632.257.1
521.12260
Berlin Commissioner for
Austrian DPA D130.354 Data Protection and
CR 52519 Freedom of Information
DD 174148 Friedrichstr. 219
FD 191920 10969 Berlin
Visitors’ entrance:
OUTFITTERY GmbH Puttkamer Str. 16-18
Management Board The building is fully accessible to
Ms. [redacted] disabled members of the public.
Leuschnerdamm 31
10999 Berlin Contact us
Phone: +49 (0)30 13889-0
16 March 2021 Fax: +49 (0)30 215 50 50
Use our encrypted contact form
for registering data protection
complaints:
Reprimand www.datenschutz-berlin.de/be-
schwerde.html
Complainant: Mr. [redacted]
Your letters of 16. March 2020, 22. June 2020 and 9. October 2020 (your For all other enquiries, please
send an e-mail to:
ref. IS-0472-10) [email protected]
Fingerprint of our
PGP-Key:
D3C9 AEEA B403 7F96 7EF6
Dear Ms. [redacted], C77F B607 1D0F B27C 29A7
The Berlin Commissioner for Data Protection and Freedom of Infor- Office hours
mation (Berlin DPA) hereby issues a reprimand to your company for a
Daily from 10 am to 3 pm,
violation of the General Data Protection Regulation (GDPR). Thursdays from 10 am to 6 pm
(or by appointment)
The Berlin DPA bases the reprimand on the following considerations:
How to find us
I. The underground line U6 to
The Berlin DPA has established the following facts: Kochstraße / Bus number M29
and 248
The complainant had received a confirmation via email regarding the eras-
Visit our Website
ure of his personal data by the controller Outfittery GmbH on 12 April 2019.
https://privacy.de
According to the commercial register (Charlottenburg Court, HRB 140519
B), the Curated Shopping GmbH, with its registered office in Berlin (Char-
lottenburg Court, HRB 138459 B), is merged with the Outfittery GmbH as a
whole on the basis of the merger agreement of 17 June 2019 and the con-
sent resolutions of the same date by transferring its assets with dissolution
without liquidation as of the merger date of 27 June 2019 (date of entry in
the commercial register). Pursuant to § 2(1) of the aforementioned merger
agreement, Curated Shopping GmbH has transferred its assets as a whole
with all rights and obligations to Outfittery GmbH under dissolution without
liquidation pursuant to § 2(1) of the Transformation Act (merger by absorp-
tion).
On 24 July 2019, the complainant had also requested erasure of his per-
sonal data to the controller Curated Shopping GmbH, which is the provider
-2-
of the service MODOMOTO, by contacting the address
[email protected], and had received a confirmation of his request from
this address via email.
On 19 October 2019, the controller informed the complainant by email
about the transfer of his data into the Outfittery GmbH system and the crea-
tion of his new account with Outfittery GmbH and requested him to activate
his account. The complainant again requested the controller to erase his
personal data by email on 21 October 2019.
By credible comments dated 16 March 2020, the controller admitted that he
had not implemented the complainant's erasure request of 24 July 2019
due to an error on the part of an employee and had only erased the com-
plainant’s personal data on 24 January 2020. In further comments of 22
June 2020, the controller also admitted that he had not sent a deletion con-
firmation to the complainant.
II.
In legal terms, the Berlin DPA assesses the facts of the case as follows.
The controller has violated the General Data Protection Regulation.
According to Article 5(1)(a) GDPR, personal data must be processed in a
lawful manner. In order for the processing to be lawful, personal data must
be processed either with the effective consent of the data subject or on the
basis of a legal authorisation, according to the first sentence of Article 6(1)
GDPR.
Through his erasure request of 24 July 2019 pursuant to Article 17(1)
GDPR, the complainant expressed that he was not interested in continuing
the customer relationship with Curated Shopping GmbH, which at that time
had already merged with Outfittery GmbH. Further processing of his data
for the business purposes of Outfittery GmbH was thus no longer neces-
sary.
However, the complainant’s request for erasure was not implemented due
to an internal employee error at Outfittery GmbH. Instead, the complain-
ant's data was reused on 21 October 2019 by creating an account in Outfit-
tery GmbH's systems and informing the complainant accordingly, although
the complainant's data should have been erased based on his previous re-
quest for erasure.
The fact that the implementation of the complainant's deletion request of 24
July 2019 was not implemented by Outfittery GmbH due to an internal em-
ployee error is irrelevant in this respect, since pursuant to Article 24(1)
GDPR, Outfittery GmbH must ensure compliance with its obligations under
data protection law by taking appropriate technical and organisational
measures. In any case, Outfittery GmbH could also be expected to ensure
that the content of the complainant's request for erasure was processed
correctly by taking internal organisational measures.
The use of the complainant's data and its continued storage until erasure
on 24 January 2020 thus took place without legal basis.
In addition, according to the first sentence of Article 12(3) GDPR, the con-
troller must provide the data subject with information on the measures
taken upon request pursuant to Articles 15 to 22 GDPR without undue de-
lay, and in any case within one month of receipt of the request. This means
-3-
that the controller confirms the erasure or at least informs why this is not
possible within the time limit. This deadline may exceptionally be extended
by a further two months if this is necessary, taking into account the com-
plexity and number of requests. However, a routine and blanket extension
of the deadline without examining the individual case is not provided for by
the GDPR. The controller also did not inform the complainant about an ex-
tension of the deadline and the reasons for it.
Consequently, the implementation of the complainant's erasure request of
24 July 2019 on 24 January 2020 was late. Moreover, the complainant was
not informed about the erasure of his data by Outfittery GmbH, as the
aforementioned acknowledgement of receipt of 29 July 2010 does not con-
tain such information.
Consequently, Outfittery GmbH also committed a violation of Article 12(3)
GDPR.
Outfittery GmbH has thus violated Article 5(1)(a), Article 6(1), Article 12(3),
Article 17(1) and Article 24(1) GDPR.
III.
As a result, the Berlin DPA does not to take any further supervisory
measures as a result of the infringement, but to leave it at a reprimand.
The reprimand is based on Art. 58(2)(b) GDPR.
Taking into account the specific circumstances of the case under investiga-
tion, the Berlin DPA considers a reprimand to be appropriate after comple-
tion of the investigation. The Berlin DPA has therefore established another
violation on the controller‘s part.
In the safe expectation that the controller will comply with the data protec-
tion regulations in the future, the Berlin DPA closes this case after issuing
the reprimand.