ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
Ours: 17.11.2023 nr 2.1.-1/23/150-
462-8
Final Decision
1. Complaint of
SA Finland forwarded a complaint to SA Estonia in which the complainant
(hereinafter the data subject or complainant) stated that
(hereinafter the controller or has not responded to his request to delete his
personal data and Club One account from the controller’s systems. According to the
complaint, on 19.10.2022, he submitted a request to delete his data from the
system but has not received a response even after sending repeated requests.
is established in Estonia, so the leading supervisory authority is SA Estonia
according to GDPR Art 56 (1).
Based on the information, Estonian SA started official proceedings regarding the case.
We forwarded to the data controller our questions regarding the situation and explained
data subject’s right to be forgotten, referring to GDPR Art 17, as well as the data
controller’s obligation to provide information to data subject according to GDPR Art 12
(3).
2. The response of the data controller ) in regards to
’s complaint
The data controller provided explanations according to which 's IT operator
added 27.10.2022 a system confirmation that the complainant's Club One account has
been closed and his personal data has been made anonymous. Unfortunately, the system
does not show that the complainant had been notified about this. Therefore, the
complainant's data was deleted within the mandatory 30 days from the receipt of the
request but, unfortunately no notification was sent to the data subject due to human
error. The complainant contacted again on 08.02.2023. On the same day, a letter
of apology was sent to the complainant and with the explanation that his data has already
been deleted on 27.10.2022. also performed an additional check on the deletion
of the complainant's data and confirmed that the Club One account has been closed and
the personal data has been made anonymous. also checked for the complainant's
email address from 's various systems and did not find a single match.
3. Position of the Estonian Data Protection Inspectorate
Since the complainant’s personal data has been made anonymous by the controller
Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee
Registrikood 70004235
according to the request in a timely manner and the controller has given information
regarding the anonymization of complainant’s personal data, the data processor has
fulfilled the obligations arising from GDPR Art 17 and Art 12 (3). Although the
information was not given to the complainant in a timely manner, the SA Estonia finds
that it is not a major violation and since the delay was caused by a human error, SA
Estonia does not impose a penalty on the data processor.
Based on the above, SA Estonia finds that the violation of data subject’s rights has ended
and therefore will terminate the proceedings concerning the protection of personal data
regarding .
Respectfully,
lawyer
authorized by Director General
2 (2)