Entertainment Trading ApS
20 April 2021
Bøgildsmindevej 3
9400 Nørresundby J.No. 2019-7320-1575
Doc.no. 341204
Caseworker
Sent with Digital Post
Complaint about the processing of personal data
The Danish Data
Protection Agency
The Data Protection Agency thus returns to the case in which (hereinafter referred Carl Jacobsens Vej 35
to as complainant) has complained to the Finnish Data Protection Agency that Entertainment 2500 Valby
Denmark
Trading ApS (hereinafter Coolshop) has not deleted information about him in the form of a cus-
T 3319 3200
tomer account and that Coolshop retains information about him. [email protected]
datatilsynet.dk
Pursuant to Article 56 of the Data Protection Regulation, the Finnish Data Protection Supervi- VAT No. 11883729
sory Authority has forwarded this complaint to the Data Protection Agency, which has assumed
the role of leading supervisory authority in relation to Coolshop’s cross-border processing ac-
tivities.
1. Decision
Following an examination of the case, the Danish Data Protection Agency considers that there
are grounds for criticizing that Coolshop’s processing of information on the customer account
of complainants has not been carried out in accordance with the rules laid down in Article 17
of the Data Protection Regulation.
The Danish Data Protection Agency also considers the basis for notifying Coolshop an injunc-
tion to delete the complainant’s customer account.
The injunction shall be notified pursuant to Article 58(2)(g) of the Data Protection Regulation.
The deadline for compliance with the injunction shall be four weeks from today’s date. Cool-
shop please notify the supervision when deletion has occurred.
Under Paragraph 41(2)(5) of the Data Protection Act, the person who fails to comply with an
order issued by the Data Protection Agency pursuant to Article 58(2)(g) of the Data Protection
Regulation is punishable by a fine or imprisonment for up to 6 months.
Below is a detailed examination of the case and a statement of reasons for the Danish Data
Protection Agency’s decision.
2. Statement of the facts
It appears from the case that the complainant made a purchase at www.coolshop.fi. A cus-
tomer account was created at the time of the purchase.
Having received the purchased goods, on 14 April 2019 he requested the deletion of informa- Page 2 of 5
tion that Coolshop dealt with about him.
Coolshop informed complaints that information about him – except for payment information –
would be deleted after one month’s inactivity and that complaints should therefore simply not
log in to his customer profile.
The complainant contacted Coolshop on 24 May 2019, as the complainant’s customer profile
at www.coolshop.fi was still available.
Coolshop replied the same day and stated that Coolshop was obliged to keep payment infor-
mation for 5 years, so all information about complaints could not be deleted immediately.
The complainant replied the same day Coolshop stating that he wanted all non-necessary in-
formation about him to be deleted and that Coolshop kept the payment information in a differ-
ent way.
On 27 May 2019, Coolshop informed the complainant that the data relating to him would be
deleted in accordance with the data protection rules on deletion, but if the customer account
continued to be accessed, the deletion procedure in relation to the customer profile would be
interrupted.
The complainant informed on the same day that he continued to want the customer profile and
all non-necessary information about him deleted.
Coolshop replied on the same day to the complaint and stated that all information except for
payment information would be deleted and that the customer profile would be deleted 30 days
after the deletion procedure was initiated. Coolshop reiterated to the complainant that the data
would not be deleted if he continued logging in to the customer profile when the deletion pro-
cedure was suspended.
On 7 August 2019, the complainant again contacted Coolshop and stated that he had not ac-
cessed the customer profile for more than two months and that, despite this, the information
about him was still not deleted. The complainant also resubmitted a request for deletion.
Coolshop replied the same day to the complainant’s inquiry and informed us that the informa-
tion about the complainant was reactivated when the complainant re- logged in to the cus-
tomer account. Moreover, the complainant’s information was deleted except for contact details
which Coolshop kept for some time in case it became necessary to contact him in relation to
the product purchased.
The complainant then lodged a complaint with the Finnish Data Protection Agency, which, hav-
ing identified the Data Supervisory Authority as the lead supervisory authority on 4 September
2020, submitted the complaint to the Danish Data Protection Agency.
On 16 September 2020, the Danish Data Protection Agency sent the complainant’s complaint
to Coolshop and asked for a statement on the matter.
Coolshop made a statement on the matter on 14 October 2020. The Finnish Supervisory Au-
thority forwarded the opinion to the complainant on 30th October 2020 and asked the com-
plainant to submit comments, if any.
On 15 January 2021, the Finnish Surveillance Authority indicated that the complainant had not Page 3 of 5
commented on the opinion.
2.1 Remarks from the complainant
The complainant have generally stated that Coolshop has not deleted all non-necessary infor-
mation about him, including the customer profile that was created in connection with his pur-
chase at www.coolshop.fi.
The complainant agrees to keep statutory information about him, but he does not want Cool-
shop to keep his customer account active.
2.2. Comments by Coolshop
Coolshop has stated the following:
General about Coolshop’s processing of personal data
When a customer makes purchases at www.coolshop.fi, this is done via a customer account
created by the customer.
In connection with the customer account, the customer must provide the name, address, e-
mail and telephone number. The purpose of the collection and storage is to identify the cus-
tomer and make it possible for Coolshop to contact the customer in connection with transac-
tions at the webshop. The customer will never be asked to provide information covered by Arti-
cle 9 of the GDPR.
Coolshop has developed a privacy policy, which is available at www.coolshop.fi.
If the customer does not make purchases at www.coolshop.fi via the customer account for 2
years, Coolshop automatically deletes the customer account and all the customer’s informa-
tion.
However, the automatic deletion assumes that Coolshop is not obliged to store personal data
or maintain the customer account under other laws.
Coolshop stores information about the company’s customers on the basis of section 83(1) of
the Purchase Act, which states that a consumer has a complaint for two years after the deliv-
ery of a purchase item. Since Coolshop.fi is a webshop, customers submit complaints via the
customer account, where an online form is completed and submitted to Entertainment Trad-
ing. In order for the customer to exercise his right of complaint, it is therefore necessary that
the customer has access to the customer account for at least two years after the purchase.
This means that personal data will be deleted at the earliest after two years if the customer
has made a purchase via his customer account at www.coolshop.fi. At the end of the two
years, automatic deletion takes place if the customer has not made use of his account within
the last year.
Section 10 of the Accounting Act also provides that the person responsible for keeping ac-
counts must keep records in a secure manner for five years from the end of the financial year
to which the material relates. Coolshop is therefore obliged to keep the information provided,
together with information on the goods purchased by the customer, for five years from the end
of the financial year in which the purchase was made. This information is stored in an ERP
system and does not require the customer account to be maintained.
In general, Coolshop processes information about customers on the basis of Article 6(1)(a, b Page 4 of 5
and c) of the GDPR respectively.
Deletion upon request
Customers have the opportunity to request through the customer account to have information
about themselves deleted.
If a customer so requests, all information about a customer that Coolshop is not obliged to
keep under the Accounting Act and the Purchase Act shall be deleted within 24 hours.
Therefore, if a customer has not made transactions, the customer account is deleted within 24
hours. If the customer has made transactions, the customer account is deleted two years af-
ter the purchase made, as the customer must have the opportunity to exercise the right of
complaint in the Purchase Act.
Furthermore, bookkeeping material arising from the customer’s purchase will not be deleted
until five years after the end of the financial year in which the purchase was made, cf. section
10 of the Accounting Act.
Personal data that Coolshop is not obliged to store shall be deleted within 24 hours of the sub-
mission of a request for deletion.
If the customer makes new purchases after initiating the deletion procedure, the deletion pro-
cedure shall be cancelled. However, already deleted personal data is not recreated. They'll
stay erased.
Coolshop generally agrees to delete requests if the data subject withdraws consent, in accor-
dance with Article 17(1)(b) of the Data Protection Regulation. Furthermore, Coolshop deletes
information necessary for the warranty of the Purchase Act after two years, when the informa-
tion is no longer necessary pursuant to Article 17(1) of the Regulation.
However, pursuant to Article 17(3) of the Regulation, Coolshop cannot comply with a request
for deletion as Coolshop is legally obliged to keep certain payment information, cf. section 10
of the Accounting Act.
The complainant’s case
The complainant made a purchase on 22 March 2019.
Immediately after the complainant initiated the deletion procedure, information about him
whom Coolshop was not legally obliged to store was deleted.
However, the customer account associated with the complainant is deleted not earlier than
two years after the complainant’s last purchase, as he must be given the opportunity to exer-
cise his right of complaint. The customer account will therefore be deleted at the earliest on 22
March 2021.
Furthermore, Coolshop keeps information on the complainant under the Accounting Act’s rules
until 2024.
In conclusion, Coolshop has stated that Coolshop has replied to all the complaints and that he
has received appropriate reasons for refusing immediate deletion of all information about him.
3. Reasons for the decision of the Data Protection Agency Page 5 of 5
It follows from Article 17 of the Data Protection Regulation that the data subject has the right
to have personal data about himself deleted by the controller without undue delay, and the
controller is obliged to delete personal data without undue delay if any of the circumstances
referred to in paragraph 1(a) to (f) applies.
It follows from Article 17(3)(b) of the Regulation that the right to have data relating to oneself
deleted shall not apply where processing is necessary to comply with a legal obligation requir-
ing processing under Union or national law to which the controller is subject.
The Danish Data Protection Agency considers that it is not necessary for the complainant to
have access to his customer account for at least two years after the purchase, in order for him
to exercise his right of complaint under the Purchase Act. It is therefore not necessary for Cool-
shop to comply with a legal obligation that the customer account should not be deleted until at
least two years after the complainant’s last purchase.
On this basis, the Danish Data Protection Agency considers that Coolshop cannot refuse to
delete the complainant’s customer account on the basis of Article 17(3)(b) of the Data Protec-
tion Regulation.
The Danish Data Protection Agency has thus emphasised that it is possible for the complainant
to advertise a product in a way other than the use of an online form in the customer account,
e.g. by e-mail or by telephone.
On these grounds, the Danish Data Protection Agency considers that Coolshop has not erased
the complainant’s customer account in accordance with Article 17 of the Data Protection Regu-
lation.
The Danish Data Protection Agency also finds the basis for notifying Coolshop an injunction
to delete the complainant’s customer profile at www.coolshop.fi.
Furthermore, the Danish Data Protection Agency finds no grounds for overriding Coolshop’s
assessment that the company is obliged under the Accounting Act and the Purchase Act to
keep information about complaints and his purchases at www.coolshop.fi.
It is thus the Danish Data Protection Agency’s opinion that the right to erasure in Article 17(1)
of the Data Protection Regulation does not apply in relation to this data, in accordance with
Article 17(3) (b). Thus, the Danish Data Protection Agency’s injunction for deletion does not
include data processed (stored) under a legal obligation.
4. Final remarks
The decisions of the Data Protection Agency cannot be appealed to any other administrative
authority, cf. section 30 of the Data Protection Act. However, decisions of the Supervisory Au-
thority may be appealed to the courts, cf. Article 63 of the Danish Constitution.
Coolshop is asked to inform the Danish Data Protection Agency when the order has been com-
plied with.
Copy of this letter are sent today to the complainant.
Kind regards