One.com A/S
2 December 2021
Kalvebod Brygge 24
1560 København V J.No. 2019-31-1997
Danmark Doc.no. 349955
Caseworker
Kasper Viftrup
Sent to
Complaint regarding access of information
The Danish Data
Protection Agency
The Danish Data Protection Agency (hereafter DPA) hereby returns to the case where, on 5 Carl Jacobsens Vej 35
July 2019, Mr (hereinafter the complainant) complained to the agency regarding 2500 Valby
Denmark
One.com A/S’ handling of his request for access to personal data. Subsequently, in accord-
T 3319 3200
ance with Article 56 of the General Data Protection Regulation (hereafter GDPR), the Danish [email protected]
DPA was designated as lead supervisory authority. datatilsynet.dk
VAT No. 11883729
1. Decision
Following a review of the case, the DPA finds that there are grounds to issue a reprimand for
the processing of personal data by One.com A/S, as it was not carried out in accordance with
the rules laid down in Article 12(3) and (6) and Article 15(1) of the GDPR.
The details of the case and the reasons for the decision of the Danish DPA are set out
below.
2. Overview of the case
On 17 August 2018, the complainant, a national and resident of Germany, terminated his con-
tract with One.com A/S and paid what was owed. In the same inquiry, the complainant reques-
ted access to his personal data pursuant to Article 15 of the GDPR.
By mistake, One.com A/S’s customer assistance staff closed the ‘support thread’, in which the
complaint sought access and therefore did not submit the request for access to the company’s
data protection team, with the result that there was no reply to the complainant’s request for
access.
On 29 March 2019, the complainant received a contract renewal from One.com A/S. The com-
plainant, on the same day, contacted One.com A/S and again requested access to his per-
sonal data.
On 11 April 2019, One.com A/S requested further identification information, referring to the
company’s procedures in order to ensure that that information was provided to the right per-
son.
The complainant remarked that the identification data was not necessary because his identity
could not be in doubt, but on 17 April 2019, he sent a copy of an ID card in order to receive
the information.
On 7 May 2019, the complainant was granted access to his personal data from One.com A/S. Page 2 of 4
The response was given in English.
On 8 May 2019, the complainant again contacted One.com A/S, on the ground that the inform-
ation transmitted was incomplete, as the reply did not contain all the information required by
article 15(1) (a) to (h).
On 21 May 2019, One.com A/S informed the complainant of the information required by art-
icle 15(1) (a) to (h) by a link to the company’s privacy policy, which was available on their web-
site.
2.1. The complainant’s remarks
Generally, the complainant has stated that One.com has breached articles 12 and 15 of the
GDPR by failing to respond to his request for access fully within a reasonable time.
In that regard, the complaint has pointed out that his request for access of 17 August 2018
was handled after a delay of nine months.
The complainant has also stated that One.com A/S had no reason to doubt his identity and to
require further identification in order to respond to his request. The complainant has stated
that One.com A/S only contested the identity of him late in the case and that the request for
access had been preceded by a contractual relationship between the two parties, where
One.com A/S had not disputed the complainant’s identity.
The complainant has also stated that information under Article 15(1)(a) to (h) of the GDPR did
not appear in One.com A/S’ initial response and that it was only on 21 May 2019, where
One.com A/S referred the complainant to the data in question on its website, that the request
could be considered fulfilled.
The complainant has further noted that One.com A/S’ reply of 7 May 2019 to his request for
access was legible, but not easily understandable. In that regard, the complainant has stated
that the response to such requests should be given in the language of the data subject and
that, consequently, the reply in the present case should have been given in German.
2.2. One.com A/S’ remarks
Generally, One.com A/S has stated that the request for access was received on 17 August
2018, but the ‘support thread’ was closed by mistake and was therefore not sent to the relev-
ant data protection team.
One.com A/S has further stated that One.com A/S generally considers the complainant’s re-
quest for access answered fully in regards to content.
