THE COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMATION
LfDI Baden-Württemberg · P.O. Box 10 29 32 ·D-70025 Stuttgart
Fine proceedings for violation of Articles 5, 6, 17 of the GDPR due to publication of
personal data on the internet without consent and non-compliance with the erasure
request
Decision
The fine proceedings shall be terminated in accordance with Section 47(1)(1) of the
Act on regulatory offences.
Findings:
I.
, an association for the protec-
tion of the marine environment, conducted in 2010 a "Petition to stop the consump-
tion of whale meat in the Faroe Islands". Supporters were able to sign the petition
online, giving their name and country, and leave a comment. A total of 57,281 people
signed the petition,
which was published on the Internet at
with the names of the supporters. On the other
hand, representatives of the Faroe Islands were given a printout of the petition to-
gether with the signatures. The petition was closed on 26 July 2010.
Königstraße 10 a · D-70173 Stuttgart · Phone (+49) 711 615541-0 · Fax (+49) 711 615541-15 · [email protected] · [email protected]
www.baden-wuerttemberg.datenschutz.de · PGP Fingerprint: E4FA 428C B315 2248 83BB F6FB 0FC3 48A6 4A32 5962
For information on our privacy notice pursuant to Article 13 GDPR, please consult our webpage at the following address:
https://www.baden-wuerttemberg.datenschutz.de/datenschutz/
-2-
On 16 July 2015, from the United Kingdom, who had signed the peti-
tion online, contacted the managing sole shareholder of the entity with the request
that her signature, which was still available under
and thus freely accessible via
the internet, be removed from the list of signatures. In addition to the name of the
complainant, the names of all signatories to the petition were available via the follow-
ing links:
In addition, the previously listed Internet pages were indexed at Google, so that a
Google search of a person listed there also listed the Internet page with the petition
as a search result. Accordingly, in a Google search for the complainant, the page
was linked as fourth hit at
Google.
The complainant's request was not complied with by with the explanation that
the complete list of signatures had already been removed from the website years
ago. On 29 April 2019, the complainant again turned to with the same re-
quest, which was rejected with the same reasoning as before. In fact, however, the
relevant link was still accessible, as an entry of the link in a web browser would have
revealed.
Subsequently, the complainant lodged a complaint with the UK supervisory authority,
which initiated IMI Article 56 proceedings on 26 August 2019 (IMI no. 74456.1) due to
the company’s registered office in Baden-Württemberg. The Baden-Württemberg
DPA accepted to handle the case as LSA. In the course of the hearing by the LSA,
again - erroneously - stated that the signature list had already been deleted
and the erasure request had thus been fulfilled.
As a result, the LSA initiated fine proceedings against on suspicion of viola-
tion of the requirement to storage limitation pursuant to Article 5(1)(e) of the GDPR
as well as violation of the obligation to erasure pursuant to Article 17(1) of the GDPR,
and heard on this matter in a letter dated 16 November 2020. In addition to
the list of signatures relating to the complainant, the subject of the fine proceedings
was also a list of signatures published under
-3-
dated 1 May 2008 with the
names and places of residence of 1,294 persons, which had already been closed on
30 April 2008 and handed over to a representative of the Federal Government in Ber-
lin.
In a letter dated 24 November 2020, stated that the list of signatures from 1
May 2008 should not be deleted, as the underlying campaign had not yet ended due
to lack of success. Furthermore, they stated that the signature list from 2010 con-
cerning the complainant had already been deleted ten years ago, although there had
been no corresponding confirmation from . Accordingly, they stated that the
signature list was also not available on the website. Screenshots of the provider were
submitted as proof, which in fact only showed the editor of the navigation bar of the
homepage of
In a letter dated 15 January 2021, was once again informed of the legal sit-
uation and the continuing obligation to erasure. was given a final opportunity
to delete the signature lists, together with the announcement of a chargeable erasure
order and a final decision in the fine proceedings.
Subsequently, demonstrably deleted the corresponding signature lists from
its homepage, so that a Google search for the complainant no longer refers to the
homepage and the signature list there [Please find the respective screen-
shots in the relevant documents].
II.
The fine proceedings shall be terminated for reasons of expediency pursuant to Sec-
tion 47(1)(1) of the Act on regulatory offences.
It is true that at least negligently violated Article 5(1)(e), Article 6(1) and Arti-
cle 17(1) of the GDPR by publishing the names of the data subjects on the home-
page years after the signature campaigns had ended without their consent and by
not deleting them despite a request to do so.
The corresponding violation is, in principle, also serious, as a large number of per-
sons were affected by the unlawful publication, the corresponding publication lasted
-4-
for a period of ten resp. twelve years and did not comply with the request for
erasure even despite repeated requests by the complainant and the LSA.
Nevertheless, it is possible to refrain from imposing a fine in exceptional cases. First
of all, it must be seen that is a non-profit and thus not commercially active
company which, apart from the managing sole shareholder, has no employees and is
dependent on donations for its non-profit activities, which in 2020 amounted to only
10,603.00 Euros up to the time of the statement of 24 November 2020. In addition,
did not act intentionally, but on the contrary, due to a lack of technical exper-
tise, was convinced that the signature list had already been deleted and had thus
complied with the complainant's request for erasure. Finally, restored the
lawful state by fulfilling the complainant's request for erasure, albeit with a delay of
several years and at the repeated request of the LSA.
In view of the nature of fines as a remedial measure, as an exception, punishing
by imposing a fine does not appear necessary, so that the fine proceedings
are terminated for reasons of expediency. However, in case will violate data
protection regulations again, they will have to expect the imposition of a fine, which
will then not be insignificant.
[…]