Final decision
The Luxembourg supervisory authority (“CNPD”) refers to the complaint of . (hereinafter
”) lodged with the supervisory authority of Austria.
The initial wording of the complaint on IMI stated that:
“The complainant tried to obtain the erasure of his but the opponent didn't
respond or reacted within a month.”
Based on said complaint, the CNPD requested the controller (hereinafter ) to provide a
detailed description of the issue relating to the processing of the complainant’s data as per Article
58.1(a) GDPR, in particular as regards the lack of reaction by the controller to the request to erasure
within one month, as well as regards the closure of the complainant’s account and the deletion of
his personal data.
The CNPD received the requested information within the set timeframe.
Following an enquiry by the CNPD, has demonstrated that:
- The reason why had not processed ’s request to close his
account connected to the e-mail address XXX1 is because contacted each
time from the e-mail address XXX2. This is not the e-mail address linked to the
account.
- service agents contacted informing him to contact them from the
e-mail address connected to his and if not possible to call their password
hotline in order to change the login details to the account. also explained
that this measure was necessary for security reasons as wanted to prevent access
from unauthorized third parties. did not call the password hotline so that the
authentication of as the owner of the account could not successfully be
completed.
Following the receipt of the letter of the CNPD, contacted under his e-mail address
XXX1 asking him to reply to the e-mail if he wished to have the account connected to the e-mail
address XXX2 closed. This email was forwarded to the CNPD.
Thus, based on the above-mentioned explanations, the CNPD did not identify any infringement of
the obligations set out in Regulation (EU) 2016/679 (GDPR) by
As the complaint has only a limited personal impact, the CNPD has consulted the Austrian SA to
determine whether the case could be dismissed. The Austrian SA informed the CNPD that the
complainant had received the answer from that he was satisfied with it and that the cross-
border complaint (national reference should be closed.
A draft decision has been submitted by the CNPD on 3 April 2019 to the other supervisory
authorities concerned as per Article 60.3 GDPR (IMI entry number .
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities shall be
deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission