521.13446 Berlin Commissioner for
631.345 Data Protection and
Freedom of Information
CR 52519
DD 186058 Friedrichstr. 219
10969 Berlin
FINAL DECISION Visitors’ entrance:
Puttkamer Str. 16-18
The building is fully accessible to
Berlin, 26 April 2021 disabled members of the public.
OUTFITTERY GmbH Contact us
Management Board
Phone: +49 (0)30 13889-0
[redacted] Fax: +49 (0)30 215 50 50
Leuschnerdamm 31
Use our encrypted contact form
10999 Berlin for registering data protection
complaints:
www.datenschutz-berlin.de/be-
For information: schwerde.html
ISiCO Datenschutz GmbH For all other enquiries, please
[redacted] send an e-mail to:
[email protected]
Am Hamburger Bahnhof 4
10557 Berlin Fingerprint of our
PGP-Key:
D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
Reprimand
Complainant: [redacted]
Office hours
Your letter of 18 December 2020 (Your ref IS-0472-10)
Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
(or by appointment)
Dear [redacted],
How to find us
We hereby issue a reprimand to your company for a violation of the
The underground line U6 to
General Data Protection Regulation (GDPR). Kochstraße / Bus number M29
and 248
Reasoning:
Visit our Website
This decision is based on the following considerations https://privacy.de
I.
The Berlin DPA has established the following facts:
The above-mentioned complainant maintained a customer account with
Curated Shopping GmbH, which was taken over by Outfittery GmbH on 27
June 2019, under his email address [redacted - email address 2] and an-
other customer account with Outfittery GmbH under the email address [re-
dacted - email address 1]. By email from the address [redacted - email ad-
dress 1], the complainant requested Outfittery GmbH to erase his data on
30 December 2019 and mentioned his user account set up under the email
address [redacted - email address 2] in his erasure request.
-2-
You confirmed the erasure of the complainant's data in an email sent to his
email address [redacted - email address 2] on 2 January 2020. On 16 Sep-
tember 2020, the complainant again received an advertising letter from
Outfittery GmbH by post. In the above-mentioned statement, you stated
that on 2 January 2020, the complainant's existing customer account at the
e-mail address [redacted - email address 2] had been deleted and admitted
that due to an employee error, however, his other customer account with
the e-mail address [redacted - email address 1] had not been erased.
II.
Legally, we assess the facts of the case as follows. Your company has vio-
lated the GDPR.
According to Article 5(1)(a) GDPR, personal data must be processed in a
lawful manner. In order for processing to be lawful, personal data must be
processed either on the bases of the consent of the data subject concerned
or some other legal basis, according to sentence one of Article 6(1) GDPR.
Pursuant to Article 17(1)(a) GDPR, the data subject has the right to obtain
from the controller the erasure of personal data concerning him or her with-
out undue delay.
Through his erasure request of 30 December 2019 pursuant to Article 17(1)
GDPR, the complainant has expressed that he is not interested in continu-
ing the customer relationship with Outfittery GmbH. Further processing of
his data for the business purposes of Outfittery GmbH was therefore no
longer necessary. Nor was the erasure request barred for other reasons.
However, his erasure request was not fully implemented due to an internal
employee error at Outfittery GmbH. Admittedly the data assigned to the
customer account with the email address [redacted - email address 2], was
erased by Outfittery GmbH on 2 January 2020. However, the erasure of the
data assigned to the customer account with the email address [redacted -
email address 1] did not take place. This data continued to be stored in the
systems of Outfittery GmbH and was used again by sending the postal ad-
vertising letter that the complainant received on 16 October 2020, although
it should have already been erased based on his previous request for eras-
ure.
The fact that Outfittery GmbH did not fully implement his deletion request of
30 December 2019 due to an internal employee error is irrelevant, as Out-
fittery GmbH must ensure compliance with its data protection obligations by
taking appropriate technical and organisational measures in accordance
with Article 24(1) GDPR. In any case, Outfittery GmbH could also be ex-
pected to take internal organisational measures to ensure that the request
for deletion was processed in accordance with data protection laws.
The continued use of the complainant's data and its continued storage were
therefore without legal grounds.
Outfittery GmbH thus violated Articles 5(1)(a), 6(1), 17(1) and 24(1) of the
GDPR.
III.
As a result, we have decided not to take any further supervisory measures
due to the violation, but to leave it at a reprimand.
The reprimand is based on Article 58(2)(b) GDPR.
-3-
Taking into account the specific circumstances of the case under investiga-
tion, we consider a reprimand to be appropriate after completion of our in-
vestigation. We have again established a violation on your part
In the safe expectation that you will comply with the data protection regula-
tions in the future, we consider the matter closed.
Kind regards,
[redacted]