521.13974 / 631.342
CR: 290757
IMI DD 344664
Berlin, 05 May 2022
Final Decision
Preliminary remarks
The complaint (ref. no. 521.13974 / 631.342) was raised before the Berlin DPA in January
2021. It was transferred to the supervisory authority Netherlands, which is the Lead Supervisory
Authority (LSA) for the cross-border processing carried out by Uber B. V., in accordance with Ar-
ticle 56 GDPR. The LSA Netherlands conducted the investigation and the cooperation proce-
dure with all concerned supervisory authorities in accordance with Article 60 GDPR. The LSA
Netherlands proposed a Draft Decision and thereby the complaint was rejected. In accordance
with Article 60 (8) GDPR, the Berlin DPA as the supervisory authority with which the complaint
was lodged, hereby adopts the decision as it was agreed upon in the cooperation procedure
and is included below:
With regard to the abovementioned case and pursuant to Article 60(3) of the General Data
Protection Regulation (GDPR), the Autoriteit Persoonsgegevens (Dutch Data Protection Au-
thority, hereafter: NL SA) has issued the following draft decision:
Summary of the Case
Berlin Commissioner for Data Protection Phone: (030) 13889-0 Mail: [email protected]
and Freedom of Information (BlnBDI) Fax: (030) 215 50 50 Web: www.datenschutz-berlin.de
Friedrichstr. 219, 10969 Berlin Office hours: Daily from 10 am to 3 pm,
Visitors‘ entrance: Puttkamerstr. 16–18 Thursdays from 10 am to 6 pm
On 15 March 2021 an article 56 notification with number 184404 was broadcast by the Ber-
lin SA. On 24 March 2021 the NL SA indicated that we considered ourselves the lead author-
ity in this matter, in accordance with Article 56 GDPR. On 20 April 2021 the Berlin SA broad-
cast an article 61 Voluntary Mutual Assistance Notification with number 290775 using Case
Register Entry 290757.
The complainant wrote that he received a newsletter from Uber and that in the email he could
not find an option to simply unsubscribe. He tried to unsubscribe by replying to the sender’s
address ([email protected]), but the e-mail bounced. He then sent a complaint to his local data
protection authority.
Norm allegedly infringed
Article 12 (2) GDPR states that the controller shall facilitate the exercise of data subject
rights under Articles 15 to 22 GDPR.
Article 21 (2) GDPR states that where personal data are processed for direct marketing
purposes, the data subject shall have the right to object at any time to processing of per-
sonal data concerning him or her for such marketing, which includes profiling to the extent
that it is related to such direct marketing.
The complainant states that he could not unsubscribe from the marketing emails that Uber
was sending him by using the reply function.
Investigation by the NL SA
On 15 October 2021 the NL SA sent an inquiry to Uber regarding this case. Uber replied on 1
November 2021 that Uber carried out internal research and has come to the conclusion that
at the bottom the relevant email contains a link with the title: “Email settings”, or in German:
“E-Mail-Einstellungen”. This link refers to a web page of Uber where users can unsubscribe
(and, if desired, resubscribe) for different types of communication. The user has not made use
of this link.
Uber wrote to the NL SA that since the date of the complaint the link has been modified in or-
der to be more clear to the user. It now bears the title: “Email abbestellen” (unsubscribe).
Uber added that the data subject has now been unsubscribed from marketing emails after the
NL SA contacted them.
2
Furthering the statements of Uber the NL SA has checked the e-mail that the data subject
complaint about and the NL SA established that it does indeed contain a link called “E-Mail-
Einstellungen”.
The NL SA has also reviewed the privacy policy on the website of Uber
(https://www.uber.com/legal/nl/document/?name=privacy-notice&country=ger-
many&lang=de) and established that it clearly describes the steps data subjects should take
to unsubscribe from marketing emails.
The NL SA holds that the GDPR does not prescribe that unsubscribing should always be pos-
sible using the reply function. Furthermore NL SA established that the controller did offer an
unsubscribe option with the link “E-Mail-Einstellungen” included at the bottom of the e-mail.
Also Uber agreed to clarify to the name of the button. It now reads “Unsubscribe”. Uber facili-
tates right of data subjects to object as required per Article 12(2) jo. article 21 GDPR. By ac-
tually unsubscribing the complainant from marketing emails it has facilitated the right to ob-
ject of the complainant.
Proposed action by the NL SA
Thus, based on the above-mentioned explanations, the NL SA did not identify any infringe-
ment of the obligations set out in articles 12(2) and 21 Regulation (EU) 2016/679 (GDPR) by
the controller. The NL SA has rejected the complaint according to Article 60 (8) GDPR.
Henceforth, the cross border complaint case (national reference 521.13974 / 631.342)
should be closed.
Appeal Notice to the complainant
Against this decision a lawsuit before the Verwaltungsgericht Berlin (administrative court of Ber-
lin), Kirchstraße 7, 10557 Berlin is admissible. The lawsuit needs to be filed in written form within
one month after the notification of this decision, it can also be filed as an electronic document
with a qualified electronic signature (QES) or for the record of the clerk of the court. Please, note
that in case of filing the lawsuit in writing the legal deadline is only met if the lawsuit reaches the
administrative court within the deadline.
The Berlin Commissioner for Data Protection and Freedom of Information
3