1(3)
Mag Interactive AB
Organisation number 556804-3524
Drottninggatan 95A
113 60 Stockholm
Our ref.:
DI-2020-10538, IMI no. 120399
Supervision under the General Data
Date:
Protection Regulation - Mag Interactive AB
2021-01-22
Final decision of the Swedish Authority for
Privacy Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that MAG Interactive AB has
processed personal data in violation of Article 12.3 of the GDPR1 by not informing the
complainant without undue delay of the result of the complainant’s request of 29 May
2019 for erasure pursuant to Article 17 no earlier than 6 November 2020.
The case is closed without further action.
Description of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
MAG Interactive AB (the company) due to a complaint. The complaint has been
transferred to IMY, as lead supervisory authority for the company’s operations
pursuant to Article 56 of the General Data Protection Regulation (GDPR), from the
supervisory authority of the country where the complainant has lodged the complaint
(Austria), in accordance with the Regulation’s provisions on cooperation in cross-
border matters.
The complaint states that the company has not handled the complainant’s request for
erasure of the complainant’s personal data pursuant to Article 17 of the GDPR.
Mag Interactive AB has mainly stated the following. The company first received a
request for erasure of the complainant’s account on the company’s services on 29
November 2018 (the first request). Since the request came from an e-mail address
other than the one linked to the account, the company requested that the complainant
return with proof of their identity, which the complainant did not. On 29 May 2019, a
new request for deletion of the complainant’s account was received, but then by post
Postal address: and with the necessary evidence to confirm the complainant’s identity (the second
Box 8114 request). The company deleted the complainant’s data manually in accordance with
104 20 Stockholm the request of 15 June 2019, except for the information needed to show that the
Sweden
request had been handled. However, due to an oversight, the complaint was not
Website: informed of the outcome of the request in connection with the request being handled.
www.imy.se
E-mail:
[email protected] 1
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with respect to the processing of
Telephone: personal data and on the free flow of such data and repealing Directive 95/46/EC (General Data Protection
+46 (8) 657 61 00 Regulation).
Swedish Authority Our ref.: DI-2020-10538, IMI no. 120399 2(3)
for Privacy Protection Date: 2021-01-22
Instead, it was only discovered and done in connection with the review pursuant to this
supervisory matter, i.e., on 6 November 2020.
The investigation has been carried out in written form. In light of it being a cross-border
complaint, the Swedish Data Protection Authority has used the mechanisms for
cooperation and consistency contained in Chapter VII GDPR. The supervisory
authorities concerned have been the data protection authorities in Ireland, Norway,
France, Austria, Denmark, Poland and Germany.
Justification of the decision
Applicable provisions
According to Article 12(3) of the GDPR, the controller shall, upon request, without
undue delay and, in all circumstances, at the latest one month after receiving the
request, provide the data subject with information on the measures taken pursuant to
Article 17. If necessary, this period may be extended by an additional two months,
taking into account the complexity of the request and the number of requests received.
The controller shall notify the data subject of such an extension within one month of
receipt of the request and indicate the reasons for the delay.
According to Article 12(6), the controller may, if he or she has reasonable reason to
doubt the identity of the natural person who submits a request pursuant to Article 17,
that additional information necessary to confirm the identity of the data subject may be
provided.
According to Article 17.1 a, the data subject shall have the right to have their personal
data erased by the controller without undue delay and the controller shall be obliged to
erase personal data without undue delay if the personal data is no longer necessary
for the purposes for which they were collected or otherwise processed. According to
Article 17(3)(b), this shall not apply to the extent that the processing is necessary to
fulfil a legal obligation requiring processing under Union law.
According to Article 57(1)(f), each supervisory authority on its territory shall be
responsible for the processing of complaints from a data subject and where
appropriate to investigate the matter of the complaint.
The Swedish Authority for Privacy Protection’s assessment
Regarding the first request, IMY finds that MAG Interactive AB had reasonable reason
to doubt the identity of the complainant and thus request that the complainant submit
additional such evidence, which the complainant did not respond to. Against this
background, IMY considers that the company was not obligated to take any further
measures due to the request.
Regarding the second request, IMY notes that the Company has deleted the
complainant’s information, except the information required to show that the request
has been processed, within 16 days of the company receiving the request on 29 May
2019. IMY finds that the company has erased the complainant’s information without
undue delay in the sense referred to in Article 17 of the GDPR and has had the right to
retain the information needed to demonstrate that the request has been handled in
accordance with the GDPR.
Swedish Authority Our ref.: DI-2020-10538, IMI no. 120399 3(3)
for Privacy Protection Date: 2021-01-22
On the other hand, the company informed the complainant of the result of the second
request only on 6 November 2020. Since the controller shall, pursuant to Article 12(3)
without undue delay and, in any event, no later than one month after receiving the
request, with an exemption not relevant here, inform the data subject of the measures
taken pursuant to Article 17, MAG Interactive AB has thereby infringed that article.
The company has stated that the reason why the complainant was not informed if the
result of the request was due to an oversight. According to the company, this was
mainly due to the request being handled manually because it was received by mail and
that the company normally handles requests in a system where notifications on
measures taken are sent automatically. As a result of the incident, the company has
indicated that it will review its procedures so that it does not happen again. This
includes setting up a separate log for manual cases so that it can be ensured that all
steps are followed and that the user is notified as requested.
IMY notes that it is of course important that controllers inform data subjects of what
measures have been taken in connection with the request, even in cases where the
request is fully met to the extent required.
However, in light of the circumstances regarding the infringement that the company
has highlighted – and the measures stated by the company that it has taken and will
take – IMY considers that the subject matter in the complaint has been investigated to
the extent appropriate under Article 57(1)(f) of the GDPR.
Against this background, the matter is concluded without further action.
This decision has been made by Unit Manager after presentation
by legal advisor .
Notice. This document is an unofficial translation of the Swedish Authority for Privacy
Protections (IMY) decision 2021-01-22, no. DI-2020-10538. Only the Swedish version
of the decision is deemed authentic.