In that regard, One.com A/S has stated that the answer in question was given in the most clear
language possible and, if there were problems with for example professional expressions,
One.com A/S was and is ready to clarify further.
3. Statement of reasons for the DPA’s decision
3.1. Article 15 of the GDPR states that the data subject has the right to obtain from the con-
troller confirmation as to whether or not personal data concerning him or her are being pro-
cessed, and, where that is the case, access to the personal data and the data referred to in
paragraph 1(a) to (h).
Under Article 12(2) of the GDPR, it is stated that the controller shall facilitate the exercise of Page 3 of 4
data subject rights and not refuse to act on the request of the data subject for exercising his
or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a posi-
tion to identify the data subject.
The controller shall provide information on action taken on a request under Articles 15 to 22 to
the data subject without undue delay and in any event within one month of receipt of the re-
quest. That period may be extended by two further months where necessary, taking into ac-
count the complexity and number of the requests. The controller shall inform the data subject
of any such extension within one month of receipt of the request, together with the reasons for
the delay.
Under Article 12(6) of the GDPR, where there is reasonable doubts concerning the identity of
the natural person making the request, for example for access, the controller may request
additional information necessary to confirm the identity of the data subject.
3.2. The DPA has taken into account that the complainant requested access to his personal
data on 17 August 2018 and received an adequate reply only on 21 May 2019.
The DPA finds that One.com A/S did not deal with the complainants’ request for access, in ac-
cordance with Article 12(3), cf. Article 15 of the GDPR, as the complainant had to wait approx-
imately nine months before receiving an appropriate response to his request for access.
3.3. In regards to the material content of the response to the request for access, the DPA finds
that the first response of One.com A/S (of 7 May 2019) to the complainant’s was not in accord-
ance with Article 15(1) of the GDPR, since the necessary information referred to in subpara-
graphs (a) to (h) of the provision did not appear in the reply.
In that regard, the DPA emphasises that, even though the information was available on the
controller’s website, the complainant would have to identify this information independently. In
that case, it would not be clear to the complainant whether the information also was relevant
to the processing of complainant’s personal data. It was only when One.com A/S referred the
complainant to the information as the necessary and relevant information referred to in sub-
paragraphs (a) to (h) on 21 May 2019 that the DPA considers the request fully provided under
Article 15(1).
3.4. Regarding One.com A/S’s request for additional information for the identification of the
complainant, the DPA considers that the controller is required, under Article 12(6) of the regu-
lation to carry out a specific assessment of whether there is reasonable doubt as to the iden-
tity of the natural person when handling a request under Articles 15 to 21.
As the present case is presented, the DPA finds that there was no reasonable doubt as to the
identity of the complainant, taking the prior contractual relationship between the parties and
the earlier correspondence into account. The DPA therefore finds that One.com A/S did not
deal with the complainant’s request in accordance with Article 12(6) of the GDPR.
3.5. Consequently, after examining the case as a whole, the DPA finds ground to issue a rep-
rimand for the processing of personal data by One.com A/S, as it was not carried out in ac-
cordance with the rules laid down in Article 12(3) and (6) and Article 15(1) of the GDPR.
In regards to the complainant’s argument relating to the intelligibility and language of the reply,
the DPA has not found grounds for criticizing One.com A/S, as it was possible to obtain the
relevant information from the documents sent by One.com A/S and there are no requirements
in the GDPR detailing that a response to requests after articles 15 to 21 specifically must be Page 4 of 4
given in the language spoken by the data subject, and in the present case, it was apparent
from the documents that the complainant was proficient in English.
4. Final remarks
The decisions of Datatilsynet are not subject to appeal before another administrative author-
ity, cf. § 30 of the Danish Data Protection Act, but may be brought before a court of law in ac-
cordance with Article 63 of the Danish Constitution.
A copy of this letter will be sent to the complainant as orientation.