¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Final decision
The present decision refers to the case/complaint of . lodged with the supervisory authority
of Austria (D130.288) and submitted to the Luxembourg supervisory authority via IMI under
Article 61 procedure 73146.
The complaint was lodged against the controller . (hereinafter “ ”), which
has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the Luxembourg
National Data Protection Commission (“CNPD”) is therefore competent to act as lead supervisory
authority.
Scope of the complaint and assessment of the case
The initial complaint on IMI stated that the complainant requested the cancellation of her test offer
and the deletion of her personal data from several times by e-mail. She also claimed
that her request was apparently not granted.
The complaint is thus based on Article 17 GDPR.
Based on said complaint, the CNPD requested the controller to provide a detailed description of
the issue relating to the complainant’s data processing as per Article 58.1 a) GDPR, in particular
as regards to her deletion request.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, the legal representative of the
controller informed the CNPD that the data of the complainant was indeed erased on request back
in 2019, but that due to an human error, the complainant was not informed thereof. A copy of the
new information letter was then send to the CNPD.
Thus, based on the information that was provided, the CNPD is of the view that the issue has been
resolved and/or the exercised right has been attended.
As the complaint has only a limited personal impact, the CNPD has consulted the supervisory
authority of Austria to determine whether the case could be closed. The CNPD and the supervisory
authority of Austria agreed that, in view of the above, no further action or additional measures are
needed and that the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 293747).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission