In the matter of the General Data Protection Regulation
DPC Complaint Reference:
In the matter of a complaint, lodged by with the Data Protection Commission
pursuant to Article 77 of the General Data Protection Regulation, concerning Meta Platforms
Ireland Limited.
Record of Amicable Resolution of the complaint and its consequent withdrawal pursuant to
Section 109(3) of the Data Protection Act, 2018
Further to the requirements of Internal EDPB Document 06/2021 on the practical implementation
of amicable settlements (adopted on 18 November 2021)
RECORD OF AMICABLE RESOLUTION FOR THE
PURPOSE OF INTERNAL EDPB DOCUMENT 06/2021 ON
THE PRACTICAL IMPLEMENTATION OF AMICABLE
SETTLEMENTS, ADOPTED 18 NOVEMBER 2021
Dated the 2nd day of December 2022
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
Background
1. On 7 February 2020, (“the Data Subject”) lodged a complaint pursuant to
Article 77 GDPR with the Data Protection Commission (“the DPC”) concerning Meta Platforms
Ireland Limited (“the Respondent”).
2. The DPC was deemed to be the competent authority for the purpose of Article 56(1) GDPR.
The Complaint
3. The details of the complaint were as follows:
a. The Data Subject contacted the Respondent via registered post on 29 November
2019, requesting access to their personal data concerning information relating to
charges that were imposed on their account.
b. The Data Subject states that did not receive any response from the Respondent.
Action taken by the DPC
4. The DPC, pursuant to Section 109(4) of the Data Protection Act, 2018 (“the 2018 Act”), is
required, as a preliminary matter, to assess the likelihood of the parties to the complaint
reaching, within a reasonable time, an amicable resolution of the subject-matter of the
complaint. Where the DPC considers that there is a reasonable likelihood of such an amicable
resolution being concluded between the parties, it is empowered, by Section 109(2) of the
2018 Act, to take such steps as it considers appropriate to arrange or facilitate such an
amicable resolution.
5. Following a preliminary examination of the material referred to it by the Data Subject, the DPC
considered that there was a reasonable likelihood of the parties concerned reaching, within a
reasonable time, an amicable resolution of the subject matter of the complaint. The DPC’s
experience is that complaints of this nature are particularly suitable for amicable resolution in
circumstances where there is an obvious solution to the dispute, if the respondent is willing
to engage in the process. In this regard, the DPC had regard to:
a. The relationship between the Data Subject and Respondent (being, in this case, an
individual consumer and a service provider); and
b. The nature of the complaint (in this case, an unsuccessful attempt by the Data Subject
to exercise their data subject rights).
6. While not relevant to the assessment that the DPC is required to carry out pursuant to Section
109(4) of the 2018 Act, the DPC also had regard to Internal EDPB Document 06/2021 on the
practical implementation of amicable settlements, adopted on 18 November 2021
(“Document 06/2021”), and considered that:
2
a. the possible conclusion of the complaint by way of amicable resolution would not
hamper the ability of the supervisory authorities to maintain the high level of
protection that the GDPR seeks to create; and that
b. such a conclusion, in this case, would likely carry advantages for the Data Subject,
whose rights under the GDPR would be vindicated swiftly, as well as for the controller,
who would be provided the opportunity to bring its behaviour into compliance with
the GDPR.
Amicable Resolution
7. The DPC engaged with both the Data Subject and Respondent in relation to the subject-matter
of the complaint. Further to that engagement, it was established that the email address the
Data Subject had used to contact the Respondent was not a valid email address. It was also
established that the Respondent could not locate a registered letter addressed to them from
the Data Subject. In the circumstances, the Respondent took the following actions:
a. The Respondent conducted an internal investigation regarding the reasons for the
Data Subject’s access request going unanswered; and
b. The Respondent provided advice to the Data Subject relating to the Respondent’s
procedures for when a user does not recognise transactions on their bank or credit
card statements.
8. On 27 April 2020, the DPC outlined the Data Subject’s complaint to the Respondent. The DPC
informed the Respondent that Data Subject’s complaint related to an access request, seeking
information relating to charges that had been made to their account without their knowledge.
On 11 May 2020, the Respondent replied to the DPC, noting that it was unable to locate any
evidence of the payments mentioned by the Data Subject based on the information provided.
The Respondent also noted that the email address that the Data Subject had originally used
to contact the Respondent was not a valid email address. The Respondent also informed the
DPC that it had conducted a search, but could not locate any letter addressed to it from the
Data Subject. The Respondent requested further information from the Data Subject in order
to progress its investigation. The Data Subject subsequently provided the DPC with this
relevant information and a series of additional queries for the Respondent to address,
including requesting further information on the Respondent’s retention policy. On 23
September 2020, the DPC provided the Respondent with the additional information and the
DPC requested that the Respondent also address the additional queries that the Data Subject
had raised.
9. On 21 October 2020, the Respondent informed the DPC again that it was unable to locate any
charges associated with the reference numbers provided by the Data Subject and, as such, it
was unable to assist the Data Subject in this regard. The Respondent stated that it provides a
dedicated Help Centre Page and contact form for individuals to resolve issues related to
alleged unauthorised or unknown bank charges on their account. The Respondent suggested
that if the Data Subject would like to pursue their request for reimbursement, then they
3
should use this dedicated contact form and provide the necessary details from their bank
statement. On 23 December 2020, the DPC wrote to the Data Subject, providing them with
the Respondent’s instructions on how to apply for a refund for unauthorised or unknown bank
charges. The Data Subject responded to the DPC on 20 January 2021, and stated that they
would contact the Respondent directly regarding the unknown charges. The Data Subject
informed the DPC that it had still not received a response from the Respondent as to why it
had not acknowledged receipt of their registered letter, nor had information on the
Respondent’s retention policies been provided.
10. On 11 August 2021, the DPC contacted the Respondent requesting it to address the
outstanding issues raised by the Data Subject. On 13 September 2021, the Respondent
provided the DPC with a link to its privacy policy for the attention of the Data Subject, which
set out its retention policy in respect of credit card details of users of its service. The
Respondent again reiterated that the email address that the Data Subject had used to contact
it was not a valid email address. The DPC subsequently engaged with the Respondent further
seeking clarification regarding the registered letter that was sent by the Data Subject, which
was unanswered by the Respondent. On 3 November 2021, the Respondent replied to the
DPC, stating that it had undertaken a comprehensive search to locate the letter, however, it
was not found nor had any internal records of it being received been found. The Respondent
noted that while it was possible that it may have been delivered to it, it is also possible that,
due to an administrative error on the part of the postal service or a mistake in the address, it
may have not reached the Respondent. The Respondent noted that it would happily continue
its search for the letter, if required, if further information could be provided by the Data
Subject, including any postal reference number, tracking number, or an image of the envelope
clearly showing the address the letter was sent to.
11. The DPC subsequently wrote to the Data Subject on 17 November 2021, outlining the
Respondent’s response. In the circumstances, the DPC asked the Data Subject to notify it,
within two months, if they were not satisfied with the outcome, so that the DPC could take
further action. The DPC did not receive any further communication from the Data Subject and,
accordingly, the complaint has been deemed to have been amicably resolved.
12. In circumstances where the subject-matter of the complaint has been amicably resolved, in
full, the complaint, by virtue of Section 109(3) of the 2018 Act, is deemed to have been
withdrawn by the Data Subject.
Confirmation of Outcome
13. For the purpose of Document 06/2021, the DPC confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties
concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
4
c. Having consulted with the supervisory authorities concerned on the information set
out above, as required by Document 06/2021 the DPC has now closed off its file in
this matter.
14. If dissatisfied with the outcome recorded herein, the parties have the right to an effective
remedy by way of an application for judicial review, by the Irish High Court, of the process
applied by the DPC in the context of the within complaint.
Signed for and on behalf of the DPC:
_____________________________
Deputy Commissioner
Data Protection Commission
5