Berlin Commissioner
for Data Protection
and Freedom of Information
521.11629
French DPA: 19003650
A56 ID 72416
CR 73122
DD 166113
IC 356451
DD 405144
1 September 2022
# Final Decision
Dear Madam or Sir,
We hereby issue a reprimand to your company for a violation of the General Data Protection Regulation (GDPR).
Justification:
Our decision is based on the following considerations:
Berlin Commissioner for Data Protection
and Freedom of Information (BlnBDI)
Friedrichstr. 219, 10969 Berlin
Visitors' entrance: Puttkamerstr. 16-18
Phone: +49 30 13889-0
Fax: +49 30 215 50 50
Office hours: Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
Mail: [email protected]
Web: www.datenschutz-berlin.de
BERLIN
I.
We have established the following facts:
The complainant submitted that when registering with the online game [REDACTED], he had provided an e-mail address containing his first and last name [REDACTED]. On February 18, 2019, he wanted to change this e-mail address to a more anonymous e-mail address [REDACTED]. However, he was informed by customer support that this was (technically) not possible.
They informed the following in the above-mentioned letter:
The complainant with the e-mail [REDACTED] had wanted to try to transfer his player account to another player in 2017. However, this is not permitted under the terms and conditions of [REDACTED]
According to [REDACTED], no user is entitled to transfer or sell his user account to a third party or to allow a third party to use his user account without the prior consent of [REDACTED] consent to a transfer does not authorize the transfer of a user account for a fee or other consideration unless express permission to do so is given as part of the consent.
The background to this is to ensure that each player has achieved game progress on their own. Honest players should not be deterred in this way.
In 2017, the complainant had already once requested the correction of the e-mail address. At that time, he himself had admitted that it was the e-mail address of a friend. In his email of August 3, 2017, he had explained that the friend had already played the game, but had lost interest because of the poor internet connection. He further confirmed the request to correct the e-mail address to that of a friend in e-mails dated August 8 and 9, 2017.
Now the account should be changed to the e-mail address [REDACTED]. In your opinion, based on the incident in 2017, it could not be ruled out that it was again a matter of transferring the account.
2
In your opinion, this is not a matter of the right to rectification pursuant to Article 16 of the GDPR, as the e-mail [REDACTED] is still correct. No incorrect data would be stored. According to Article 16 sentence 2 of the GDPR, a data subject only has the right to request the completion of incomplete personal data - also by means of a supplementary declaration. In the case of the complainant, however, the old e-mail address was still valid. Accordingly, the old address was not an incorrect date. The complainant also did not demand that the new e-mail address be added to his data, but rather that it be exchanged with the old one and, to that extent, not supplemented. There was no reason to change the previous e-mail address to the new one for goodwill reasons.
In this case, the statement of technical reasons was made instead of a non-statement of reasons, which would also have been permissible from a legal point of view, or a reference to the general terms and conditions. According to you, this was done because there were indeed technical reasons, because it would create a considerable technical effort if a transfer of user accounts had to be permitted in the terms of use and then ensured (e.g., due to the necessary verification processes and necessary security measures for such a transfer).
In the opinion of [REDACTED], changing the e-mail address would also not lead to anonymization, as the name of the complainant was stored at [REDACTED] anyway due to the legal obligation to retain data. You also requested that it be noted that the complainant's e-mail address is only requested in your system during registration/login and does not appear anywhere else. In this respect, the complainant's argumentation regarding better anonymization did not apply. And the e-mail address you have in your system is always assigned to a specific user, who is also known by name from the time a contract is concluded - as in the case of the complainant. In this respect, too, there was no legitimate interest of the complainant in an alleged "anonymization" via an innocuous e-mail address.
Accordingly, changes to the e-mail address could only be made if it was ensured that the request for change was not based on a transfer of the account, i.e. the existing e-mail account verifiably no longer existed, for example.
Finally, the complainant had been notified of a supplementary (late) notice regarding his change request. However, this notice still does not refer to the prevention of the player transfer.
3
II.
Legally, we assess the facts as follows: Your company has violated the GDPR.
### *1. Violation of Article 12 (1-4) GDPR*
According to Article 12 (3) of the GDPR, the controller must provide the data subject with information about the measures taken pursuant to Articles 15 to 22 of the GDPR within one month of receipt of the request. If he does not take any measures, he must inform the data subject of the reasons within the one-month period (Article 12 (4) GDPR).
#### *Request for rectification pursuant to Article 16 GDPR.*
The complainant's request constitutes a request for rectification of their data pursuant to Article 16 of the GDPR. Your argument that the previously stored e-mail address still works and is therefore not incorrect is not valid. In principle, every person is free to decide for themselves which e-mail address they would like to use for which communication purpose.
In particular, every person must be free to gradually deactivate or withdraw a particular e-mail address from circulation in order to be able to switch it off at some point, e.g. because the provider is to be changed or because too many unwanted e-mails reach them at a particular e-mail address.
Accordingly, the accuracy of an e-mail address not only requires that it can be objectively assigned to the data subject, but also requires that the specific e-mail address has been designated by the data subject for the specific communication purpose. The data subject can also change this designation. With the e-mail of February 18, 2019, the complainant informed you that he would like to use a different e-mail address for communicating with you in the future. He thus changed the purpose for his e-mail address previously stored with you; it was no longer intended for communication with you. It was therefore incorrect.
The request pursuant to Article 16 of the GDPR had to be answered in accordance with Article 12 (3), (4) of the GDPR.
#### *No sufficient communication pursuant to the first sentence of Article 12 (1) GDPR.*
4
Communications pursuant to Articles 12 to 22, i.e. also pursuant to Article 16 GDPR, must be provided in a precise, transparent, comprehensible and easily accessible form in clear and simple language pursuant to the first sentence of Article 12 (1), GDPR. This also means that the data subject is informed transparently about the real background of the refusal of the rectification according to Article 16 GDPR.
In the present case, the true reason for the refusal was not communicated to the complainant, but only relied on technical reasons. In the French reply of the support of February 19, 2020, it was stated that the necessary architecture to change this information had not been available.
In addition, it was explained that a rectification pursuant to Article 16 of the GDPR could not be considered, as the e-mail address could not be incorrect since it was still functioning. However, this alone does not exclude the right to rectification under Article 16 GDPR (see above).
The reason given to us that there are doubts as to whether the newly provided e-mail address is actually an address of the complainant and that there are fears that the account could be passed on in breach of contract was not transparently informed to the complainant. This is a violation of Article 12 (3) in conjunction with (1) of the GDPR.
## *2. Right to rectification in the specific case*
The right to rectification exists, of course, only if the processed data do not become inaccurate as a result of the change requested by the complainant. The controller is responsible for this in accordance with Article 5 (1) (d) GDPR. Insofar as there are reasonable doubts that the new e-mail address provided by the complainant is one of the complainant, your company may take appropriate measures to ensure the accuracy of the information. However, it must always be taken into account that the company must facilitate the exercise of the right of rectification under Article 16 of the GDPR in accordance with Article 12(2) of the GDPR.
### III.
As a result, we have decided not to take any further supervisory measures due to the violation, but to leave it at a reprimand for the time being.
The reprimand is based on Article 58 (2) (b) of the GDPR.
5
Taking into account the specific circumstances of the established facts, we consider a reprimand to be appropriate after the conclusion of our investigation. When approached by us, you showed understanding and announced that you would comply with data protection requirements and cease the reprimanded behavior.
In the certain expectation that you will comply with data protection regulations in the future, we consider the matter closed.
[Information on legal remedies not translated]
6