# The Hamburg Commissioner for Data Protection and Freedom of Information
IMI Reference No. 429871
National Reference Number:
In the matter of a complaint, lodged by , Poland with the Hamburg Commissioner for Data Protection and Freedom of Information pursuant to Article 77 of the General Data Protection Regulation, concerning
## FINAL DECISION SUI GENERIS FOR THE PURPOSE OF INTERNAL EDPB DOCUMENT 06/2021 ON THE PRACTICAL IMPLEMENTATION OF AMICABLE SETTLEMENTS, ADOPTED 18 NOVEMBER 2021
Hamburg, 2. February 2022
### Background
On 5 November 2021, (“the Data Subject”) lodged a complaint pursuant to Article 77 GDPR with the Hamburg Commissioner for Data Protection and Freedom of Information (“the HmbBfDI”) concerning (“the Controller”). As the Controller is based in Hamburg, Germany, the lead supervisory authority is the HmbBfDI in accordance with Art. 56 (1) GDPR.
### The Complaint
1. The details of the complaint were as follows:
a. The Data Subject is CEO of a public limited company, sp. z o.o.. In the Polish company’s register entry of February 2019, the Data Subject’s name is specified with a middle name initial “”. In February 2020, the Data Subject’s name was changed from “” to “” in a register entry. In the next register entry dating February 2020, the Data Subject’s name is shown without a middle initial.
b. The Controller reproduces commercial register information in an online-database. The information regarding the Data Subject’s name was published in graphic overviews including the middle initial “”.
www.datenschutz-hamburg.de
E-Mail: [email protected]
Confidential information should be transmitted to us by electronic means only in encrypted form. The public PGP-key is available on the internet (Fingerprint: 0932 579B 33C1 8C21 6C9D E77D 08DD BAE4 3377 5707).
The Hamburg Commissioner for
Data Protection and Freedom of Information
c. The Data Subject emailed the Controller on 15 October 2021 to request deletion
of the middle initial in its overview under URL [REDACTED]. The Controller stated that the mid-
dle initial had been contained in the company's register and demanded an official
name certificate from the Data Subject to prove it has no such middle name. The
Data Subject was of the opinion it had no obligation to provide an official name
certificate.
# Action taken by the HmbBfDI
1. The HmbBfDI started an Informal Consultation with PL SA (Office for the Protection of Personal Data) (IMI Reference No. 388073) in February 2022 as the Data Subject is residing in Poland. The HmbBfDI considered the concerns raised by PL SA in the consultation.
2. The HmbBfDI, having regard to Internal EDPB Document 06/2021 on the practical implementation of amicable settlements, adopted on 18 November 2021 ("Document 06/2021"), and considered that there is a reasonable likelihood of an amicable settlement being concluded between the parties within a reasonable time, and considered that (paragraph 64): only one data subject was affected, a systemic failure was not recognisable, there was an incidental or accidental data protection violation, as the middle name initial is contained in former company's register's entries, with the middle initial, a limited number of personal data was affected, the effects of the violation were not of serious nature and there is a small likelihood of further violations in the future.
# Amicable Settlement
3. The HmbBfDI engaged with both the Data Subject and the Controller in relation to the subject-matter of the complaint. Further to that engagement, it was established that the Controller was willing to change the name upon receipt of an official name certificate, but that the Data Subject was not willing to provide same.
4. In the circumstances, the Controller agreed to take the following action:
The Controller agreed to delete the middle name initial from all of its graphic overviews,
i.e. under URLs [REDACTED],
[REDACTED], as well as
[REDACTED] and
[REDACTED] and in any URLs
linked on its websites even without being provided an official name certificate by the Data
Subject.
- 2 -
The Hamburg Commissioner for
Data Protection and Freedom of Information
5. With this, the Controller has fully complied with the Data Subject's request to delete the middle name initial from the graphic overview under URL as it has deleted the middle initial from its overviews on all of its websites accessible via the online-database.
6. On 29 June 2022, the Data Subject was provided with the Controller's answer that the middle name initial had been deleted from its graphic overviews and depictions of commercial register entries. The correspondence noted that the deletion by the Controller appeared to constitute the resolution of the Data Subject's complaint. The Data Subject did not provide any additional comments. The HmbBfDI did not receive any further communication from the Data Subject. Accordingly, as the Controller has fully complied with the Data Subject's request to delete the middle name initials from its database-websites, without being provided an official name certificate/identity card, the complaint has been deemed to have been amicably settled.
7. In circumstances where the subject-matter of the complaint has been amicably settled, in full, the complainant, in accordance with Internal EDPB Document 06/2021 on the practical implementation of amicable settlements (adopted on 18 November 2021), is to be informed of the consequences of the amicable settlement.
# Confirmation of Outcome
8. For the purpose of Document 06/2021, the HmbBfDI confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
c. The HmbBfDI will close off its file in this matter having consulted with the supervisory authorities concerned on the information set out above, as required by Document 06/2021.
Signed for and on behalf of the HmbBfDI:
02. February 2022
Hamburg DPA
- 3 -