idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
# Information and Data Protection Commissioner
vs
# COMPLAINT
1. Reference is made to the complaint, lodged by [REDACTED] (the "complainant") against [REDACTED] (the "controller"), referred to the Information and Data Protection Commissioner (the "Commissioner") pursuant to article 61 of the General Data Protection Regulation¹ (the "Regulation") by the Spanish supervisory authority (Agencia Española de Protección de Datos), acting as the concerned supervisory authority under the one-stop-shop mechanism.
2. The complainant alleged that the controller did not respond to a request to erase her personal data pursuant to article 17 of the Regulation (the "request") within one month. The request was submitted by means of an e-mail dated the 13th August 2020 to the e-mail address [REDACTED]. The complainant argued that that this was the e-mail address which was made available on the controller's privacy policy published on the official website.
3. In support of the allegations made, the complainant provided the Commissioner with a copy of the request and a document issued by the company [REDACTED] certifying that such e-mail was actually delivered to the controller.
¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Airways House, Second Floor
High Street, Sliema SLM 1549
MALTA.
[+356] 2328 7100
[email protected]
www.idpc.org.mt
Page 1 of 6
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
# INVESTIGATION
4. Pursuant to article 58(1)(a) of the Regulation, the Commissioner requested the controller to provide its submissions in relation to the allegations raised by the complainant. In terms of this Office's internal investigation procedure, the controller was provided with a copy of the complaint together with the supporting documents.
5. On the \(4^{\text{th}}\) December 2020, the controller submitted the following principal legal arguments for the Commissioner to take into consideration during the legal analysis of the case:
i. that the complainant sent "her erasure request on the 13 August 2020 to the email which is an old email address of , and not the contact email for entity and its customers support service as also displayed currently in Spanish website";
ii. the controller held that the correct e-mail address which should be used by the Spanish customers is and in this regard, the controller provided a screen capture of an URL of its official website², where such e-mail address is visible;
iii. that the complainant submitted her request on an old e-mail address which is "not monitored regularly by the customer support agents", and consequently, the controller held that the complainant's "request didn't reach DPO before 24th November 2020, after DPO received the complaint from IDPC and internal investigation was launched";
iv. that the "unfortunate incident of not replying within required deadline can be attributed to a degree of unintentional human error from the side for not monitoring regularly the old mailbox and from [the complainant's] side for not addressing her request to the email address displayed validly on webpage";
v. that following an internal investigation conducted by the controller, it has been established that the incident was a fraud case, and "the data and account related to has been blacklisted and maintained in a way only being available to the
2
Page 2 of 6
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
police and judicial authorities and not being anymore subject to any further processing by [REDACTED] or any of its data processors";
vi. that the controller was obliged to retain the complainant's personal data for ten (10) years from the date of the closure of the complainant's account, and that such obligation emanates from "Article 163 of the Companies Act, Cap. 386; articles 4(11) and 4(13) of the Cooperation with Other Jurisdictions on Tax Matters Regulations (S.L. 123.127); article 19 of the Income Tax Management Act, Cap. 372; articles 1964 and 1968 of the Spanish Civil Code; and the Maltese Prevention of Money Laundering and Funding of Terrorism Regulation (S.L. 373.01) article 13(2)";
vii. that the controller held that, having "finalised its internal investigation and reached the conclusion [that the matter is a result of fraud], the [REDACTED] will immediately contact [the complainant] to address her request, explain the reason for [REDACTED] being late with its reply and sincerely apologies for the late reply". The Commissioner requested the complainant to further substantiate its submissions with a copy of the letter sent to the complainant.
### LEGAL ANALYSIS AND DECISION
6. Having examined article 12(3) of the Regulation, which stipulates that "the controller shall provide information on the action taken on a request under Articles 15 to 22 to the data subjects without undue delay and in any event within one month of receipt of the request" [emphasis has been added].
7. Having read article 12(3) of the Regulation in conjunction with article 17 of the Regulation, which disciplines the right of the data subject to erase his or her personal data undergoing processing under certain circumstances.
8. During the course of the investigation, the Commissioner established that the controller did not reply to the request submitted by the complainant to erase her personal data within the period stipulated by law.
9. In terms of article 17(1) of the Regulation, the "data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay
Page 3 of 6
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
and the controller shall have the obligation to erase personal data without undue delay” where one of the grounds listed in article 17(1)(a) to (f) applies. However, this rule is subject to a number of exceptions, in particular article 17(3)(b) which states that the right to erasure shall not apply “for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject ...” [emphasis has been added].
10. Having observed recital 65 of the Regulation, which stipulates that “[a] data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation” [emphasis has been added].
11. Whereas the Commissioner established that the processing of the complainant’s personal data is necessary for compliance with a legal obligation to which the controller is subject, and therefore the controller’s refusal to erase the complainant’s personal data is justified pursuant to article 17(3)(b) of the Regulation, the controller is still obliged to respond to the data subject request submitted by the applicant within the period stipulated by law.
12. In this context, the Commissioner examined the submissions provided on the 4th December 2020, whereby the controller stated that the e-mail address to which the complainant sent her request was not regularly monitored and consequently, this was replaced by a new e-mail address. Pursuant to article 24(1)3 of the Regulation and, as a general good practice, the controller shall implement the appropriate technical and organisational measures to ensure that data subject requests are addressed in a timely and appropriate manner.
13. Consequently, the Commissioner concluded that, by leaving an e-mail address unmonitored, the controller violated its duty of care under the law, and that this negligent behaviour hindered
3 “Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.”
Page 4 of 6
idpc
INFORMATION AND DATA
PROTECTION COMMISSIONER
the complainant from obtaining a response to a right of erasure request within the period stipulated by law.
14. As a consequence, the fact that the complainant did not obtain a response within the deadline stipulated by the law generated unnecessary prolonged uncertainty in relation to the lawfulness and transparency of the controller's data protection practices and operations.
On the basis of the foregoing, the Commissioner decides that the controller infringed:
i. article 12(3) of the Regulation when it failed to provide the complainant with information on the action taken on the request submitted on the \(13^{\text{th}}\) August 2020 to erase her personal data pursuant to article 17 of the Regulation; and
ii. article 24(1) of the Regulation, for not having implemented the appropriate technical and organisational measures to ensure and be able to demonstrate that processing is performed in accordance with the provisions of the Regulation, particularly, when it failed to set-up a mechanism to monitor incoming communications to the e-mail address
By virtue of article 58(2)(b) of the Regulation, the controller is hereby being served with a reprimand and reminded that, in the event of a similar infringement, the Commissioner shall take the appropriate corrective action, as the case may be.
In terms of article 58(2)(d) of the Regulation, the Commissioner is instructing the controller to take the following corrective measures to bring its processing operations into compliance with the provisions of the Regulation by:
i. setting-up a rule on the email account so that the mailbox sends out automated responses to incoming e-mails informing the data subjects of the correct e-mail address; or
ii. setting-up a rule whereby e-mails sent to the e-mail address are automatically re-directed to the controller's correct e-mail address.
Page 5 of 6
idpc.
INFORMATION AND DATA
PROTECTION COMMISSIONER
The controller shall provide the Commissioner with evidence of implementation of the aforementioned instructions within twenty (20) days from the date of receipt of this legally binding decision.
Decided today, the 27th day of April, 2021
Page 6 of 6