Information and Data Protection Commissioner
CDP/IMI/LSA/19/2022
vs
COMPLAINT
1. On the 11th June 2020, (the “complainant”) lodged a complaint (the
“complaint”) with the supervisory authority of Denmark (Datatilsynet, hereinafter the “Danish
SA”) against 1 (the “controller”) pursuant to article 77(1) of the
General Data Protection Regulation2 (the “Regulation”).
2. By virtue of article 56 of the Regulation, the Danish SA identified the Information and Data
Protection Commissioner (the “Commissioner”) as the lead supervisory authority competent
for the handling of the complaint. The Commissioner confirmed with the Danish SA that it is
indeed the lead supervisory authority and proceeded to investigate the complaint on the basis
of the procedure set out in article 60 of the Regulation.
INVESTIGATION
3. On the 11th June 2020, the complainant filed a complaint with the Danish SA and submitted the
following principal arguments:
1
is a private limited company incorporated in Malta and operating in the online gaming
sector with registration number and registered address at
.
2
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC.
Page 1 of 5
a. that “ seems to store more data than what is necessary – even though I have
used my right to be forgotten. They have even confirmed completing the deletion process.
They have sent me a file containing all the data that is still in their systems after this
process was completed”;
b. that “I wonder a lot about the amount of data, as I don’t understand that they can lawfully
store so much data regarding me. When I contracted them about it, they said that it was
necessary to store the data due to legal obligations”;
c. that “I full understand that has to store some data in order to document some
things to the authorities. I cannot understand thought that they lawfully can
store that much data, and I want it to stop as far as my assumption is correct”;
d. that the controller satisfied his request to have his personal data erased. He noted that
“these data are what they have regarding me after responding to my request to be
forgotten. It is my clear impression that they do not have a legal basis for keeping all
these data when I have requested deletion”.
4. In this regard, the controller submitted its reply to rebut the arguments made by the complainant
and highlighted the following salient points:
a. that the controller is a group of undertakings with its main establishment located in Malta
and although the controller operates in Denmark under a Danish license, its website
which is only available to the Danish market is operated by the main establishment,
namely , a company incorporated under the laws of Malta, which
is the controller responsible for the data processing through such platform;
b. that the complainant closed his account on the 2 nd May 2020, and exercised his right to
be forgotten on the 4th May 2020, and the controller replied to the request on the 18th May
2020;
c. that when a customer exercises such right, no further processing takes place in relation
to the individual, apart from the retention of personal data which is either required to
Page 2 of 5
comply with legal obligations or to establish, exercise or defend legal claims which may
be instituted against the controller;
d. that the controller emphasised that as a licensed operator, it is subject to obligations
stemming from regulatory and licencing requirements, notably those relating
to ;
e. that the controller is also a subject person in terms of Directive EU 2015/849 on the
prevention of the use of the financial system for the purposes of money laundering or
terrorist financing (commonly known as the 4 th Anti-Money Laundering Directive) as
transposed under the Laws of Malta, and therefore the controller noted that such law
imposes an obligation upon the controller to retain documentation concerning business
relationship with a customer or after the date of an occasional transaction;
f. that it is evident that the controller “is unable to fully exercise the complainant’s request
as this would hinder our compliance with legal obligations to which we are subject as
well as our legitimate rights at law. In this regard, it is respectfully being submitted that
most of the personal data relating to the complainant is indeed still necessary within the
meaning of Article 17(1)(a) of the GDPR”;
g. that the controller referred to the retention periods and criteria used to establish such time
frames, which information is made available on the controller’s website3 ; and
h. that upon signing-up to use the controller’s services, a customer must accept the ‘Terms
& Conditions’ and confirm that the privacy policy has been read and consequently, all
the information contained in the privacy policy including the retention periods applicable
to the processing of personal data have been duly made available to the complainant, in
compliance with the transparency principle under the Regulation.
LEGAL ANALYSIS
5. The Commissioner proceeded to carefully examine the privacy policy available on the website
of the controller, which must be accepted by the customer prior to signing-up to use its services.
3
Page 3 of 5
The privacy policy which sets out general information in relation to the controller’s retention
periods, particularly that for anti-money laundering purposes, states that the controller has a
legal obligation to keep its customer’s personal data up to ten (10) years from the closure of the
account.
6. In terms of article 17(1) of the Regulation, the “data subject shall have the right to obtain from
the controller the erasure of personal data concerning him or her without undue delay and the
controller shall have the obligation to erase personal data without undue delay” where one of
the grounds listed in article 17(1)(a) to (f) applies. However, this rule is subject to a number of
exceptions, in particular article 17(3)(b) which states that the right to erasure shall not apply
“for compliance with a legal obligation which requires processing by Union or Member State
law to which the controller is subject …” [emphasis has been added].
7. In this regard, the controller is subject to legal obligations which require processing of personal
data even following the termination of the customer relationship. In terms of regulation 13 of
the Prevention of Money Laundering and Funding of Terrorism Regulations, Subsidiary
Legislation 373.01, the controller shall retain documents and information for a period of five
(5) years which “may be further extended, up to a maximum retention period of ten years,
where, after a thorough assessment of the necessity and proportionality of such further
extension, it is concluded that the extension is justified as necessary for the purposes of the
prevention, detection, analysis and investigation of money laundering or funding of terrorism
activities by the Financial Intelligence Analysis Unit, relevant supervisory authorities or law
enforcement agencies” [emphasis has been added] .
8. In accordance with the definition of processing as held in article 4(2) of the Regulation,
processing “means any operation or set of operations which is performed on personal data or
on sets of personal data, whether or not by automated means, such as collection, recording,
organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or
combination, restriction, erasure or destruction” [emphasis has been added]. This definition
demonstrates that the retention of personal data constitutes processing of personal data,
therefore the controller shall continue to comply with the requirements and principles until the
destruction of the personal data as required by law.
Page 4 of 5