Final decision
The present decision refers to the case/complaint of . lodged with the supervisory authority
of Germany, Bavaria, (national reference LDA-1085.3-10571/19-I) and submitted to the
Luxembourg supervisory authority via IMI under Article 61 procedure 92645.
The complaint was lodged against the controller . (hereinafter
“ ”) which has its main establishment in Luxembourg. Pursuant to Article 56 GDPR, the
Luxembourg National Data Protection Commission (“CNPD”) is therefore competent to act as
lead supervisory authority.
Scope of the complaint and assessment of the case
The initial wording of the complaint on IMI stated that:
“The data subject states that upon request the deletion of their mobile phone was confirmed,
however, the mobile number is still processed at .” Furthermore, it results from the
complaint that . wished to connect his actual account with said phone number
which was previously associated with an already closed account.
The complaint is thus based on Articles 16 and 17 GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the
issue relating to the complainant’s data processing as per Article 58.1 a) GDPR, in particular as
regards the erasure and/or rectification of the complainant’s phone data.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the enquiry by the Luxembourg supervisory authority, has confirmed that the
closure request was completed and that the complainant should now be able to connect the phone
number from the prior account to his current account.
Thus, based on the information that was provided, the CNPD is of the view that the issue has been
resolved and the exercised right has been attended.
As the complaint had only a limited personal impact, the CNPD has consulted the supervisory
authority of Bavaria (Germany) to determine whether the case could be closed. The CNPD and the
supervisory authority of Bavaria (Germany) agreed that, in view of the above, no further action is
required and that the cross-border complaint should be closed. Also, the complainant considered
the case as resolved.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 295888).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission