Berlin Commissioner for
Berlin DPA: 521.10949 / 632.201 Data Protection and
Freedom of Information
French DPA: 18022379
A56ID 60758 Friedrichstr. 219
10969 Berlin
CR 63286
Visitors’ entrance:
Puttkamer Str. 16-18
Final Decision
The building is fully accessible to
disabled members of the public.
Berlin, 7 June 2021
Contact us
Phone: +49 (0)30 13889-0
Fax: +49 (0)30 215 50 50
Use our encrypted contact form
for registering data protection
complaints:
www.datenschutz-berlin.de/be-
For your information: schwerde.html
For all other enquiries, please
send an e-mail to:
[email protected]
Fingerprint of our
PGP-Key:
D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
Reprimand
Complainant: Mr [redacted]
Office hours
Your letters of 30 April 2019 and 27 November 2020
Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
(or by appointment)
Dear Sir or Madam,
How to find us
The Berlin Commissioner for Data Protection and Freedom of Infor-
The underground line U6 to
mation (Berlin DPA) hereby issues a reprimand to your company for a Kochstraße / Bus number M29
violation of the General Data Protection Regulation (GDPR). and 248
Reasoning Visit our Website
https://privacy.de
The decision is based on the following considerations:
I.
The Berlin DPA has established the following facts:
In a message dated 29 April 2018, the complainant requested
to erase his personal data and to close his customer account. The erasure
was confirmed to the complainant by in an email dated 30 April
2018. In his complaint of 8 November 2018, the complainant submitted that
a few months after the erasure had been confirmed to him, he had received
an email from informing him that the email address of his cus-
tomer account had been changed. The complainant then confronted
by e-mail with the fact that his customer account should have
been erased long ago. The customer account was finally erased by
on 26 March 2019.
-2-
In the statement of 30 April 2019, you informed us that the non-erasure
could possibly be related to the reorganisation of internal processes with re-
gard to the applicability of the GDPR. The erasure of the customer account
on 26 March 2019 had been carried out due to a query with the customer
service department by the legal department in an entirely hasty manner and
without consultation by the customer service department. However, the fact
that the account was not initially deleted could possibly be due to the fact
that there were obstacles. However, it is no longer possible to clarify the
facts of the case because the customer account has been erased.
is of the opinion that the facts of the case should be assessed solely ac-
cording to the old legal situation.
In the statement of 27 November 2020, you described the procedure in the
event of a deletion request. Before erasure, it is always checked whether
there are obstacles such as open orders or open invoice amounts. If this is
not the case, the customer account is first deactivated and then erased.
Otherwise, the customer would be informed about the existence of the spe-
cific reason for obstruction. Furthermore, you pointed out that the display of
the data in Annexes 3 and 4 (Annex 3: _hacking and Annex 4:
_question) differed from the display of the data in Annexes 1 and 2
( Annex 1: _contact and Annex 2: _answer), so that, de-
pending on how the data was read (DD/MM/YY or MM/DD/YY), it was also
possible that the e-mail address in the customer account had been
changed before the request for deletion. In this respect, a manipulation by
the complainant could not be ruled out. Before the erasure, a check by the
customer service had shown that there were no indications of fraudulent
activities.
II.
Legally, we assess the facts as follows. Your company has committed a vi-
olation of the General Data Protection Regulation.
1. Violation of Article 17(1)(a) and (b) GDPR.
The failure to erase the complainant's customer account constitutes a viola-
tion of Article 17(1)(a) and (b) in conjunction with Article 6(1), Article 5(1)
GDPR.
The GDPR applies in the present case, as the failure to erase or, in a simi-
lar way, the continued storage of the complainant's data is data processing
which, although it started before the GDPR applied, was still ongoing on 25
May 2018 and beyond. The complainant's request for erasure was made on
29 April 2018 and thus before the GDPR applied. However, it is undisputed
that the complainant's request was not complied with until 26 March 2019,
i.e. after the deadline. The supervisory complaint was lodged on 8 Novem-
ber 2018 and thus also after the effective date.
With the applicability of the General Data Protection Regulation, the na-
tional law of the Member States ceased to apply. Pursuant to Article 99(2)
GDPR, the General Data Protection Regulation has been directly applica-
ble since 25 May 2018 (effective date). Data processing that started before
25 May 2018 and continued beyond 25 May 2018 must comply with the re-
quirements of the General Data Protection Regulation as of the effective
date (cf. recital 171 pp. 2; Taeger/Gabel/Golland, GDPR, 3rd ed. 2019, Arti-
cle 99 marginal no. 5; cf. also FG Saarland, decision of 03.04.2019, Ref: 2
-3-
K 1002/16 = DStRE 2019, 1226, marginal no. 10). The lawfulness of data
processing as of 25 May 2018 must therefore be assessed in accordance
with the GDPR, even if it began before the effective date.
Pursuant to Article 17(1) GDPR, if one of the listed grounds applies, the
data subject has the right to obtain from the controller the erasure of per-
sonal data concerning him or her without undue delay and the controller
shall have the obligation to erase personal data without undue delay. If one
of the grounds pursuant to Article 17(1) GDPR applies, the controller is also
obliged to erase the data immediately, irrespective of the data subject's re-
quest. Erasure is immediate if it takes place without undue delay.
Article 17(1)(a) to (c) GDPR concern cases in which initially lawful data pro-
cessing has become unlawful (BeckOK/Worms, Datenschutzrecht, 34th
ed., Article 17 GDPR, para. 24). In the present case, it is assumed that the
data processing based on the customer relationship was initially lawful
within the meaning of Article 6(1) and Article 5(1) GDPR.
However, with the declaration of the request for erasure on 29 April 2018,
the purpose of processing ceased to exist (Article 17(1)(a) GDPR). Accord-
ingly, a reason for erasure exists if the personal data are no longer neces-
sary in relation to the purposes for which they were collected or otherwise
processed. If a customer relationship is terminated, the data processing is
usually no longer necessary (cf. Paal/Pauly/Paal, GDPR, 3rd ed. 2021, Arti-
cle 17 marginal no. 23). By requesting the closure of the customer account,
the complainant initiated the end of the customer relationship, so continued
storage of the data was no longer necessary within the meaning of Article
6(1)(b) GDPR.
Insofar as the processing was based on consent, the reason for deletion
pursuant to Article 17(1) (b) GDPR also exists. Accordingly, the personal
data must be deleted if the data subject withdraws consent and there is no
other legal basis for the processing. The request for erasure implicitly in-
cludes the withdrawal of consent within the meaning of Article 7(3) sen-
tence 1 GDPR (Sydow/Peuker, GDPR, 2nd ed. 2018, Article 17 marginal
no. 20). The erasure request continues to apply from the day of the decla-
ration until the day of fulfilment of the claim, so that regardless of the old le-
gal situation, you were in any case obliged to erase without delay from the
effective date of 25 May 2018 in accordance with Article 17(1)(b) GDPR. In
view of the change in the legal situation, the complainant did not have to re-
issue his request for deletion, as the legal basis Article 6(1)(a) GDPR had
ceased to exist. Notwithstanding the fact that Article 17(1) GDPR does not
require a request anyway, as there is an obligation to delete regardless of
the request, such a requirement would disadvantage the data subject if the
request for deletion was - as in this case - unjustifiably not complied with.
This would contradict the protective purpose of the data subject's rights.
In any case, the retention of the complainant's data in the period between
25 May 2018 and 26 March 2019 (date of erasure) is also not permissible
in any other way pursuant to Article 6(1) GDPR.
As explained, Article 6(1)(a) GDPR cannot be considered as a legal basis,
as the consent was in any case withdrawn in an implied manner by the re-
quest for erasure.
Furthermore, the retention of the personal data cannot be based on Article
6(1)(f) GDPR, as there was no overriding legitimate interest in not erasing
-4-
the data. The interests can be of a legal, economic or non-material nature
(BeckOK Daten-schutzR/Albers/Veit GDPR, 34th ed., Article 12 para. 18).
The controller bears the burden of proof for the existence of the conditions
for data processing and thus for the existence of legitimate interests (cf.
also Gola/Schulz, GDPR, 2nd ed. 2018, Article 6 marginal no. 7).
has not demonstrated legitimate interests in the form of the existence of
obstacles. The mere possibility that grounds for obstruction might have ex-
isted does not constitute proof.
Furthermore, there are no actual indications for the existence of grounds for
obstruction, e.g. in the form of outstanding invoices, which would have to
be taken into account in the context of Article 6(1)(b) GDPR anyway. This
view is supported by the fact that the hasty erasure on 26 March 2019
would probably not have taken place if reasons for the failure to erase the
data at that time had been apparent to the customer service when re-exam-
ining the process. Rather, the hasty catching up of the erasure suggests
that the customer service recognised its own omission in this respect and
attempted to rectify it. Furthermore, states in its submission of
27 November 2020 that, as a matter of principle, a review of the grounds
for obstruction takes place as a standard procedure prior to every erasure.
Why such a check should not have taken place in this case, of all cases, is
not explained. The confirmation of erasure sent to the complainant on 30
April 2018 is rather an indication that the conditions for erasure already ex-
isted at that time.
Finally, you cannot successfully invoke one of the exceptions under Article
17(3) GDPR. In this respect, only Article 17(3)(e) GDPR applies. There
were no indications that you or the complainant would need the data for the
assertion, exercise or defence of legal claims at the time of the request for
deletion. The facts of the case could no longer be determined in detail be-
cause the erasure was carried out too quickly. Insofar as you have put for-
ward the existence of obstacles as a possible reason for non-erasure, the
mere theoretical possibility is not sufficient to fulfil the exceptional circum-
stances. As already explained, there are no factual indications for the exist-
ence of obstacles.
2. Violation of Article 6(1) GDPR.
The continued storage of the complainant's personal data also constitutes a
violation of Article 6 (1) GDPR. The permissibility of data processing follows
the principle of prohibition with an exception. Accordingly, any data pro-
cessing must satisfy both the principles set out in Article 5 GDPR and at
least one of the legal grounds set out in Article 6(1)(a) to (f) GDPR. The
continued storage of the complainant's personal data constitutes pro-
cessing relevant under data protection law. A legal basis for the continued
storage of the data after the request for erasure has been made is not ap-
parent, as none of the conditions mentioned in Article 6(1)(a) to (f) GDPR
apply.
You have the burden of proof for the existence of a permissible condition
(Article 6(1), Article 5(1)(a) and (2) GDPR). You have not met this burden of
proof, and according to the above explanations, there is no indication that a
permissive circumstance existed.
As already explained, the complainant has in any case impliedly revoked
any consent within the meaning of Article 6(1)(a) and Article 7(3) GDPR by
-5-
declaring his request for erasure, so that the continued storage of the com-
plainant's personal data cannot be based on Article 6(1)(a) GDPR. Article
6(1)(b) GDPR is not a legal basis, as the complainant has terminated the
customer relationship with and further storage of his personal
data was therefore no longer necessary. The continued storage cannot be
based on Article 6(1)(f) GDPR either, as has not proven the ex-
istence of legitimate interests in any case. Moreover, there is no necessity
for the continued storage, so that Article 6(1)(c) to (e) GDPR cannot be
considered as a legal basis either.
With regard to the e-mail stating that the e-mail address of the customer ac-
count had been changed, the facts of the case could not be clearly estab-
lished.
III.
As a result, we decided not to take any further supervisory measures due to
the violation, but to leave it at a reprimand.
The reprimand is based on Article 58(2)(b) GDPR.
Taking into account the specific circumstances of the established facts, we
consider a reprimand to be appropriate after completing our investigation.
We have again identified a violation on your part, which, however, was
based in the past and should no longer occur as a result of the processes
that have been changed in the meantime. You have comprehensively
changed your processes and corrected the error immediately after it was
identified.
In the certain expectation that you will comply with the data protection regu-
lations in the future, we consider the matter closed.
Kind regards,
The Berlin DPA