Final decision
The present decision refers to the case/complaint of . lodged with the supervisory authority
of Germany, Brandenburg, (national reference 136/18/1112) and submitted to the Luxembourg
supervisory authority via IMI under Article 56 procedure 47964.
The complaint was lodged against the controller
(hereinafter” ”), which has its main establishment in Luxembourg. Pursuant to Article 56
GDPR, the Luxembourg National Data Protection Commission (“CNPD”) is therefore competent
to act as lead supervisory authority.
Scope of the complaint and assessment of the case
The initial wording of the complaint on IMI stated that:
“The complainant requested access to data via E-Mail. Since no answer was received she called
by phone. As an answer she was told that her identity has to be confirmed and that she will
be prompted to send an id-card copy via e-mail in the near future. Since that E-Mail did not
arrive, she tried to log-in to her account but was provided with safety-measures. A code was sent
to her e-mail and she was prompted to verify that code via phone. She states that she did not save
her phone number in the account by herself but that used the number she had used before
to call the first time.”
The complaint is thus based on Articles 5 and 15 of GDPR.
Based on said complaint, the CNPD requested to provide a detailed description of the issue
relating to the complainant’s data processing as per Article 58.1 a) GDPR, in particular as regards
to her right of access as well as the origin and processing of her phone number.
The CNPD received the requested information within the set timeframe.
Outcome of the case
Following the intervention by the Luxembourg supervisory authority, has confirmed to the
CNPD that it received the complainants data access request on 1st June 2018. After confirming
her identity, provided the information to her on 18th July 2018 and she acknowledged
receipt of the information via e-mail on 24th July 2018 (document provided to the CNPD).
Furthermore, the complainant did not provide any further details regarding what data she thinks
has not provided to her.
With regard to the phone number (known by the CNPD), provided information to the CNPD
which specified that the phone number was indeed provided by the data subject when the account
was opened on 14 March 2018.
Thus, based on the information that was provided, the CNPD did not identify any infringement
by the controller of the obligations set out in Regulation (EU) 2016/679 (GDPR) by .
As the complaint had only a limited personal impact, the CNPD has consulted the supervisory
authority of Brandenburg (Germany) to determine whether the case could be closed. The CNPD
and the supervisory authority of Brandenburg (Germany) agreed that, in view of the above, no
further action or additional measures were needed and that the cross-border complaint should be
closed.
Notwithstanding the closure of this case, the Luxembourg supervisory authority might carry out
subsequent actions in exercise of its investigative and corrective powers regarding the data
processing activities in the event of new complaints.
A draft decision has been submitted by the CNPD to the other supervisory authorities concerned
as per Article 60.3 GDPR (IMI entry number 293852).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities concerned
shall be deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission