TRANSLATION
PRESIDENT
OF THE PERSONAL DATA PROTECTION
OFFICE
Jan Nowak
Warsaw, 9 March 2023
DS.523.467.2022.ZS.JKO.
DECISION
Pursuant to Article 104 §1 of the Act of 14 June 1960 Code of Administrative
Procedure (Journal of Laws 2022, item 2000 as amended), Art. 7(1) and (2) of the Act on
Personal Data Protection of 10 May 2018 (Journal of Laws 2019, item 1781), in conjunction
with Art. 58 (2)(b) and Article 12(3) and (4) in conjunction with Art. 17(1) of the Regulation
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) (Journal of Laws EU L 119 of 04.05.2016, p. 1 and Journal of Laws of the EU L
127 of 23.05.2018, p. 2 and Journal of Laws UE L 74 of 4.03.2021, p. 35) (hereinafter:
GDPR), having conducted an administrative proceedings concerning the complaint lodged
by (address:
on irregularities in the processing of her personal data by
company with its registered office in Warsaw at
, consisting in the failure to comply with the request to erase her
personal data, President of the Personal Data Protection Office
provides a reprimand to company with its registered office in
Warsaw at for violation of Article 12(3) and
Article 17(1) of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L
119 of 4.05.2016, p. 1, Official Journal of the EU L 127 of 23.05.2018, p. 2, and Official
Journal of the EU L 74 of 4.03.2021, p. 35), consisting in the failure to act promptly,
and at the latest within one month, on the request to erase the personal data of
(address:
) from the website with URL address
Justification
Personal Data Protection Office has received a complaint from the Spanish
Supervisory Authority (hereinafter: Spain SA), through the Internal Market Information
Office of Protection it’s a tel. 22 531-09-01
Personal data
U.S.A. Rates 2
00-193 Warsaw www.uodo.gov.pl
System (IMI)1 via
an Article 56 notification under the number A56ID 356000.1 from
(address:
, hereinafter the Complainant, regarding irregularities in the processing of her
personal data by company with its registered office in Warsaw at
, hereinafter: the Company, consisting of failure to
comply with the request to delete the Complainant’s personal data processed on the website
regarding the e-mail address, password to the user’s account
(hidden using stars), name and surname, date of birth, address, telephone number and
payment method. The Polish Supervisory Authority (hereinafter: Polish SA), which is the
President of the Personal Data Protection Office (hereinafter PDPO), having analyzed the
facts of the case, considered itself as the leading supervisory authority to conduct the
present complaint case pursuant to Article 56(1) of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data and
repealing Directive 95/46/EC (General Data Protection Regulation (Official Journal of the
EU L 119 of 4.05.2016, p. 1, Official Journal of the EU L 127 of 23.05.2018, p. 2, and Official
Journal of the EU L 74 of 4.03.2021, p. 35) hereinafter: GDPR, due to the registered office
of the Company, which is located on the territory of Poland, as informed by the Spanish SA
on 19 January 2022.
In the complaint, the Complainant indicated that she was a user of the service through
which the Company operates, i.e. the website The
Complainant also indicated that she wants to delete her account, but does not find a special
button to perform this action, as mentioned in the "FAQs" section. The complainant stated
that she sent two deletion requests to the mailbox that appears as the controller's contact
information on the website, but received no response. The complainant also pointed out that
she continues to receive emails with new surveys to fill out and can still log into her user
account.
In the course of the investigation in the present case, the President of the PDPO, as
the lead supervisory authority, obtained clarifications on the circumstances of the case and
established the following facts.
1. The President of the PDPO on 9 May 2022, through the Spanish SA notified the
Complainant that the present complaint case had been identified as having a cross-
border nature
in accordance with Article 4(23) of the GDPR and the President of the PDPO initiated
an administrative investigation procedure and asked the Company to submit an
explanation on the matter;
2. The President of the PDPO on 9 May 2022, requested the Company to respond to
the content of the complaint and provide an explanation of the case;
3. In explanations submitted to the President of the PDPO on 19 May 2022, the
Company indicated the following:
a. The Company currently does not process the Complainant's personal data on the
website as this data has been deleted by the Company. Before
deletion, the Company processed the Complainant's personal data provided by the
1
European Commission Internal Market Information System.
