Final decision
The present decision refers to the case/complaint of . lodged with the supervisory
authority of Denmark (national reference 2018-31-0530) and submitted to the Luxembourg
supervisory authority via IMI under Article 56 procedure 58117.
The complaint was lodged against the controller (hereinafter
“ ”), which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the
Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope of the complaint and assessment of the case
In the original IMI case, the complainant stated that:
- (1) it was not possible to access his personal data linked with all the
in a single request (a separate request has to be done separately on each
), and that
- (2) the website did not offer the data subjects the possibility to access
their personal data.
The complaint is thus mainly based on Article 15 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the
issue relating to the complainant’s data processing as per Article 58.1(a) GDPR, in particular as
regards to the possibility for data subjects to obtain their personal data linked with all
in a single request.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, has demonstrated that:
- As for point (1), was already, back in 2018, in the process of putting in place a
technical solution allowing data subjects to access their personal data linked with all their
accounts in a single request. Thus, it is thus now possible for every
customers to request their personal data from all in one single
request.
- As for point (2), unlike for the (e.g.,
), the personal data processed in the context of the
website are controlled by a U.S. based company ( ),
for which the CNPD is not the competent supervisory authority. In addition, the website
has also implemented, in the meantime, a tool for customers to access their
personal data linked with their account on . This point has been confirmed
by the complainant who indicated that this issue has been solved satisfactorily.
Thus, based on the information that was provided, the CNPD is of the view that the issue has been
resolved and the CNPD has consulted the supervisory authority of Denmark to determine whether
the case could be closed. The CNPD and the supervisory authority of Denmark agreed that, in
view of the above, no further action or additional measures are needed and that the cross-border
complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 294504).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission