Final decision
The Luxembourg Supervisory Authority (“CNPD”) refers to the complaint of (hereinafter
“ ”) lodged with the supervisory authority of Germany, Rhineland-Palatinate.
The initial wording of the complaint on IMI stated that:
“The complainant had entered a contract for a credit card with the controller, but he did not accept
the release from banking secrecy in the terms of service. Since the controller has insisted on this
clause, the complainant withdrew from the contract. He now mainly wishes his data to be erased.”
Based on said complaint, the CNPD requested the controller (hereinafter
“ ”) to provide a response to the issue raised as per Article 58.1(a) GDPR, in particular as
regards the complainants right to erasure.
The CNPD received the requested information within the set timeframe.
Following an enquiry by the CNPD, has demonstrated that the complainant was
provided with all the requested information and that the contract was indeed terminated. The
controller also demonstrated that the complainant’s data has been erased, except from the
transaction data, which must be kept ten years according to article 16 of the Luxembourg
commercial code.
Thus, based on the above-mentioned explanations, the CNPD is satisfied that has
fulfilled its obligations under Regulation (EU) 2016/679 (GDPR) by immediately addressing the
issue.
As the complaint has only a limited personal impact, the CNPD has consulted the supervisory
authority of Germany, Rhineland-Palatinate to determine whether the case could be dismissed.
The CNPD and the supervisory authority of Germany, Rhineland-Palatinate agreed that, in view
of the above, no further action is required and that the cross-border complaint (national reference
4.02.18.525) could be closed.
A draft decision has been submitted by the CNPD on 7 February 2020 to the other supervisory
authorities concerned as per Article 60.3 GDPR (IMI entry number 107971).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities shall be
deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission