IMI Article 56 identification of LSA and CSA: 126484 18 November 2020
IMI Case Register: 154274
J.No. 2020-31-3060
Doc.no. 263702
Caseworker
Complaint about the right to erasure The Danish Data
Protection Agency
The Danish Data Protection Agency returns to the case where, on 4 March 2020, Mr. Carl Jacobsens Vej 35
(hereinafter referred to as the complainant) complained to the Danish Data Protection 2500 Valby
Denmark
Agency that Entertainment Trading ApS (hereinafter Entertainment Trading) refused to delete
T 3319 3200
his personal data. In line with Article 56 of the General Data Protection Regulation 1, the Danish 0F
[email protected]
Data Protection Agency has been designated as the leading supervisory authority of the case. datatilsynet.dk
VAT No. 11883729
1. Decision
Following a review of the case, the Danish Data Protection Agency finds that there are grounds
to criticize that Entertainment Trading’s processing of personal data about the complainant’s
customer account has not been carried out in accordance with the rules of Article 17 of the
General Data Protection Regulation.
The Danish Data Protection Agency also finds basis to order Entertainment Trading to delete
the complainant’s customer account.
The order is granted pursuant to Article 58(2)(g) of the General Data Protection Regulation.
The deadline for compliance with the order is four weeks from the date of this letter. Enter-
tainment Trading is requested to notify the Danish Data Protection Agency when erasure has
taken place.
The Data Protection Agency draws attention to the fact that, pursuant to section 41(2)(5) of
the Data Protection Act 2, failure to comply with an order issued by the Danish Data Protection
1F
Agency pursuant to Article 58(2)(g) of the Regulation is punishable.
The details of the case and the reasons for the decision of the Danish Data Protection Agency
are set out below.
1
Regulation (EU) 2016/679 Of The European Parliament And OF The Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation).
2
Act No. 502 of 23 May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data (the Data Protection Act).
2. Statement of the facts Page 2 of 5
It appears from the case that the complainant made purchases at Coolshop.dk in April 2019
and January 2020. By e-mail of 13 February 2020, the complainant requested Entertainment
Trading to delete all information about him.
The complainant informed on 4 March 2020 that it was still possible for him to log into Cool-
shop.dk.
Entertainment Trading then stated that deletion might take up to 30 days.
2.1. Entertainment Trading’s remarks
(hereinafter ) has stated on behalf of Entertainment
Trading that when a customer makes purchases at Coolshop.dk it is done via a customer
account created by the customer. To create a customer account, the customer must provide
his name, address, email address and telephone number. The purpose of collecting and stor-
ing the information is to identify the customer and enable Entertainment Trading to contact the
customer in connection with transactions on the webshop.
As far as deletion is concerned, has stated that if a customer does not make
a purchase on Coolshop.dk via his customer account for 1 year, Entertainment Trading auto-
matically deletes the customer account and the entire customer’s personal data.
However, this automatic deletion presupposes that Entertainment Trading is not obliged to
retain the personal data or maintain the customer account under other laws.
has stated that it follows from section 83(1) of the Danish Sale of Goods Act
that a consumer has a right to claim compensation for defective product for 2 years after the
goods were handed over to the buyer. Since Coolshop.dk is a webshop, customers submit
complaints via their customer page. On the customer page, the customer fills in an online form,
which is subsequently submitted to Entertainment Trading. In order for the customer to exer-
cise his right of complaint, it is therefore necessary that the customer has access to his cus-
tomer account for at least 2 years after the purchase.
This means that personal data can be deleted at the earliest after 2 years, if the customer
through his customer account has made a purchase at Coolshop.dk. At the end of the 2 years,
an automatic deletion occurs if the customer has not made use of his account within the last
year.
has also stated that in accordance with section 10 of the Danish Bookkeeping
Act the person liable for keeping books must keep bookkeeping material in a safe manner for
5 years from the end of the financial year to which the material relates. Entertainment Trading
is thus obliged to keep information about the customer’s name, address, email address and
telephone number, together with information on the items the customer has purchased for 5
years from the end of the financial year in which the purchase was made. This information is
stored in Entertainment Trading’s ERP-system and therefore does not require the customer’s
customer account to be maintained.
Once deleted, the personal data cannot be restored and the customer cannot reactivate his
account after it has been deleted.
stated that when the complainant requested deletion, Entertainment Trading
deleted all information about the complainant which Entertainment Trading is not legally
obliged to keep. Since the complainant made his last purchase in January 2020, the complain-
ant’s customer account will not be deleted until January 2022, as Entertainment Trading is
legally obliged to ensure the complainant’s right of complaint in accordance with the rules of
the Sale of Goods Act.
Bookkeeping material arising from the complainant’s purchase will be automatically deleted in Page 3 of 5
2025 and 2026 respectively.
In this connection, has stated, with reference to Article 17(3) of the General
Data Protection Regulation that the provisions referred to in the Sale of Goods Act and the
Bookkeeping Act take precedence over the rules of the General Data Protection Regulation.
further stated that Entertainment Trading replied to the complainant’s request
and that the complainant received appropriate reasons for the refusal to immediately delete all
of his personal data.
2.2. The complainant’s remarks
The complainant has stated that he is not familiar with the Danish Sale of Goods Act, but that
he is very surprised if the law requires an online user account to ensure the right of complaint.
The complainant agrees that Entertainment Trading stores information as required by law, but
he does not want Entertainment Trading to keep his online customer account active.
3. Justification for the Danish Data Protection Agency’s decision
It follows from Article 17(3)(b) of the General Data Protection Regulation that the right to have
data about oneself deleted shall not apply where processing is necessary to comply with a
legal obligation which requires processing by Union or Member State law and to which the
controller is subject.
The Danish Data Protection Agency considers that it is not necessary for the complainant to
have access to his customer account for at least 2 years after the purchase, in order for him
to exercise his right of complaint under the Sale of Goods Act and that it is therefore not nec-
essary for Entertainment Trading to comply with a legal obligation that the customer account
is not deleted for at least 2 years after the complainant’s last purchase.
The Danish Data Protection Agency finds that Entertainment Trading cannot omit to delete the
complainant’s customer account based on Article 17(3)(b) of the General Data Protection Reg-
ulation.
The Danish Data Protection Agency has thus emphasised that it is possible for the complainant
to complain about a product in a different way than through the use of an online form in the
customer account, e.g. by e-mail or by telephone.
On this ground the Danish Data Protection Agency finds that there are grounds to criticize
that Entertainment Trading’s processing of personal data about the complainant’s customer
account has not been carried out in accordance with the rules of Article 17 of the General Data
Protection Regulation.
The Danish Data Protection Agency also finds basis to order Entertainment Trading to delete
the complainant’s customer account at Coolshop.dk.
Furthermore, the Danish Data Protection Agency finds no grounds for setting aside Entertain-
ment Trading’s assessment that the company is obliged under the Bookkeeping Act and the
Sale of Goods Act to keep information about the complainant and his purchases on Cool-
shop.dk. Thus, the Danish Data Protection Agency considers that the right to erasure in Article
17(1) of the Data Protection Regulation does not apply in relation to this data, in accordance
with Article 17(3)(b), and that the Danish Data Protection Agency’s order for deletion does not
cover data subject to a legal obligation in relation to storage.
4. Final remarks Page 4 of 5
The Danish Data Protection Agency’s decision may be appealed to the courts, cf. section 63
of the Danish Constitution.
A copy of this letter is sent today to the complainant for information.
The Data Protection Agency awaits notification from Entertainment Trading. The notification
must be received within four weeks of today’s date.
Kind regards
Appendix: Legal basis
Page 5 of 5
Appendix: Legal Basis
Extracts from Regulation (EU) 2016/679 Of The European Parliament And OF The Coun-
cil of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation).
Article 17. The data subject shall have the right to obtain from the controller the erasure of
personal data concerning him or her without undue delay and the controller shall have the
obligation to erase personal data without undue delay where one of the following grounds
applies:
a) the personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to
point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal
ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no
overriding legitimate grounds for the processing, or the data subject objects to the
processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or
Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society
services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to para-
graph 1 to erase the personal data, the controller, taking account of available technology and
the cost of implementation, shall take reasonable steps, including technical measures, to in-
form controllers which are processing the personal data that the data subject has requested
the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing by Union or Member
State law to which the controller is subject or for the performance of a task carried out
in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with points (h)
and (i) of Article 9(2) as well as Article 9(3);
d) for archiving purposes in the public interest, scientific or historical research purposes
or statistical purposes in accordance with Article 89(1) in so far as the right referred
to in paragraph 1 is likely to render impossible or seriously impair the achievement of
the objectives of that processing; or
e) for the establishment, exercise or defence of legal claims.