Final decision
The present decision refers to the case/complaint of . lodged with the supervisory authority
of France (national reference 18022393) and submitted to the Luxembourg supervisory authority
via IMI under Article 61 procedure 72561.
The complaint was lodged against the controller (hereinafter
“ ”), which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the
Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope the complaint and assessment of the case
In the initial complaint on IMI, the complainant stated that he was a reviewer on the website
for a few years and that during those years, he published reviews, usually
with photos. Then, according to the complainant, erased every single one of his reviews
without letting him the time to retrieve them. He then contacted in order to retrieve these
reviews without success.
The complaint is thus based on Article 15 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the
issue relating to the complainant’s data processing as per Article 58.1 a) GDPR, in particular as
regards the right of access of . to his personnel data processed by , mainly his
reviews.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, has informed the CNPD
that it had investigated this matter and noted that the request sent by . on 4 September
2018 was not directed internally to the team responsible for processing DSARs and that for this
reason, . was not informed of the actions taken for his request.
After having been contacted by the CNPD, immediately escalated the complainant’s
DSAR to the correct team and acted on the DSAR. apologized for this human error and
confirmed to provide additional training to the relevant teams regarding the DSAR response
process. It also assured that it took further steps to remind the internal departments on how to
recognize a DSAR to ensure that they are routed to the correct team.
Thus, based on the information that was provided, the CNPD is of the view that the issue has been
resolved and the exercised right has been attended.
As the complaint had only a limited personal impact, the CNPD has consulted the supervisory
authority of France to determine whether the case could be closed. The CNPD and the supervisory
authority of France agreed that, in view of the above, the cross-border complaint should be closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 295819).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission