521.12076 Berlin Commissioner for
631.271 Data Protection and
Freedom of Information
CR 52519
DD 163890 Friedrichstr. 219
10969 Berlin
RDD 173453
FD 177476 Visitors’ entrance:
Puttkamer Str. 16-18
The building is fully accessible to
disabled members of the public.
Final Decision
Contact us
OUTFITTERY GmbH
Phone: +49 (0)30 13889-0
Management Board Fax: +49 (0)30 215 50 50
Ms [redacted]
Use our encrypted contact form
Leuschnerdamm 31 for registering data protection
10999 Berlin complaints:
www.datenschutz-berlin.de/be-
schwerde.html
For your information: For all other enquiries, please
ISiCO Datenschutz GmbH send an e-mail to:
[email protected]
Ms [redacted]
Am Hamburger Bahnhof 4 Fingerprint of our
PGP-Key:
10557 Berlin
D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
Reprimand
Complainant: [redacted]
Office hours
Your letters of 09 April 2020 and 23 June 2020 (Your ref IS-0472-10) Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
(or by appointment)
Dear Ms [redacted],
How to find us
We hereby issue a reprimand to your company for a violation of the
The underground line U6 to
General Data Protection Regulation (GDPR) Kochstraße / Bus number M29
and 248
This decision is based on the following considerations
Visit our Website
I. https://privacy.de
The Berlin DPA has established the following facts:
By e-mail dated 23 September 2019, Curated Shopping GmbH, with the
address [email protected], informed the above-mentioned complainant
about the merger with Outfittery GmbH, which was entered in the commer-
cial register on 27 June 2019, and the transfer of his data to Outfittery
GmbH's system, unless he objected within two weeks of receipt of the noti-
fication. In an e-mail dated 30 September 2019 sent to
[email protected], the complainant requested the erasure of his data.
On 10 October 2019, you informed the complainant of the successful crea-
tion of his profile by e-mail. On the same day, the complainant sent you an-
other e-mail reminding you of his objection to the transfer of his data. On 21
October 2019, you sent the complainant an advertising e-mail from the ad-
dress [email protected].
-2-
In your comments of 9 April 2020 and 23 June 2020, you acknowledged
that, due to an error on the part of the member of staff responsible, you had
incorrectly not included the complainant's request for erasure of 30 Sep-
tember 2019 in the objection process and that you had deleted his data on
22 October 2019.
II.
Legally, we assess the facts of the case as follows. Outfittery GmbH has in-
fringed the GDPR.
According to Article 5(1)(a) GDPR, personal data must be processed in a
lawful manner. For processing to be lawful, Article 6(1) sentence 1 GDPR
prescribes that personal data must be processed either with the effective
consent of the data subject or on the basis of a legal authorisation.
In his request for erasure according to Art. 17(1) GDPR dated 30 Septem-
ber 2019, which is considered to be an objection to the transfer of his data
to Outfittery GmbH's systems, the complainant has expressed that he is not
interested in continuing the customer relationship with Outfittery GmbH.
Further processing of his data for Outfittery GmbH's business purposes
was therefore no longer necessary.
Due to an internal employee error at Outfittery GmbH, the complainants’
objection to the data transfer was not taken into account. Rather, the com-
plainant's data was re-used on 10 October 2019 by creating a profile in
Outfittery GmbH's systems, the subsequent information about it and the
subsequent sending of an advertising e-mail to the complainant on 21 Oc-
tober 2019 by Outfittery GmbH, although the complainant's data should not
have been transferred due to his timely objection.
The fact that Outfittery GmbH did not assign the complainant's request for
erasure of 30 September 2019, which is to be regarded as an objection, to
the objection process provided for this purpose due to an internal employee
error is irrelevant in this context, as Outfittery GmbH must ensure compli-
ance with its obligations under data protection law through appropriate
technical and organisational measures in accordance with Article 24(1)
GDPR. In any case, Outfittery GmbH could also be reasonably expected to
ensure that the objections against the transfer of customer data were pro-
cessed correctly in terms of content by means of internal organisational
measures.
The use of the complainant's data and its continued storage until erasure
on 22 October 2019 was thus without legal grounds.
Outfittery GmbH thus violated Article 5(1)(a), Article 6(1), Article 17(1), Arti-
cle 21(3) and Article 24(1) GDPR.
III.
As a result, we have decided not to take any further supervisory measures
due to the violation, but to leave it at a reprimand.
The reprimand is based on Article 58(2)(b) GDPR.
Taking into account the specific circumstances of the case under investiga-
tion, we consider a reprimand to be appropriate after completion of our in-
vestigation. We have again established a violation on your part.
-3-
In the safe expectation that you will comply with the data protection regula-
tions in the future, we consider the matter closed.
Kind regards,
[redacted]