Final decision
The Luxembourg Supervisory Authority (“CNPD”) refers to the complaint of (hereinafter
“ ”) lodged with the supervisory authority of Austria.
The initial wording of the complaint on IMI stated that:
“The complainant has terminated his contract with is a trademark of the
controller). He wanted to assert his right to erasure, but his data is still available on the web
portal. the Controller didn't answer his request within a month.”
Based on said complaint, the CNPD requested the controller (hereinafter “ ”)
to provide a response to the issue raised as per Article 58.1(a) GDPR, in particular as regards the
complainants right to erasure.
The CNPD received the requested information within the set timeframe.
Following an enquiry by the CNPD, has demonstrated that all the complainant’s data have
been erased, except from the transaction data, which must be kept ten years according to article 16
of the Luxembourg commercial code.
Thus, based on the above-mentioned explanations, the CNPD is satisfied that has fulfilled its
obligations under Regulation (EU) 2016/679 (GDPR) by immediately addressing the issue.
As the complaint has only a limited personal impact, the CNPD has consulted the Austrian SA to
determine whether the case could be dismissed. The CNPD and the Austrian SA agreed that, in
view of the above, no further action is required and that the cross-border complaint (national
reference D130.070) could be closed.
A draft decision has been submitted by the CNPD on 7 February 2020 to the other supervisory
authorities concerned as per Article 60.3 GDPR (IMI entry number 107959).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities shall be
deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission