Final decision
The present decision refers to the case/complaint of . lodged with the supervisory authority
of Germany, Bavaria, (national reference LDA-1085.4-8170/18-I) and submitted to the
Luxembourg supervisory authority via IMI under Article 56 procedure 61900.
The complaint was lodged against the controller (hereinafter
“ ”) which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the
Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope of the complaint and assessment of the case
The initial wording of the complaint on IMI stated that:
“ did not process or did not fully process the complainant's request regarding the access
to the personal data relating to him that is processing.”
The complaint is thus based on Article 15 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the
issue relating to the complainant’s data processing as per Article 58.1 a) GDPR, and in particular
to the request by the complainant to access his personal data processed by .
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, informed the CNPD
that it was not able to locate the letter of the complainant from 2018 attached to the complaint (and
the complainant did not communicate a valid proof of sending either).
confirmed though that the complainant contacted customer service in June
2019 requesting information about his data, how is processing it and in about data that is
shared with third parties.
replied to the complainant’s questions, and provided him with the requested information.
also informed the complainant about what data he could further review in his customer
account and how he could submit a data subject access request the easiest way by logging in into
his customer account and submitting the request via the designated contact form therein. This way
he will be properly identified as holder of the respective customer account for which he requests
the data set for. However, did not hear back from the complainant since last
response to him. He did not communicate any further questions regarding the processing of his
data, nor complications with or refusal to use the contact form to submit the data subject access
request. therefore had assumed that the complainant was satisfied with the information
provided.
Finally, following receipt of the CNPD’s letter regarding the present complaint, contacted
the complainant a second time in order to provide him with the requested data.
Thus, based on the information that was provided, the CNPD is of the view that the controller has
taken appropriate measures to satisfy the complainants’ right of access, pursuant to Article 15 of
the General Data Protection Regulation.
As the complaint had only a limited personal impact, the CNPD has consulted the supervisory
authority of Bavaria (Germany) to determine whether the case could be closed. The CNPD and the
supervisory authority of Bavaria (Germany) agreed that, in view of the above, no further action is
required and that the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 294505).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission