id�c. IPfFClmMTlCH AN13 DATA
PROTEG".011 COM�a.!
Information and Data Protection Commissioner
vs
COMPLAINT
I. Reference is made to the complaint dated the 26th January 2021 lodged by
(the "complainant") against (the
"controller") with the Spanish Data Protection Agency (the "Spanish SA").
2. Having identified that the complaint concerned cross-border processing carried out by a
controller based in Malta, the Spanish SA launched a voluntary mutual assistance notification
1
under article 61 of the General Data Protection Regulation (the "Regulation") to the
Information and Data Protection Commissioner (the "Commissioner"), which accepted to
process the complaint pursuant to article 5 6 ( 1 ) of the Regulation in its capacity as the lead
supervisory authority.
3. In his complaint, the complainant alleged that the controller unilaterally closed his account
without informing him. In addition, he argued that when he requested the controller to erase
his personal data, the controller replied that such data could not be erased and that afterwards,
he requested the controller to grant him access to his personal data. The complainant
concluded that the controller proceeded to comply with his request to exercise his right of
access, but did not provide him with any further information about the right of erasme request
that he had previously filed.
I
Regulation (EU) 2016/679 of the European Parliament and of the Council o f 2 7 April 2 0 1 6 on the protection
of natural persons with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection Regulation).
Page 1 o f 8
Airways House, Second Floor \.. (+356) 2328 7 1 0 0
High Street, Sliema SLM I 549 S [email protected]
MALTA. GI www.idpc.org.mt
id�c. liflAJJJMA1$0Jl MID Dt',TA
PR01ECTt0rl COMMISSIONER
INVESTIGATION
4. Pursuant to article 58(1)(a) of the Regulation, the Commissioner requested the controller to
provide its submissions in relation to the allegations raised by the complainant. In terms of
this Office's internal investigation procedure, the controller was provided with a copy of the
complaint together with the relevant supporting documents.
5. On the I Jlh June 2 0 2 1 , the controller submitted the following principal legal arguments for
the Commissioner to take into consideration during the legal analysis of the case:
111
1. that the complainant's "account was initially opened on the 6 o
f October 2020 with
1
his final activity occurring on the 21' o
f January 2021 ";
ii. that the controller "contacted [the complainant] on 1 O'h ofJanuary 2021 to inform him
that his account would be closed within fourteen (] 4) days in accordance with clause
4.2(b) of its Terms and Conditions and Art. 85.4 ofRoyal Legislative Decree 1/20070/
November 16 ";
1
111. that the controller "subsequently contacted [the complainant] on the 26 h o
f January
2021, after the fourteen (14) day notice period had elapsed, to inform him that his
account had been closed;
1
iv. that the complainant "contacted [the controller] on the 26 h ofJanuary 2021 to request
the deletion of his personal data and on the 2 8'" of January 2021 to make a subject
access request";
v. that on the 1 5 th February 2 0 2 1 , the controller complied with the complainant's right
of access request by providing him with the requested information and personal data
by means of an email;
-------------.· --thaUhe Commi.s&iQ.AU-was providlld witb a copy of the-t�-H--aR4-a,-------
copy of a screenshot taken after the email was sent, which demonstrates that the email
was delivered on the 15th February 2021 at 0 2 : 0 8 : 5 5 ;
Page 2 of8
idJ;!f:
vii. that in relation to the complainant's right of erasure request, the controller held that it
operates in Spain and therefore, it is licensed and regulated by the Directorate General
for the Regulation of Gambling in Spain, which means that it "is required to comply
with applicable Spanish laws and regulations and the obligations that they impose.
One such legal obligation is the requirement to retain relevant data for the minimum
period mandated under Law 10/2010, of 28 April, prevention o
f money laundering
and terrorism financing".
6. By means of an email dated the 1 5 t h June 2 0 2 1 , the Commissioner requested the controller to
provide further information in relation to its legal obligation to retain data subjects' personal
111
data. On the 18 June 2 0 2 1 , the controller submitted the following considerations:
i. that the controller is subject to the legal obligation, specifically "[a]rticle 25 of
Spanish Law 10/2010 of 28 April, prevention o
f money laundering and terrorism
financing . . . which states that 1) Obliged persons shall keep the documentation
gatheredfor the compliance with the obligations under this Actfor a minimum period
of ten years. In particular, obliged persons shall keep for its use in any investigation
or analyses of possible money laundering or terrorist financing by the Executive
Service or by other competent authorities: a) Copy of the documents required under
the customer due diligence measures for a minimum period of ten years from the end
of the business relationship or the date of the transaction. b) Original or evidentiary
copy admissible in court proceedings, o
f the documents or records duly evidencing
the transactions, their participants and the business relationships, for a minimum
period of ten years from the date of the transaction or from the end o
f the business
relationship";
ii. that the controller further provided that "obliged persons" is defined as "[pjersons
responsible for the management, operation and marketing of lotteries or other
gambling activities in respect ofprize payment transactions", and that in this regard,
the controller, being a fully licensed and regulated operator of online gambling
services in Spain, falls squarely within the meaning of"obliged persons";
iii. that the controller also confirmed that "during [the] retention period, [it] will only
process the complainant's data in compliance with [its] legal and regulatory
requirements. In accordance with applicable law, [the controller is] obliged to keep
Page 3 of8
id�c.
PIA)RMAT!OH ,ANO CM.11\
PROTE.CTION CIJMl.!l!i51ml01
the complainants' personal data at the disposal of competent authorities for the
purpose o
f enforcing any possible liabilities arising from the processing and only for
the period o
f limitation o
f such liabilities, which is 1 0 years";
iv. that additionally, the controller confirmed that the retained data will be "blocked [and]
not be processed for any purpose other than [the ones] as set out above . . . Once such
period has elapsed, the data be definitively deleted in accordance with article 32 of
Organic Act 3/2018, o
f 5 December, on the Protection o
f Personal Data and
Guarantee o
f Digital Rights".
LEGAL ANALYSIS AND DECISION
The exercise of the right of access
7. Having examined article 1 5 of the Regulation, which grants the data subject the right to access
his or her personal data by stipulating that "[t}he data subject shall have the right to obtain
from the controller confirmation as to whether or not personal data concerning him or her
are being processed[ . . . ] " and specifically article 1 5 ( 3 ) thereof, which establishes that "the
controller shall provide a copy of the personal data undergoing processing[ . . . ] " ;
8. Having noted article 1 2 ( 3 ) of the Regulation, which aims at ensuring the efficient exercise of
data subjects' rights and obliges the controller to "provide information on action taken on a
request under Articles 15 to 22 to the data subject without undue delay and in any event within
one month of receipt o
f the request."
9. During the course of the investigation, it transpired that the complainant submitted the request
111
to exercise his right of access on the 28 January 2021 and consequently, the controller
1h
complied with the request on the 15 February 2 0 2 1 , by providing the complainant with a
copy of his personal data undergoing processing and the supplementary information pursuant
to article 1 5 of the Regulation, within the statutory period as set forth in article 12(3) of the
Page 4 of 8
The exercise of the right to erasure
10. Having established that in terms of article 1 7 ( 1 ) of the Regulation, "[t]he data subject shall
have the right to obtain from the controller the erasure ofpersonal data concerning him or
her without undue delay and the controller shall have the obligation to erase personal data
without undue delay" where one of the grounds listed in article 17(1)(a) to (f) applies.
However, this rule is subject to a number of exceptions, in particular article 17(3)(b) of the
Regulation, which states that the right to erasure shall not apply "for compliance with a legal
obligation which requires processing by Union or Member State law to which the controller
is subject[ . . . ] " [emphasis has been added].
1h
11. Having established that on the 26 January 2 0 2 1 , the complainant filed a valid request to erase
his personal data with the controller.
12. Having examined the controller's submissions on this matter, the Commissioner established
that indeed, processing by the controller is necessary because the controller is subject to a
compelling legal obligation under Member State law which requires such processing.
The provision of information in relation to the right of erasure request
13. Having given due regard to the fact that data protection rights as enshrined in articles 1 5 to 22
of the Regulation are intrinsically related to the transparency requirement, as held in articles
5(1)(a) and 12 of the Regulation. The rationale behind article 12 is to ascertain that the
substantive rights of the data subjects are adequately safeguarded, specifically, by defining
the technical and procedural conditions as to how and when the controller shall communicate
with the data subjects in relation to their data protection rights.
14. For the purpose of this legal analysis, the Commissioner examined the reply provided by the
controller on the 27th January 2021 in relation to the request submitted by the complainant to
erase his personal data, wlrei e i u the complainant was iuforuied lhat "[t]u comply with the legal
and license requirements of as well as our own Inner risk management procedures,
we cannot remove your personal information [ . . . ]. We will store your personal data as long
as you are customer, and we will ensure that they are protected appropriately and
usedjust for legitimate purposes. Ifyou are not customer anymore, we will store your
data while it is necessary to comply with the current legal and regulation requirements. Ifyou
Page 5 of 8
id�c.
