Final decision
The present decision refers to the case/complaint of . lodged with the supervisory authority
of France (national reference 18019666) and submitted to the Luxembourg supervisory authority
via IMI under Article 61 procedure 77871.
The complaint was lodged against the controller (hereinafter “ ”
which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the Luxembourg
National Data Protection Commission (“CNPD”) is therefore competent to act as lead supervisory
authority.
Scope of the complaint and assessment of the case
The initial wording of the complaint on IMI stated that:
“The complainant asked to delete his account from its platform as well as all
information about the books he published. did not comply with his request. has
answered him that it does not remove the pages in order to help clients to easily find
information about authors they like. told the complainant that it could only dissociate his
email address from the page. This reply does not seem satisfactory in respect with the
deletion request of the complainant.”
The complaint is thus based on Article 17 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the
issue relating to the complainant’s data processing as per Article 58.1(a) GDPR, in particular as
regards the refusal by the controller to remove the complainant’s page and to erase his
books references from s websites.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Although the complainant framed his request as an exercise of his rights as a data subject under
the GDPR, both GDPR and copyright laws are relevant to defining the scope of rights
and their obligations in this case.
Indeed, under EU copyright law, where a copyrighted work is legally purchased or acquired by
another owner, it may subsequently be sold and resold without restriction (see Article 4 of
Directive 2001/29/EC of 22 May 2001). The exhaustion of right principle applies to copies of
works legally sold into circulation at his own request. Accordingly, any third-party sellers
has the right to resell any of those copies of the Books legitimately acquired, including used copies
of the Books, on websites via the . And indeed offers customers
the opportunity to find out-of-print books through , which is similar to a used
bookstore and lists a wide selection of titles for customers' reference and convenience.
name is displayed on the Page and pages only for informational purposes in
association with the Books he has authored. This information was released to and the
public by . for the purpose of commercially trading his Books. is therefore entitled
under copyright law to display name on the product detail pages and on Page for
purposes of enabling the legitimate, non-infringing sale of s Books. In particular, although
will no longer fulfil new orders placed for the Books, it remains possible that someone
could wish to sell a used copy of the Books on websites; in that case the
pages would be needed to enable that sale.
Considering its compliance with Article 17 GDPR in the context of erasure request, the
GDPR permits to continue to process name for the abovementioned purpose,
as no grounds for erasure apply under Article 17(1) GDPR. In particular, the processing of
name for this purpose is still “necessary in relation to the purposes for which [it was]
collected or otherwise processed” as contemplated in Article 17(1) a); the accurate identification
of Books authored by and lawfully offered for sale to consumers is an “overriding
legitimate ground” for processing as contemplated in Article 17(1)(c); and none of the other
grounds set forth in Article 17(1) is relevant in this case.
In addition, has described the context of making books available for sale on
and of claiming of his page, so that the Supervisory authority/ies can
gain a complete understanding of the abovementioned rationale for the subject erasure request:
In October 2014, . registered for the service and self-published two books
for sale on . In November 2014, another book was also made available for sale on
. (Collectively, the “Books.”) He chose to offer the Books in printed physical format and
enabled distribution rights on several . He also accepted terms and conditions under
which granted a right to use information identifying and describing the Books
(e.g., title, author, synopsis) on the website.
explains that product detail pages are where customers can go to find information about
specific product listings on so that customers may learn about products offered for
sale. Detail pages include all offer details available for a particular product, including offers for
new copies as well as used copies which are sold by third party selling partners via the
. On December 8, 2018, . disabled sales rights for the self-published Books,
meaning that future sales of new copies of the self-published Books were discontinued. Consistent
with the rights granted by ., however, information about the Books remained visible on
detail pages in order to enable listings of used copies.
. also used service. explains that this service allows
authors to claim and enhance the for their books within . r
pages are one way organizes its catalog to help customers find titles they are interested
in, and can be accessed by clicking on t . The
page consists of a list of all the books in their store by that . By claiming the page
for their books in authors confirm their identity as the author of their books
, e.g.,
biographical information, photos, details about book tours
. The author is able to add,
modify, and delete this additional information from the author page via the tools
as well as by contacting . In September 29, 2014, claimed his
by confirming his identity as the author of the Books through his Account
linked to his email address.
Finally, without prejudice to the explanations above, has exceptionally and voluntarily
resolved request by removing the detail pages and Page from their
websites, considering that there are no used copies of the Books currently offered on
websites.
has also demonstrated that they informed accordingly by email, and provided the
CNPD with a copy of this communication.
Thus, based on the information that was provided, the CNPD is of the view that the controller has
taken appropriate measures to satisfy the complainants’ right to erasure, pursuant to Article 17 of
the General Data Protection Regulation.
The CNPD has consulted the supervisory authority of France to determine whether the case could
be closed. The CNPD and the supervisory authority of France agreed that, in view of the above,
no further action is required and that the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 294749).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission