ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Notation made: 04.11.2022
The access restriction shall be valid until: 04.11 2097
p 2 until the entry into force of the decision
Base: AvTS § 35 lg 1 p 12, AvTS § 35 lg 1 p 2
unofficial translation
Our 04.11.2022 nr 2.1.-1/22/635
Final Decision
Notice of termination of proceedings in a personal data protection case
The Data Protection Inspectorate received a complaint from the German data protection
authority (SA Berlin) via the cross-border procedural system IMI concerning a complaint by
, a German resident, against concerning the deletion of data.
According to the complaint, the applicant requested to delete his data, but that was not the
case at the time of the appeal. It is apparent from the correspondence annexed to the complaint
that the applicant sent a request by e-mail to the German entity for the deletion of its data,
but received from customer support the reply that it had to submit a request to that effect through
the application. By that time, the applicant had deleted the application from its device,
so that it was no longer able to submit an application via the app and did not allow any other
means to be used.
Article 17(1) of the General Data Protection Regulation (GDPR) gives a person the right to
request the erasure of their data and the controller is obliged to erase personal data without undue
delay if one of the circumstances listed in that provision exists. The data controller need not
erase the data if the processing is necessary for the reasons referred to in Article 17(3).
Pursuant to Article 12(3) of the GDPR the controller must provide the data subject without undue
delay, but no later than one month after receiving the request, information on measures taken on
the basis of the request.
On the basis of the above, I initiated supervision proceeding on the basis of Section 56(3)(8) of
the Personal Data Protection Act. As part of the supervisory procedure, I made an inquiry to
in order to ascertain why his account had not been deleted at the applicant’s
request. has replied to the inquiry and explained the following:
Deleting an account through the app is the easiest and fastest way, since the right of the account
holder has already been established. If the account holder no longer has access to the
application, then alternatively we offer deletion by e-mail. The prerequisite for this is the
verification of the e-mail, which can be launched by the account holder independently in the
application or by the customer support representative. The email address verification
process also does not require access to the application.
Tatari 39, 10134 Tallinn Telefon 627 4135
Registrikood 70004235 E-post [email protected] www.aki.ee
We confirm that it is possible to delete an account even without entering the app if the request
has been sent to from a verified address, which in turn is linked to the account.
Verification of the email and confirmation of the phone number are minimum steps so that we
can be sure of the right of the account holder if the data subject does not have the possibility or
will to forward the request to delete the account in-app.
On 15 June 2022 confirmed to the Inspectorate that the process of deleting
the applicant’s account has been completed.
has confirmed in the telephone conversation that they will again instruct the
customer service staff regarding the possibilities of deleting the account.
has confirmed to the Inspectorate that they have sent the complainant a
confirmations of the deletion of his data.
Summary
The applicant submitted to a request for deletion of personal data in
accordance with the Article 17 of the GDPR by email and explained that he no longer has the
opportunity to submit such request through the application. Therefore,
should have dealt with the applicant´s request, in accordance with Article 12(3) of the GDPR,
should have responded to the complainant. In this case did not do this.
Based on the above and considering the fact that has fulfilled the request to
delete the complainant´s account and also sent the complainant a response to his request, I will
terminate the supervision procedure.
With respect
(signed digitally)
lawyer
under the authority of the Director-General
2 (2)