2
Complainant in the course of creating an account on the
website on the basis of:
Article 6(1)(b) of the GDPR - the necessary for the performance of the agreement
for the provision of account services, in order to create an individual account,
manage this account and provide access to surveys and conduct billing of
services provided under the concluded agreement, in terms of: e-mail address,
address data (postal code), date of birth, gender;
Article 6(1)(a) of the GDPR - consent of the data subject for the performance of
an agreement for the provision of a Newsletter service for the purpose of
performing
an agreement the subject of which is a service provided electronically, in the
following scope: e-mail address;
Article 6(1)(f) of the GDPR - legitimate interest, for the purpose of establishing,
investigating and enforcing claims and defending against claims in proceedings
before courts and other state authorities, in terms of: name and surname, home
address, telephone number, data on the use of services if the claims arise from
the way the user uses the services, other data necessary to prove the existence
of the claim, including the extent of the damage suffered;
b. The Company pointed out that the Complainant had never been employed by the
Company;
c. The Complainant sent an early email to the Company on 7 September 2021
requesting that her account be closed. Then on 14 September 2021 the Complainant
sent a second email from the same email address to the Company regarding the
processing of her personal data, indicating in the content an email address that did
not appear in the Company's database;
d. The Company deleted all of the Complainant's personal data processed on the
website and on 19 May 2022 responded to both of the
Complainant's messages confirming the full implementation of the request made by
the Complainant, as proof of which it attached 2 screenshots showing the full content
of the Company's correspondence with the Complainant;
e. The Company explained that the delay in processing the Complainant's request was
caused by a technical error consisting in the incorrect classification of messages from
the Complainant by the e-mail server, as a result of which the Complainant's
messages were moved to the SPAM folder. Immediately upon receiving information
about the incident in question, the Company performed an investigation of the
circumstances of the case and took all available measures to ensure the highest
possible level of personal data protection, compliance with data protection
regulations and to prevent similar situations in the future. The Company stressed that
the technical error that caused the incident had been analyzed, the Complainant's
personal data had been deleted, and a response had been given to the
correspondence sent by the Complainant. As a result of the deletion of the
Complainant's account, the Company also stopped sending emails to the
Complainant containing invitations to complete the survey;
f. The Company indicated that it conducted a detailed review of the correctness of the
processing of personal data in terms of the legal basis, purposes and scopes, and
the updating of such data. The Company stressed that in order for the scope of
3
personal data in particular to comply with the principle of data minimization indicated
in Article 5(1)(c) of the GDPR, as a result of this analysis it decided to collect less
personal data and to make a comprehensive update of personal data stored in the
Company's database. The update consisted of deleting currently stored redundant
personal data (as redundant data, personal data about which there could be any
doubt in demonstrating the correct legal basis was classified) in the form of: telephone
number and address data in terms of street name and house/apartment number;
g. The Company stated that corrective procedures have been put in place involving the
use of new technical solutions to improve communication with the customer and
speed up the processing of the data subject's request for deletion of personal data.
On the website: in the customer panel, a new solution was
added and tested in the form of an account deletion button that allows direct and
independent account deletion;
h. The Company stated that the Complainant's personal data was also processed on
the basis of consents given by the Complainant via the website when setting up an
account on the website: . With regard to the Complainant's
consent to receive a newsletter, the Company pointed out that it had discontinued
the newsletter service and the Complainant had never received commercial
information within the meaning of the Act of 18 July 2002 on electronic services;
i. The Company stated that when processing personal data in the course of its
business, it makes every reasonable effort to ensure the safety of personal data
processing, compliance with the provisions of the GDPR and other data protection
laws, and the realization of the rights of the individuals to whom the data relates. In
view of the relevant situation, the Company also ensures that the frequency of internal
audits is increased in terms of the compliance of personal data processing with the
law, as well as the verification and updating of data in the database in order to ensure
the continued compliance of processed data with the facts.
After reviewing the whole of the evidence gathered in the case, the President of the
PDPO considered the following.
The President of the PDPO, when issuing an administrative decision, is obliged to
decide based on the facts existing at the time of issuing the decision. As the doctrine states,
"the public administration authority evaluates the factual state of the case according to the
moment of issuing the administrative decision. This rule also applies to the assessment of
the legal state of the case, which means that the public administration authority issues an
administrative decision on the basis of the law in effect at the time of its issuance (...).
Adjudication in administrative proceedings involves applying the applicable law to the
established facts of an administrative case. Thus, the public administration authority realizes
the purpose of administrative proceedings, which is the realization of the applicable legal
norm in the field of administrative-legal relations, when these relations require it"
(Commentary to the Act of 14 June 1960, Code of Administrative Procedure M. Jaskowska,
A. Wróbel, Lex., el/2012).
Pursuant to Article 17(1) of the GDPR the data subject shall have the right to obtain
from the controller the erasure of personal data concerning him or her without undue delay
and the controller shall have the obligation to erase personal data without undue delay, inter
alia if the personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed (Art(1)(a) of the GDPR), if the data subject withdraws
4
consent on which the processing is based according to point (a) of Article 6(1), or point (a)
of Article 9(2), and where there is no other legal ground for the processing (Art. 17 (1)(b) of
the GDPR) or also if the personal data have been unlawfully processed (Art. 17(1)(d) of the
GDPR).
