Final decision
The present decision refers to the complaint of . lodged with the supervisory authority of
Germany, Hamburg, (national reference D51/2470/2018) and submitted to the Luxembourg
supervisory authority via IMI under Article 56 procedure 57757.
The complaint was lodged against the controller (hereinafter
“ ”), which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the
Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope of the complaint and assessment of the case
The initial wording of the complaint on IMI stated that:
“A German client of the has requested Access to his personal data.
did not send the data directly but sent him information on how to download it. The complainant is
convinced that this way is not reasonable.”
The complaint is thus based on Article15 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the
issue relating to the complainant’s data processing as per Article 58.1(a) GDPR, in particular as
regards the reasons why advised to log into his account and then go
on an webpage where he could request his personal data, instead of complying with the
access request directly. The CNPD also requested to comply with the complainant’s data
access request.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, has demonstrated that:
- accepts data subject access requests through various channels but needs to
properly identify the requestor as holder of the respective customer account in order to
make sure to only disclose personal data to the respective data subject.
- The easiest way for the customer to identify themselves, is indeed to log into their
account and submit their request via the designated contact form. However, if the customer
does not want this, clearly stated that it will also comply with other ways of
identification.
- In the case at hand, did not refuse the subject access request but was not
able to properly identify . on the basis of his e-mail and therefore asked him to
preferably use the designated contact form in his customer account.
- Following receipt of the CNPD letter regarding s complaint, n contacted the
customer asking him to confirm that he is requesting access to his personal data.
- informed the CNPD that confirmed that he was requesting access to his
personal data and that was going to work on his data set immediately and make it
available to . once completed.
Thus, based on the information that was provided, the CNPD is of the view that the controller has
taken appropriate measures to satisfy the complainants’ right of access pursuant to Article 15 of
the General Data Protection Regulation.
As the complaint has only a limited personal impact, the CNPD has consulted the supervisory
authority of Hamburg (Germany) to determine whether the case could be closed. The CNPD and
the supervisory authority of Hamburg (Germany) agreed that, in view of the above, no further
action or additional measures are needed and that the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 294009).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission