1/5
National File Number: E/04570/2019 - E/09399/2019 – A56ID 66050
FINAL DECISION
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 27/04/2021 14:33:51
To discontinue proceedings carried out upon the reception in the Spain supervisory
authority (hereinafter, AEPD) of a complaint describing an alleged infringement of the
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data (from now on, the GDPR) and based on
the following:
FACTS
FIRST: On 15th of March of 2019 and with registry number 013831/2019, a complaint
was lodged at the AEPD regarding a cross-border processing carried out by
GOODGAME STUDIOS (the controller), for a potential breach of art. 17 of GDPR.
El documento consta de un total de 5 páginas. Página 1 de 5.
The complaint relies on the following points:
The claimant, consumer of the online videogames offered by the defendant,
requested by e-mail the removal of all his accounts, as well as his personal
data. He chose e-mail because it was apparently the only channel available to
communicate with the data controller.
However, his petition was not attended, since he kept on receiving e-mail
communications from the defendant.
Although a mere e-mail address is enough to open an account, the data
controller stores also bank account numbers and payment method data. This
information is necessary to pay for accessories that are needed through the
game, due to the nature of the videogames offered.
Together with the complaint, the following evidence was provided:
A screenshot of the e-mail sent on 27/05/2018 by the claimant to the data
controller, as a reply to a communication received from it to inform him about
the changes implemented in personal data protection matters, on the occasion
of the imminent coming into force of the GDPR.
A screenshot of the upper part of a response obtained from the defendant on
16/07/2018.
A screenshot of an advertising e-mail received on 15th of March of 2019.
SECOND: According to the privacy policy available in the GOODGAME STUDIOS
website, the data controller is ALTIGI GmbH, which has its main or single
establishment in Hamburg (Germany)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/5
THIRD: Taking into account the cross-border nature of the complaint, on 7 th of October
of 2019 it was agreed to provisionally discontinue the proceedings and inform Hamburg
supervisory authority (SA) – the Hamburgische Beauftragte für Datenschutz und
Informationsfreiheit, or, in English, the Hamburg Comissioner for Data Protection and
Freedom of Information –about the complaint, so that it could handle it as lead
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 27/04/2021 14:33:51
supervisory authority (LSA), pursuant to Article 56(1) of the General Data Protection
Regulation (GDPR).
FORTH: The complaint was communicated through the Internal Market Information
System (IMI) to the Hamburg data protection authority. The supervisory authorities
concerned (CSA) were Italy, France, Denmark, Slovakia, Sweden, Norway and
Germany-Saarland.
The Hamburg SA did not answer within IMI system. After being contacted by the
Spanish SA, Hamburg SA accepted the case via an e-mail dated on 19 th of September
of 2019, and requested the documents of the case, whose access had got blocked in
the system after the corresponding period had expired. The material was handed over
to the LSA in a new assistance request, with number 82273.
El documento consta de un total de 5 páginas. Página 2 de 5.
FIFTH: In accordance with the procedure provided in Article 60 GDPR, the Hamburg
SA has broadcasted among the concerned SAs the draft decision, which has been
accepted.
LEGAL GROUNDS
I – Competence
Pursuant to Article 60(8) of GDPR, the Director of the Spain-SA shall have competence
to adopt this decision, in compliance with both the art. 12(2)(i) of the Royal Decree
428/1993, of 26th of March, which approves the Charter of the Spanish Agency for Data
Protection, and the First Transitory Provision of the Organic Law 3/2018 of 5 December
on Personal Data Protection and safeguard of digital rights (hereinafter, LOPDGDD).
II – The Internal Market Information System (IMI)
The Internal Market Information System is regulated by Regulation (EU) Nº 1024/2012
of the European Parliament and of the Council of 25 October 2012 on administrative
cooperation through the Internal Market Information System and repealing Commission
Decision 2008/49/EC (‘the IMI Regulation’). It helps competent authorities of Member
States to fulfil their cross-border administrative cooperation, mutual assistance and
information exchange.
III – Determination of the territorial scope
The art. 66 of LOPDGDD specifies that:
“1. Except for the cases referred to in article 64.3 of this organic law, the Spanish Data
Protection Agency shall, prior to the execution of any other action, including the
admission for processing of a complaint or the commencement of preliminary
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/5
investigation proceedings, examine its competence and determine the national or
cross-border nature of the procedure to be followed, in any of its forms.
2. If the Spanish Data Protection Agency considers that it does not have the status of
lead supervisory authority for handling the procedure, it shall, without any further delay,
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 27/04/2021 14:33:51
refer the complaint submitted to the lead supervisory authority deemed competent, so
that it may be properly addressed. The Spanish Data Protection Agency shall notify
this situation to the person who has submitted the complaint, as the case may be.
The agreement which resolves the referral mentioned in the preceding paragraph shall
imply the provisional filing of the procedure, without prejudice to the Spanish Data
Protection Agency issuing, as appropriate, the resolution referred to in paragraph 8 of
article 60 of Regulation (EU) 2016/679.”
IV – Main establishment, cross-border processing and lead supervisory authority
Article 4(16) of GDPR defines «main establishment»:
El documento consta de un total de 5 páginas. Página 3 de 5.
