1(4)
Rebtel Networks AB
Org. no:556680-3622
Jakobsbergsgatan 16
111 44 Stockholm
Our ref.:
DI-2020-10561, IMI no. 120408 Supervision under the General Data
Date: Protection Regulation – Rebtel
2021-03-23
Networks AB
Final decision of the Swedish Authority for
Privacy Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that Rebtel Networks AB has
processed personal data in violation of
Article 17 of the General Data Protection Regulation (GDPR)1 by not without
undue delay having erased the personal data on 9 November 2020 that the
complainant had requested erasure of 18 September 2019.
Article 12(3) of the GDPR by providing incorrect information on 22 September
2019 that the complainant’s data had been erased due to the complainant’s
request of 18 September 2019.
The Swedish Authority for Privacy Protection (IMY) issues Rebtel Networks AB a
reprimand in accordance with Article 58(2)(b) of the GDPR.
Report on the supervisory matter
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Rebtel Networks AB (the company) due to a complaint. The complaint has been
submitted to IMY, in its capacity as responsible supervisory authority pursuant to
Article 56 of the GDPR. The handover has been made from the supervisory authority
of the country where the complainant has lodged their complaint (Spain) in accordance
with the Regulation’s provisions on cooperation in cross-border processing.
The complaint states that the complainant has unsuccessfully tried to persuade the
Postal address:
company to stop sending non-requiring emails after she removed her account. She
Box 8114
104 20 Stockholm
has on four occasions requested removal and the company has each time confirmed
Sweden that her data has been deleted and that she would not receive any more messages,
Website:
but she then receives a new e-mail each time asking her to provide feedback about the
www.imy.se service. She has also tried to use the “unregister” link listed in each email, but it has
E-mail:
[email protected] 1
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with respect to the processing of
Telephone: personal data and on the free flow of such data and repealing Directive 95/46/EC (General Data Protection
+46 (8) 657 61 00 Regulation).
Swedish Authority Our ref.: DI-2020-10561, IMI no. 120408 2(4)
for Privacy Protection Date: 2021-03-23
not worked either. Against this background, she believes that the company has
violated its obligations under Article 17 of the GDPR.
Rebtel Networks AB has mainly stated the following.
The company received a request for deletion from the complainant on 18 September
2019. In retrospect, however, it can be noted that it has not been handled as a request
for erasure under the GDPR, even if certain data were erased. This is why additional
e-mails in the form of reminders of a customer survey survey have been sent to the
complainant. This has been done during the period up to and including 1 October
2019, i.e. not after the one month deadline that applies under the GDPR to meet a
request for erasure.
The remaining data was erased on 9 November 2020, except for those necessary to
handle the current supervisory matter. The company informed the complaint on 20
November 2020.
Due to this supervisory matter, the Company has taken special measures to
strengthen its established processes and procedures for identifying a request under
the GDPR. This mainly includes further training of its customer service agents. The
company has further improved its so-called data triggers in its customer service tool.
The company’s investigation of the complainant’s case showed that it had not been
flagged as a matter under the GDPR when the data application did not understand any
reference to the GDPR in Spanish.
The processing has been done through correspondence. In the light of cross-border
processing, IMY has used the mechanisms for cooperation and consistency contained
in Chapter VII of the GDPR. The supervisory authorities concerned have been the data
protection authorities in Spain, Germany, Norway, Italy and France.
Justification of the decision
Applicable provisions
According to Article 12(3) of the GDPR, the controller shall, upon request, without
undue delay and, in all circumstances, at the latest one month after receiving the
request, provide the data subject with information on the measures taken pursuant to
Article 17. If necessary, this period may be extended by an additional two months,
taking into account the complexity of the request and the number of requests received.
The controller shall notify the data subject of such an extension within one month of
receipt of the request and indicate the reasons for the delay.
According to Article 17(1)(a), the data subject shall have the right to have their
personal data erased by the controller without undue delay and the controller shall be
obliged to erase personal data without undue delay if the personal data is no longer
necessary for the purposes for which they were collected or otherwise processed.
According to Article 17(3)(b), this shall not apply to the extent that the processing is
necessary to fulfil a legal obligation requiring processing under Union law.
Swedish Authority Our ref.: DI-2020-10561, IMI no. 120408 3(4)
for Privacy Protection Date: 2021-03-23
The assessment of the Swedish Authority for Privacy
Protection (IMY)
Has there been an infringement of the GDPR?
The company has stated that the reason the complainant’s request for erasure of 18
September 2019 was not handled until 9 November 2020 is because the company did
not perceive it as a request for erasure.
In the opinion of the IMY, however, it has been clear from the request that the data
subject wished to exercise her right to erasure. Since certain data was only erased on
9 November 2020, Rebtel Networks AB has processed personal data in violation of
Article 17 of the GDPR by not without undue delay having erased the personal data on
9 November 2020 that the complainant had requested erasure of 18 September 2019.
However, the company has had the right to retain the information needed to show that
the request has been handled in accordance with the GDPR.
The Company has stated that no further e-mails have been sent since 2 October 2019
and that this is within the deadline of one month following Articles 12(3) and 17 GDPR.
However, the company incorrectly stated in its reply to the complainant on 22
September 2019 that the information had been erased and that the complainant would
not receive any more e-mails. Rebtel Networks AB has thus in violation of Article 12(3)
the GDPR provided incorrect information about what measures – that the data had
been fully erased – which had been taken due to the complainant’s request.
Despite the fact that the company, on 22 September 2019, informed the complainant
that no more e-mails regarding customer satisfaction would be sent, the complainant
received another four such e-mails. The four e-mails were sent on 22 and 25
September, and on 1 and 2 October 2019. However, IMY notes that these were sent a
relatively short time after the request for erasure was made and finds that it is within
the timeframe that the company would have had to take action if the request had been
handled correctly.
Choice of corrective measure
Articles 58(2) and 83(2) of the GDPR states that IMY has the authority to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the individual case, administrative fines shall be imposed in addition to or instead of
the other measures referred to in Article 58(2), such as injunctions and prohibitions.
Furthermore, Article 83(2) lists which factors should be taken into account in deciding
whether to impose an administrative fine and on the amount of the fine. If it is a minor
infringement, IMY may, as stated in recital 148 instead of impose an administrative
fine, issue a reprimand pursuant to Article 58(2)(b). Consideration shall be taken to
aggravating and mitigating circumstances in the case, such as the nature of the
infringement, severity and duration as well as previous relevant infringements.
The company has stated that the reason the complainant’s request for erasure was not
handled correctly was mainly due to a mistake in the company’s customer service and
customer service tools. As a result of the incident, the company has stated that it has
taken specific organisational and technical measures to strengthen its established
processes and procedures, especially for identifying a request under the GDPR.
In an overall assessment of the circumstances, IMY finds that the stated infringements
are minor violations in the sense referred to in recital 148 and that Rebtel Networks AB
Swedish Authority Our ref.: DI-2020-10561, IMI no. 120408 4(4)
for Privacy Protection Date: 2021-03-23
therefore should be issued a reprimand in accordance with Article 58(2) of the GDPR
for the stated infringements.
This decision has been made by Head of Unit after presentation
by legal advisor .
Notice. This document is an unofficial translation of the Swedish Authority for Privacy
Protection’s (IMY) decision 2021-03-23, no. DI-2020-10561. Only the Swedish version
of the decision is deemed authentic.