexity and number of ap-
plications. However, the GDPR does not provide for a routine and blanket
extension of the deadline without examining the individual case. Nor has
the controller informed the complainant of any extension of the deadline
and the reasons for it.
Although the controller has complied with the complainant's request for
erasure within the time limit, the controller has not informed the complain-
ant of the erasure of her data.
-2-
This constitutes an infringement of Art. 12(3) GDPR.
III.
As a result, the Berlin DPA does not take any further supervisory measures
as a result of the infringement, but leaves it at a reprimand.
The reprimand is based on Art. 58(2)(b) GDPR.
Taking into account the specific circumstances of the case under investiga-
tion, the Berlin DPA considers a reprimand to be appropriate after comple-
tion of the investigation. This is the first time the Berlin DPA has established
a violation on the controller‘s part. In response to the Berlin DPA‘s address-
ing the issue at hand, the controller showed understanding, reviewed its
processes again and announced that it would comply with data protection
regulations and stop the conduct for which it had been reprimanded.
However, the Berlin DPA has to point out the fact that the controller‘s obli-
gation to inform the complainant about the erasure of her data pursuant to
Art. 17(1) GDPR has not yet been fulfilled and continues to exist.
In the safe expectation that, after being notified by this reprimand, the con-
troller will notify the complainant of the erasure of her personal data and will
comply with the data protection regulations in the future, the Berlin DPA
closes this case after issuing the reprimand.