However, pursuant to Article 12(2) of the GDPR the controller shall facilitate the
exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article
11(2), the controller shall not refuse to act on the request of the data subject for exercising
his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a
position to identify the data subject.
Moreover, the controller shall provide information on action taken on a request under
Articles 15 to 22 to the data subject without undue delay and in any event within one month
of receipt of the request. That period may be extended by two further months where
necessary, taking into account the complexity and number of the requests. The controller
shall inform the data subject of any such extension within one month of receipt of the
request, together with the reasons for the delay. Where the data subject makes the request
by electronic form means, the information shall be provided by electronic means where
possible, unless otherwise requested by the data subject (Article 12(3) of the GDPR).
In the course of the administrative proceedings, it was established that on 7
September 2021 the Complainant requested the Company via an email to delete her
personal data, including the account established in the service available on the website
14 September 2021 the Complainant again requested the same thing
from the Company through another email sent to the Company. As of the date of the
Complainant's complaint, i.e. 14 November 2021 the Complainant was still able to access
the website in question using her credentials, and her request for deletion by the Company
had not been processed. The Company, in its explanations, admitted that due to a technical
error involving the misclassification of messages by the email server, the messages with the
Complainant's request were moved to the SPAM folder, as a result of which there was a
delay in the in the processing of the request for deletion of the Complainant's data, and the
data was not deleted until 19 May 2021, of which the Company informed the Complainant
via email on the same day (evidence: two screenshots responding to the Complainant's
requests of September 7 and 14, 2021). It should also be pointed out that despite the lack
of expediency in the Company's actions, the Company did not act promptly, or at the latest
within a month, on the Complainant's request to delete her data in accordance with its
obligation under the provisions of the GDPR as a controller.
As indicated in Recital 59 of the GDPR, modalities should be provided for facilitating
the exercise of the data subject's rights under this Regulation, including mechanisms to
request and, if applicable, obtain, free of charge, in particular, access to and rectification or
erasure of personal data and the exercise of the right to object. The controller should also
provide means for requests to be made electronically, especially where personal data are
processed by electronic means. The controller should be obliged to respond to requests
from the data subject without undue delay and at the latest within one month and to give
reasons where the controller does not intend to comply with any such requests.
In the light of the above, it should be pointed out that the Company has failed to
comply with the disposition specified in Article 12(3) of the GDPR. It is clear from the
evidence gathered in the case that the Complainant requested the deletion of her data twice,
including for the first time on 7 September 2021, while the Company deleted the
5
Complainant's data only after the intervention of the President of the PDPO on 19 May 2022,
thus definitely after the deadlines under Article 17(1) of the GDPR and informed the
Complainant of this in violation of the deadline under Article 12(3) of the GDPR. Accordingly,
the President of the PDPO, pursuant to Article 58(2)(b) of the GDPR, provided a reprimand
to the Company in this regard.
The President of the PDPO, acting on the basis and within the limits of the powers
granted to him by the provisions of the GDPR, when issuing a decision examines the factual
and legal situation as of the date of the decision. In the present case, the Company failed to
comply with its obligations as an controller and violated the provisions of Articles 12(3) and
17(1) of the GDPR. Accordingly, the President of the PDPO has decided to provide a
reprimand to restore compliance with the law. Referring to the regulation of Article 58(2)(c)
of the GDPR, it should be noted that the President of the PDPO may order a controller or
processor to comply with a data subject's request arising from his or her rights under the
regulation, i.e. to restore the state of lawfulness in the event of a violation of data protection
regulations. However, the fundamental fact affecting the content of this ruling is that the
Complainant's request for deletion of personal data was finally granted by the Company and
the Complainant's personal data is not currently being processed in the disputed manner,
so the authority cannot order its deletion.
In this factual and legal state, the President of the PDPO has adjudicated as
indicated in the operative part of the decision.
Under the authority of the
President of the Personal Data Protection Office
Director of the Complaints Department
The decision is final. Pursuant to Article 7(2) of the Act of 10 May 2018 on the Protection of Personal Data (Journal of
Laws 2019, item 1781) in connection with Article 13 § 2, Article 53 § 1 and Article 54 § 1 of the Act of 30 August 30 2002
Law on Procedure before Administrative Courts (Journal of Laws 2022, item 329, as amended), the party has the right to
lodge a complaint against this decision with the Voivodeship Administrative Court in Warsaw, within 30 days from the date
of its delivery to the party. The complaint is lodged via the President of the Personal Data Protection Office. The fee for the
complaint is in the amount of 200 PLN. The party has the right to apply for the right of aid, which includes exemption from
court costs and the appointment of an attorney, legal advisor, tax advisor or patent attorney. The right of aid may be granted
upon the request of a party submitted before the initiation of the procedure or in the course of the procedure. This request
is free of court fees.
6