THE HESSIAN COMMISSIONER
FOR DATA PROTECTION AND FREEDOM OF INFORMATION
01 July 2022
# Final Decision
Complaint against
Right to erasure (article 17 GDPR) and right to object (article 17 GDPR)
IMI references: Case 67526 / A61VMN 98242 / A60DD 405512
National reference numbers: 90.19.49:0440 (Hessian SA) / ZSPR.440.1814.2018 (Polish SA)
The Hessian Commissioner for Data Protection and Freedom of Information ("Hessian SA") refers to the complaint of ("complainant") against ("controller"), which has been lodged with the Polish Data Protection Authority ("Polish SA").
As the controller is established in Hesse, Germany, the Hessian SA is the competent lead supervisory authority. The complaint concerns the exercise of the data subject's rights. The complainant objects to the processing of her personal data and requests its erasure.
# Case Description
On December 6, 2018, the complainant has taken part in an internet contest on Facebook. To win the prize (a voucher for a drugstore) users had to "like" a fanpage, write the 500th comment under the post and "share" the post. The complainant was one of the five people announced as winners. The post announcing the winners included a link, under which the winners had to provide their personal data in order to receive the prize. The personal data to be provided included name, surname, home address, phone number, phone information and earnings. The complainant received a confirmation that the registration was successful.
On December 7, 2018, the complainant visited the fanpage and discovered another announcement of winners, as well as comments suggesting the fanpage is a phishing operation. On the same day, the complainant wrote to the fanpage via Facebook Messenger and sent an e-mail provided during the registration process, informing about her withdrawal from the contest and a request to "delete my details from the completed questionnaire". Besides, the complainant clicked on a link "deregister" included in the e-mail announcing successful registration, but is not sure if this was effective.
Page 1 of 3
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 2 of 3
## **Investigation Procedure**
On May 14, 2020, the Hessian SA contacted the controller, raised questions and asked the controller to answer the questions and comment on the case, by May 29, 2020. By letter dated May 27, 2020, the controller asked for an extension of this deadline. The Hessian SA extended the deadline until June 12, 2020. On June 10, 2020, the controller replied to the Hessian SA's letter. Following said reply, the Hessian SA felt the need to clarify additional aspects with the controller, for which a second request for information was sent to the controller on June 16, 2020, and a second reply was received on July 10, 2020.
In its replies, the controller informed the Hessian SA that it had never received an objection to further data processing or a request for erasure from the complainant. The complainant's e-mail of December 7, 2018, sent by the Hessian SA to the controller, in which the complainant objected to the further use of her data for the purposes of the contest and stated that she no longer wished to take part, never reached the controller. This is why the complainant did not receive a reply or confirmation from the controller.
Nevertheless, the controller had blocked the complainant's data for marketing purposes on December 18, 2018, as a business partner had informed the controller that the complainant had withdrawn her consent. This request had been complied with immediately upon knowledge. However, no deletion of the complainant's data had been carried out due to legitimate interests for evidence purposes (article 6(1)(c) and (f) GDPR).
After withdrawal of consent, the data is stored in a "legal database" based on legal limitation periods. Once the limitation period has expired, the data is automatically deleted from the system. This procedure results from a legal assessment of both article 6(1)(f) GDPR and the exception under article 17(3)(e) GDPR. According to these provisions, further data processing is still possible in the event of an erasure request by the data subject for the purpose of establishing, exercising and defending legal claims. This exception is not limited to the judicial pursuit of legal claims in front of courts, but also covers out-of-court proceedings, including proceedings before regulatory authorities such as the data protection authorities.
In March 2022, the Polish SA informed the Hessian SA that the complainant has declared to be pleased that her data is blocked for marketing purposes. Further, the complainant understands that her data 'is not to be deleted from the controller's so-called legal database', as it is stored in a lawful manner and 'kept until the storage limitation expires in order to be able to prove the facts'. Therefore, the complainant has declared to agree with the Hessian SA that no further action is necessary and that the case may be closed.
Page 2 of 3
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 3 of 3
## **Decision**
Based on the controller’s statement and the fact that the complainant’s data is blocked
for marketing purposes and will be deleted after expiry of legal limitation periods, the
Hessian SA considers the complainant’s requests to be complied with and closes the
file without further action.
On behalf of the Hessian SA
Page 3 of 3
Gustav-Stresemann-Ring 1 · 65189 Wiesbaden · Telephone +49 6 11 14 08 – 0 · Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] · Web www.datenschutz.hessen.de