ÚŘAD PRO OCHRANU OSOBNÍCH
ÚDAJŮ
Pplk. Sochora 27, 170 00 Praha 7
*UOOUX00DULVQ*
tel.: 234 665 111, fax: 234 665 444
[email protected], www.uoou.cz
Ref. UOOU-00776/21-6
RESOLUTION
The Office for Personal Data Protection (hereinafter “the Office”), in its capacity of the
competent administrative authority pursuant to Article 64(1) of the Act No. 110/2019 Coll.,
on personal data processing, and to Article 58(1)(d) of the Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation), has decided on
17 May 2021 as follows:
The case concerning the suspected company company identification number
established at which
allegedly have committed an offence pursuant to Article 62(1)(c) of the Act
No. 110/2019 Coll., on personal data processing. The company, despite a request from
of 17 March 2020 for erasure of his personal data, contacted him anew
on 4 May 2020 via e-mail containing yet another marketing communication. The company,
by this action, has allegedly breached the data subject´s rights laid down in Article 17(1)(c) of
the Regulation (EU) 2016/679, specifically the right obliging the controller to erase personal
data without undue delay concerning the data subject, if this particular data subject objects
to the processing pursuant to Articles 21(1) and 21(2),
is pursuant to Article 65 of the Act No. 110/2019 Coll., on personal data processing,
discontinued the proceedings.
Reasoning:
The Office received on 17 January 2021 via the IMI system, a complaint lodged originally
with the Office for Personal Data Protection of the Slovak Republic by
concerning an unlawful processing of his personal data in relation to sending of marketing
communications. The complainant stated in his complaint of 5 May 2020 that he, on a not-
specified day, made an order for goods at the e-shop On 17 May
2020, at 17:29 hrs, he obtained an e-mail message from the customer service of this e-shop
informing him that the ordered item was dispatched to him on 16 May 2020. On the same
day, the complainant received a letter from the e-shop file number
signed by informing him that the ordered item was
sold out and the order could not be accommodated. With regard to these two contradicting
1/4
pieces of information the complainant had lost confidence in the given e-shop and had
withdrawn his order on the very same day at 20:13 hrs and simultaneously asked for erasure
of his personal data provided to the company in relation with the order. He sent the reque st
for the order withdrawal as well as for the erasure of his personal data to the customer
service to the e-mail address He backed his statements by
a copy of the given e-mail communication. On 20 March 2020 the complainant received an
answer form the customer service, sent from the address ,
saying that the company respected his wishes and would refrain from any sending of offers .
The company added further that database of offers was set up in advance, i.e. it was created
yet before the complainant´s request for erasure was filed. The company also apologized for
the case, if still the complainant would in the coming days obtain a marketing offer. Despite
the complainant´s request for erasure, the suspected company sent him electronically
marketing offers of the e-shop whereas the last offer was sent by e-mail
on 4 May 2020 at 12:38 hrs. A copy of the marketing offer was attached as well.
As per Article 21(2) of the Regulation (EU) 2016/679, where personal data are processed for
direct marketing purposes, the data subject shall have the right to object at any time to
processing of personal data concerning him or her for such marketing, which includes
profiling to the extent that it is related to such direct marketing. Pursuant to paragraph 3 of
the mentioned article, where the data subject objects to processing for direct marketing
purposes, the personal data shall no longer be processed for such purposes . Pursuant to
Article 12(3) of the Regulation (EU) 2016/679, the controller shall provide information on
action taken on a request under Articles 15 to 22 to the data subject without undue delay
and in any event within one month of receipt of the request. That period may be extended
by two further months where necessary, taking into account the complexity and number of
the requests. However, also in this case, the controller shall inform the data subject of such
extension within one month of receipt of the request.
With regard to the aforementioned facts, the administrative authority asked on 15 April
2021 the suspected company for cooperation in accordance with Article 31 of the Regulation
(EU) 2016/679 and requested the processor´s agreement with the company ,
established at Slovak Republic, company identification
number which provides to the e-shop the
customer service. The administrative authority also asked, when the suspected company
was informed of the complainant´s request for erasure of his personal data and what
measures the suspected company had taken in relation to the complainant´s request.
In reaction to its request, the administrative authority received on 28 April 2021 a statement
in which the suspected company explained that the request for erasure of personal data, or,
respectively, the discontinuation of sending of the commercial offers to
from the e-mail address was obtained on 17 March 2020,
whereas on 20 March 2020 the operator entered this request to the system
for further handling. On 27 May 2020 the physical removal of the complainant´s personal
data from the direct marketing database took place. The suspected company stated further
that it was discovered during a checkback that yet, several marketing communications were
sent to the complainant due to a technical mistake within the system.
2/4
The suspected company also stated that after in relation to this failure, it had conducted a
revision of the entire process and applied measures preventing repetition of similar mistake.
Moreover, the suspected company informed that customer data are processed over the
period covering the order processing plus delivery and subsequently also over periods
related to the warranty claims purposes as well as periods during which buyers may apply
their claims or a competent supervisory body could perform an inspection. Following the
suspected company, these personal data are processed on legal grounds for the purposes of
observing an agreement and of the suspected company´s legal interests, however not longer
than for three years as of the filing of an order. The information for customers as to the
processing of personal data are available at the website In relation
to the complainant´s request, the company stated that his personal data had been removed
from the demarketing database, but it could not erase all personal data as they were
processed in connection with his order on the basis of a legal interest of the suspected
company whereas they should be erased automatically after three years as of the filing of
the order.
The suspected company also attached the agreement on processing of personal data closed
on 25 May 2018 with the company which provides for the suspected
company customer service. It also attached the processor´s technical and organizational
measures of 25 May 2018 as well as a sample of the electronic newsletter footer where a
customer may unsubscribe reception of electronic newsletters. Finally, the invoice and the
delivery confirmation related to the complainant´s order was attached.
The administrative authority has assessed the suspected company´s conduct and declares
that the suspected company, after the complainant´s sending of his request for erasure of 17
March 2020, removed on 20 March 2020 the complainant´s personal data from its marketing
distribution list and informed him thereof by e-mail on the same day. The suspected
company could not accommodate the complainant´s request for erasure of his personal data
due to the fact that the formerly closed agreement related to the complainant´s order is
subject to Article 6(1) of the Regulation (EU) 2016/679 as they are necessary for compliance
with the suspected company´s legal obligations and for the purposes of its legal interests.
Due to a technical failure on the suspected company´s side, marketing offers (catalogue and
newsletter) were sent to the complainant even after his personal data had been removed
from the distribution list, whereas subsequently the suspected company took measures
preventing repetition of such an event.
On the basis of the material collected in the file, the administrative authority, in accordance
with Article 65 of the Act No. 110/2019 Coll., discontinued the proceedings without initiating
proceedings concerning an infraction as only a single mistake occurred on the suspected
company´s side and with respect to the significance and extent of the breach of the
protected interest that was affected by the action and also with regard to the conduct of the
suspected company that, immediately after the case happened, it remedied the unlawful
situation. It is obvious that the objective that could have been achieved by performing a
proceeding, was reached even so.
3/4
Instruction: This resolution shall, pursuant Article 65 of the Act No. 110/2019 Coll., only be
recorded in the file. In accordance with Article 76(5) of the Administrative Code, this
resolution cannot be appealed.
Prague, 17 May 2021
4/4