11,fF0.'8..\AtlON A.ND a.ii['°'
PFla"IEOIDN COU..Ml!iSICINER
wish to obtain information about how we process your personal data, as well as our legitimate
interests to do it, please consult the Privacy Policy in our website, which can be accessed
clicking on "Privacy Policy" at the bottom of the website'",
1 5 . The first general obligation laid down in article 12(1) of the Regulation states that the
"controller shall take appropriate measures to provide information referred to in Articles 13
and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the
data subject in a concise, transparent, intelligible and easily accessible form, using clear
and plain language [. . . ] " [emphasis has been added]. Accordingly, the Guidelines on
3
Transparency under Regulation 2016/679 provide that the controller shall "comply with the
principle of transparency (i.e. relating to the quality o
f the communications set out in Article
1 2 . 1 when communicating with data subjects in relation to their rights under Articles 15 to
22 and 34 ", In this respect, the nature of the information provided shall meaningfully position
the data subject in such a manner to enable him or her to ascertain the lawfulness of the
personal data undergoing processing and, if necessary, challenge the process.
16. Having established that, with specific reference to the exercise of the rights of the data subject
under Chapter III of the Regulation, including the right to erasure, the overarching principle
of transparency enshrined in the Regulation, as transposed inter alia into its article 12(1),
requires that a reply to a data subject's request which contains the reason for not complying
in terms of the exceptions provided by the Regulation should be formulated in a concise,
transparent, and easily accessible manner and using clear and plain language.
1 7 . After examining the reply provided by the controller in relation to the right to erasure
exercised by the complainant on the 26th January 2 0 2 1 , the Commissioner noted that the
controller simply referred the complainant to its Privacy Policy, and merely informed him that
the processing of his personal data is necessary to comply with the legal and regulations
requirement, without specifying the legal obligation to which the controller is subject.
1 8 . As a consequence, the Commissioner has established that the controller's reply of the 27th
January 2021 contravened the requirements of article 1 2 ( 1 ) of the Regulation due to the fact
2
The original text of this email was in Spanish. The text reproduced in this legally binding decision is an
unofficial English translation provided by the Spanish SA, acting as the concerned supervisory authority.
3
Adopted by the Article 29 Data Protection Working Party on the 29th November 2 0 1 7 , as last revised and
adopted on the I l " April 2 0 1 8 .
Page 6 o f 8
that the controller failed to communicate with the complainant in a concise, transparent, and
easily accessible manner, using clear and plain language in relation to the exercise of the right
of erasure by the same complainant.
1 9 . The fact that the controller failed to efficiently and concretely present the information in such
a manner to enable the complainant to easily understand the legal obligations which require
the controller to continue processing his personal data even after the termination of the
business relationship for the period set forth in the applicable law adds to the gravity of the
controller's infringement.
On the basis of the foregoing considerations, the Commissioner hereby decides that:
i, on the basis of the evidence gathered during the course of the investigation, the controller
complied with the right of access request under article 15 of the Regulation submitted
by the complainant on the 28th January 2021, by providing the complainant with a copy
of his personal data undergoing processing and the supplementary information
pursuant to article 15 of the Regulation and within the stipulated time-frame set forth
in article 12(3) of the Regulation;
ii. the exemption of article l 7(3)(b) of the Regulation applies in relation to the
complainant's request to exercise his right to erasure under article 1 7 of the Regulation
1
of the 26 h January 2021 due to the fact that processing by the controller is necessary for
compliance with a legal obligation under Member State law; and
iii. the controller's response to the complainant's request to exercise his right to erasure
under article 17 of the Regulation of the 27th January 2021 did not comply with the
requirements set forth in article 12(1) of the Regulation.
In terms of article 58(2)( d) of the Regulation, the controller is hereby being ordered to provide
1
the complainant with a reply to his right to erasure request dated the 26 h January 2021, in a
--------e-a-aee,eiisse.e,;-1t:-l'F&llRR:SS1fJEJ18Hl'e'e>fln+t-ft-l&ft&-Casily 11eeess1 a:�gee,.-1ilflDHJJEttllHr'lt1it�itt'.--------
by including.in the response information relating to the specific legislation which obliges the
controller, qua obliged person, to comply with the requirements deriving therefrom and retain
personal data for the prescribed timeframes.
Page 7 of8
id��
This order shall be implemented within ten (10) days from the date of receipt of this legally
binding decision, and the controller is requested to inform the Commissioner with the action
taken to comply with such order immediately thereafter.
By virtue of article 83(6) of the Regulation, any failure by the controller to implement the
Commissioner's instructions shall be subject to further corrective action, as specified therein.
('-
Decided today, the J.f, day of October, 2021
Page 8 o f 8