Berlin Commissioner for
Berlin, 19 February 2020 Data Protection and
Freedom of Information
521.10846 Friedrichstr. 219
10969 Berlin
631.137
Visitors’ entrance:
IMI CR 73122 Puttkamer Str. 16-18
DD 102720
The building is fully accessible to
FD 110629 disabled members of the public.
Final Decision Contact us
Phone: +49 (0)30 13889-0
To Fax: +49 (0)30 215 50 50
Sandbox Interactive GmbH
Use our encrypted contact form
Pappelallee 78-79 for registering data protection
10437 Berlin complaints:
www.datenschutz-berlin.de/be-
schwerde.html
Reprimand For all other enquiries, please
send an e-mail to:
[email protected]
Complainant: Mr.
Your letter dated 12th March 2019 and 16th October 2019 Fingerprint of our
PGP-Key:
D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
Dear Mr. ,
Office hours
We are hereby issuing a reprimand to your company regarding a
violation of the General Data Protection Regulation (GDPR) when Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
processing personal data within your scope of responsibility. (or by appointment)
Justification: How to find us
The underground line U6 to
Our decision is based on the considerations stated below: Kochstraße / Bus number M29
and 248
I.
We have established the facts as follows: Visit our Website
https://privacy.de
On 9th April 2016, the complainant purchased the computer game ‘Al-
bion Online’ from your company, and created a user account. On 24th
January 2019 he addressed an email to you with instructions to delete
his account in full. The complainant made his request via the support
area of the account management section after logging in using his
saved registration data.
On 27th January 2019, he was asked to provide additional information,
as your company wanted to ensure that the complainant was in fact
the owner of the account.
In response to our request for your comments, you explained that a
verification of identity was required to prevent an irreparable deletion of
a player account, and that the damage would be extensive if the dele-
tion was unauthorised.
-2-
Following our statement that, under Art. 12 (6) GDPR, the controller
may only request additional information should reasonable doubt arise
regarding the identity of the natural person when asserting the rights of
the respective data subject, you deleted the complainant’s data and
notified him of this fact.
In this specific case, you provided no grounds as to why you raised
doubts regarding the complainant’s identity.
You have modified your processes for deleting player accounts ac-
cordingly.
II.
The reprimand is based on Art. 58 (2) lit. b GDPR, as an infringement
occurred against the provisions of the GDPR within your scope of re-
sponsibility.
In accordance with Art. 12 (3) sentence 1 GDPR, the controller must
inform the data subject of the measures generally taken immediately
following receipt of the request, and in any event within one month af-
ter receipt of such request pursuant to Art. 15-22 GDPR. The controller
shall therefore provide information, confirm the erasure of data or
acknowledge the objection, or at least state why this is not possible
within the time period specified. Where necessary, the deadline may
exceptionally be extended by a further two months in view of the com-
plexity and number of requests. However, the GDPR does not stipulate
an automatic or standard extension of the deadline without an exami-
nation of the specific case.
In this case, the complainant submitted a request to erase his personal
data on January 24th, 2019. On 27th January 2019 he was then asked
to provide additional information, as your company sought to ascertain
that the complainant was the owner of the account. No deletion of data
was carried out due to the request for further information to establish
the complainant’s identity.
In accordance with Art. 12 (6) GDPR, the controller may only request
additional information which is necessary to confirm the identity of the
data subject if reasonable doubts exist as to the identity of the natural
person. Here, the principle of data minimisation must be observed pur-
suant to Art. (5) 1 p. 1 lit. c GDPR.
The complainant sent the request to erase his data via the support
area of the account management section after logging in using his
saved registration data.
The request for additional data did not represent data minimisation for
identification purposes within the meaning of Art. 5 (1) p. 1 lit. c GDPR.
The request for such extensive data was unnecessary, and made it
more difficult for the data subject to exercise the right to erasure.
The response received on 1st October 2019 to the plaintiff’s request
dated 24th January 2019 to erase his data is, in our opinion, belated.
This is a violation of Art. 12 (3) GDPR and Art. 12 (6) GDPR.
-3-
In view of the specific circumstances based on the facts and having
concluded our investigation, we consider a reprimand is appropriate.
We have established a violation on your part in the first instance. In re-
sponse to our presentation of the facts, you acknowledged your ac-
tions and have stated that you will comply with the relevant data pro-
tection regulations and cease the conduct forming the subject matter of
the complaint. You have modified your deletion processes accordingly.
We are confident that you will comply with the data protection regula-
tions in future, and now consider the matter closed.
Best regards,