In the matter of the General Data Protection Regulation
DPC Complaint Reference:
IMI number:
In the matter of a complaint, lodged by [REDACTED] with Commission Nationale de l'informatique et des Libertés pursuant to Article 77 of the General Data Protection Regulation, concerning [REDACTED]
Record of Amicable Resolution of the complaint and its consequent withdrawal pursuant to Section 109(3) of the Data Protection Act, 2018
Further to the requirements of Internal EDPB Document 06/2021 on the practical implementation of amicable settlements (adopted on 18 November 2021)
# RECORD OF AMICABLE RESOLUTION FOR THE PURPOSE OF INTERNAL EDPB DOCUMENT 06/2021 ON THE PRACTICAL IMPLEMENTATION OF AMICABLE SETTLEMENTS, ADOPTED 18 NOVEMBER 2021
Dated the 19th day of August 2022
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
# **Background**
1. On 29 June 2019, [REDACTED] ("the **Data Subject**") lodged a complaint pursuant to Article 77 GDPR with Commission Nationale de l'informatique et des Libertés ("the **Recipient SA**") concerning [REDACTED] ("the **Respondent**").
2. In circumstances where the Data Protection Commission ("the **DPC**") was deemed to be the competent authority for the purpose of Article 56(1) GDPR, the Recipient SA transferred the complaint to the DPC on 02 July 2020.
# **The Complaint**
3. The details of the complaint were as follows:
a. The Data Subject contacted the Respondent by email on 19 June 2019, to request erasure of his personal data.
b. The Data Subject received further contact from the Respondent via email on June 26 2019, indicating that his personal data had not been deleted and erasure request not effected by the Respondent.
# **Action taken by the DPC**
4. The DPC, pursuant to Section 109(4) of the Data Protection Act, 2018 ("the **2018 Act**"), is required, as a preliminary matter, to assess the likelihood of the parties to the complaint reaching, within a reasonable time, an amicable resolution of the subject-matter of the complaint. Where the DPC considers that there is a reasonable likelihood of such an amicable resolution being concluded between the parties, it is empowered, by Section 109(2) of the 2018 Act, to take such steps as it considers appropriate to arrange or facilitate such an amicable resolution.
5. Following a preliminary examination of the material referred to it by the Recipient SA, the DPC considered that there was a reasonable likelihood of the parties concerned reaching, within a reasonable time, an amicable resolution of the subject matter of the complaint. The DPC's experience is that complaints of this nature are particularly suitable for amicable resolution in circumstances where there is an obvious solution to the dispute, if the respondent is willing to engage in the process. In this regard, the DPC had regard to:
a. The relationship between the Data Subject and Respondent (being, in this case, an individual consumer and a service provider); and
b. The nature of the complaint (in this case, an unsuccessful attempt by the Data Subject to exercise his data subject rights).
6. While not relevant to the assessment that the DPC is required to carry out pursuant to Section 109(4) of the 2018 Act, the DPC also had regard to Internal EDPB Document 06/2021 on the
2
practical implementation of amicable settlements, adopted on 18 November 2021 (“Document 06/2021”), and considered that:
a. the possible conclusion of the complaint by way of amicable resolution would not hamper the ability of the supervisory authorities to maintain the high level of protection that the GDPR seeks to create; and that
b. such a conclusion, in this case, would likely carry advantages for the Data Subject, whose rights under the GDPR would be vindicated swiftly, as well as for the controller, who would be provided the opportunity to bring its behaviour into compliance with the GDPR.
# **Amicable Resolution**
7. The DPC engaged with both the Data Subject (via the Recipient SA) and the Respondent in relation to the subject matter of the complaint. Further to that engagement, it was established that the Data Subject had created an account with the Respondent and then subsequently sought to delete that account. In accordance with the Respondent’s deletion request authentication process at the time, they requested that the Data Subject verify his identity and authenticate his request by providing a copy of proof of identity. The Data Subject failed to engage with that verification method, as he did not wish to provide a copy of proof of identity documentation to the Respondent. The Respondent offered an alternative means for the Data Subject to verify his identity by logging into his account (which had been disabled but was reactivated for the purpose of this alternative verification process). However, the Data Subject advised the DPC in its communication with him that he could not log into the account to do so. In the circumstances, the Respondent agreed to take the following action:
a. The Respondent agreed to grant the Data Subject’s request for account deletion; and
b. The Respondent agreed to make direct contact with the Data Subject to confirm that they had processed his request.
8. On 09 December 2020, the DPC issued correspondence to the Data Subject, via the Recipient SA for onward transmission, with an update on the outcome of its engagement with the Respondent. When doing so, the DPC noted that the actions taken by the Respondent appeared to adequately deal with the concerns raised in his complaint. In the circumstances, the DPC asked the Data Subject to confirm whether he had received any direct communication from the Respondent to indicate that his erasure request had been processed, and to respond to the DPC, within two months, if he was not satisfied with the outcome so that the DPC could consider the matter further.
9. On 12 January 2021, the DPC received correspondence from the Data Subject (via the Recipient SA), that stated he was pleased the Respondent confirmed it would delete his account, however, at the time of writing he had not received any communication from the Respondent to confirm his account was deleted. He did, however, also state at this time that
3
if the Respondent confirmed the deletion of his account then his complaint could be considered closed.
10. Following further engagement with the Respondent on the matter, the DPC received confirmation on 31 March 2021 that the Respondent had deleted the Data Subject's account. Following additional engagement, the Respondent also provided the DPC with a copy of said email correspondence dated 31 March 2021, in which the Respondent confirmed to the Data Subject that his account had been deleted and apologised for any inconvenience caused.
11. On 28 May 2021, the DPC issued correspondence to the Recipient SA, for onward transmission to the Data Subject, advising of confirmation of the requested account having been deleted as provided by the Respondent, and that the dispute between the Data Subject and Respondent thus appeared to have been resolved. In the circumstances, the DPC asked the Data Subject to notify it, within two months, if he was not satisfied with the outcome, so that the DPC could consider the matter further. The DPC did not receive any further communication from the Data Subject and, accordingly, the complaint was deemed to have been amicably resolved.
12. In circumstances where the subject matter of the complaint has been amicably resolved, in full, the complaint, by virtue of Section 109(3) of the 2018 Act, is deemed to have been withdrawn by the Data Subject.
# **Confirmation of Outcome**
13. For the purpose of Document 06/2021, the DPC confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
c. Having consulted with the supervisory authorities concerned on the information set out above, as required by Document 06/2021 the DPC has now closed off its file in this matter.
14. If dissatisfied with the outcome recorded herein, the parties have the right to an effective remedy by way of an application for judicial review, by the Irish High Court, of the process applied by the DPC in the context of the within complaint.
Signed for and on behalf of the DPC:
4
Deputy Commissioner
Data Protection Commission
5