“(a) as regards a controller with establishments in more than one Member State, the
place of its central administration in the Union, unless the decisions on the
purposes and means of the processing of personal data are taken in another
establishment of the controller in the Union and the latter establishment has the
power to have such decisions implemented, in which case the establishment
having taken such decisions is to be considered to be the main establishment;
(b) as regards a processor with establishments in more than one Member State, the
place of its central administration in the Union, or, if the processor has no
central administration in the Union, the establishment of the processor in the
Union where the main processing activities in the context of the activities of an
establishment of the processor take place to the extent that the processor is
subject to specific obligations under this Regulation;”
According to Article 4(23) of GDPR «cross-border processing» means either:
(a) processing of personal data which takes place in the context of the activities of
establishments in more than one Member State of a controller or processor in
the Union where the controller or processor is established in more than one
Member State; or
(b) processing of personal data which takes place in the context of the activities of a
single establishment of a controller or processor in the Union but which
substantially affects or is likely to substantially affect data subjects in more than
one Member State.
Pursuant to Article 56(1), regarding the competence of the lead supervisory authority,
and without prejudice to Article 55, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall
be competent to act as lead supervisory authority for the cross-border
processing carried out by that controller or processor in accordance with the
procedure provided in Article 60.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/5
In the case under examination, as outlined above, ALTIGI GmbH has its main or single
establishment in Hamburg (Germany) and, therefore, the Hamburg supervisory
authority is the competent authority to act as lead supervisory authority.
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 27/04/2021 14:33:51
V – Concerned Supervisory Authorities (CSAs)
In accordance with Article 4(22) of GDPR, ‘concerned supervisory authority’ means a
supervisory authority which is concerned by the processing of personal data
because:
(a) the controller or processor is established on the territory of the Member State of that
supervisory authority;
(b) data subjects residing in the Member State of that supervisory authority are
substantially affected or likely to be substantially affected by the processing; or
(c) a complaint has been lodged with that supervisory authority;
El documento consta de un total de 5 páginas. Página 4 de 5.
In this procedure, the supervisory authorities concerned are those enumerated in the
fourth fact.
VI – Cooperation and consistency procedure
In the present case, the complaint has been handled according to the procedure
established in Article 60.8, which states the following:
“8. By derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof.”
VII – Subject-matter of the complaint and legal reasoning
The complaint has been lodged at the AEPD in connection with a cross-border data
processing carried out by ALTIGI GmbH because of an alleged infringement of the
following provisions: art. 17 GDPR.
The complaint was transferred to the supervisory authority of Hamburg as the
competent to act as lead supervisory authority within the meaning of Article 56 (1)
GDPR. In accordance with the procedure laid down in Article 60 of the GDPR, the
Hamburg Supervisory Authority has communicated to the authorities concerned the
draft decision, which has been accepted.
In the draft decision, the LSA commented that the screenshots provided by the
claimant did not reflect accurately the events which took place. The data controller
stated that the first e-mail was sent by the complainant to a “no reply” mailbox of the
company. It was in July of 2018 when the petitioner contacted the data controller by e-
mail and was referred to a support webform, which featured a verification process put
in place to request the information needed to consume the online service. He was also
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/5
informed about how he could unsubscribe from the newsletter, if that was what he
wanted.
The defendant went on explaining that the claimant did not follow its instructions, so the
removal process did not finish, and he received a commercial communication on 15 th of
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 27/04/2021 14:33:51
March of 2019. Nevertheless, after learning about the complaint, the defendant has
proceeded to remove the claimant’s personal data, except for those whose
conservation is necessary to comply with legal duties.
The LSA concluded that no data protection infringement was apparent in this specific
case. Indeed, if a data controller offers services through Internet, whose consumption
needs an identifier created by the own user and, possibly, a password, these identity
proofs can be used as part of the authentication process.
After reviewing the draft decision presented by the lead authority, this Agency takes
into account that the defendant, ALTIGI GmbH, has granted the petitioner his right to
erasure and, consequently, considers that it is opportune to dismiss the complaint.
El documento consta de un total de 5 páginas. Página 5 de 5.
Consistently with the conclusions described, it is agreed by the Director of the Spanish
SA:
FIRST: TO DISCONTINUE the proceedings and dismiss the complaint.
SECOND: NOTIFY this decision to the CLAIMANT.
THIRD: INFORM ALTIGI GmbH about the decision adopted.
Pursuant to Article 50 of LOPDGDD, this resolution shall be published after the
notification of the parties concerned.
This resolution finalizes the administrative procedure pursuant to Article 114 (1) (c) of
the Act 39/2015 of 1 October on Common Administrative Procedure of Public
Administration. According to Articles 112 and 123 of the aforementioned Act 39/2015, it
is possible to appeal this decision before the Director of the Spanish SA within a month
starting the day which follows the receipt of this notification. In accordance with Article
25 and Additional Provision 4(5) of the Act 29/1998 of 13 July regulating the Jurisdiction
for Judicial Review, it is also possible directly appeal before the contentious-
administrative division of the Spanish National High Court. Pursuant to Article 46 (1) of
the Act 29/1998, the period for filing for judicial review shall be two months long,
counting from the day following the date of this notification.
1155-100820
Mar España Martí
Director of the Spanish SA
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es