Final decision
The present decision refers to the case/complaint of . lodged with the supervisory authority
of Germany, Brandenburg, (national reference 136/18/1621) and submitted to the Luxembourg
supervisory authority via IMI under Article 56 procedure 58964.
The complaint was lodged against the controller (hereinafter
), which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the
Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope of the complaint and assessment of the case
The initial wording of the complaint on IMI stated that:
“Data subject alleges that did not sufficiently gave access to all data and in particular
regarding a commercial dispute between and the complainant.”
The complaint is thus based on Article 15 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the issue
relating to the complainant’s data processing as per Article 58.1 a) GDPR, in particular to grant
the complainant access to his personal data that is processing regarding the above-
mentioned dispute the basis of claim.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, has demonstrated the
following:
- The complainant had multiple email addresses associated with his account. Following an
in-depth investigation, records showed that had not received a data access
request from either of the email addresses associated with the complainant, ‘XXX1’ or
‘XXX2’ (known by the CNPD).
- With respect to the commercial dispute, reviews showed that the complainant
opened a complaint. reached out to the complainant for more information but
did not receive a response from him. Thus, the case was closed in favor of the
. Upon closure of the complaint, automated
email, sent on 6 December 2015, advised t and
was then showing as negative. received the complainant’s request for
to provide the reason for the . The complainant was
subsequently sent the information in an automated email which included the reason for his
negative as being the complaint which was found against him.
- contacted the complainant to outline to him how he can submit his Data Access
Request and provide him with more information.
Thus, based on the information that was provided, the CNPD did not identify any infringement by
the controller of the obligations set out in Regulation (EU) 2016/679 (GDPR) by .
As the complaint had only a limited personal impact, the CNPD has consulted the supervisory
authority of Brandenburg (Germany) to determine whether the case could be closed. The CNPD
and the supervisory authority of Brandenburg (Germany) agreed that, in view of the above, no
further action was required and that the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 294755).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission