1(5)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s decision 2023-
03-23, no. IMY-2022-9186. Only the Swedish version of the
decision is deemed authentic.
Ref no:
IMY-2022-9186 Decision pursuant to Article 60 under
the General Data Protection
Date of decision:
2023-03-23 Regulation – MAG Interactive AB
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection finds that MAG Interactive AB has
processed personal data in breach of Article 12(3) of the General Data Protection
Regulation (GDPR)1 by not having accommodated the complainant’s request for
erasure made on 4 August 2021 without undue delay, and first on 26 November 2021.
The Swedish Authority for Privacy Protection issues a reprimand to MAG Interactive
AB pursuant to Article 58(2)(b) of the GDPR for the infringement of Article 12(3) of the
GDPR.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
MAG Interactive AB (the company) due to a complaint, mainly to investigate whether
MAG Interacitve AB has received and handled the complainant’s request for erasure in
accordance with Articles 12 and 17 of the GDPR. The complaint has been submitted to
IMY, as lead supervisory authority pursuant to Article 56 of the GDPR. The handover
has been made from the supervisory authority of the country where the complainant
has lodged their complaint (Germany) in accordance with the provisions of the GDPR
on cooperation in cross-border processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The supervisory authorities
concerned have been the data protection authorities in Denmark, France, Ireland,
Norway, Poland, Germany and Austria.
Postal address:
Box 8114
104 20 Stockholm The complaint
Website: The complainant has mainly stated the following. The complainant requested erasure
www.imy.se of its account in the ‘Quiz Duell’ app in July 2021. Since no deletion had been carried
E-mail: out, the complainant posted a Google Play rating to bring it to the attention of the
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Phone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Our ref: IMY-2022-9186 2(5)
Date:2023-03-23
company. On 30 August 2021, the complainant received a reply to the made post, in
which the complainant was referred to contact the company at
[email protected]. The complainant sent a message to that email
address on 8 September 2021 and reminded of the made request. On 7 and 16
October 2021, the complainant reminded again of the request. In response to the
email of 16 October 2021, the complainant received a standard reply from the
company. On 16 October 2021, the complainant’s request had still not been
accommodated.
What the company has stated
In its statement from 7 November 2022, the company essentially stated the following.
The Company is the data controller for the processing to which the complaint relates.
The Company’s description of the events surrounding the complainant’s request for
erasure
On 4 August 2021, the complainant requested to have his data deleted from the game
Quiz Duell. The request was made directly in the game and was received by the
company. The request should have been processed automatically on 18 August 2021
but did not for the reasons set out below.
On 30 August 2021, the complainant submitted a review on Google Play and
complained, inter alia, that deletion had not taken place. The company has a built-in
function in the games to communicate with support, but the complainant had either not
seen it or chose not to use that feature. On 31 August 2021, the company’s support
replied and asked the complainant to send an email to a specified support address for
getting help to find out what went wrong.
The complainant then claims that an email was sent to the that email address on two
occasions (8 September and 7 October 2021) but the company has no listing in its
support system, ZenDesk, that they have received any emails from the complainant.
The complainant also claims that it did not receive a response from the company’s
support, which also indicates that the company has never received any emails from
the complainant. The support will respond to all incoming issues. What has gone
wrong here, if the complainant has written the wrong email address or if the
complainant´s email stuck in any spam filter, the company does not know but
everything indicates that the complainant´s email unfortunately did not arrive.
On 16 October 2021, the complainant emailed one of the company’s email addresses
with an autoreply that has instructions on how to request deletion of data and how to
contact support. That email has been received by the company and the company has
also responded to it automatically on the same day.
On 22 November 2021, the company discovered a system problem that led to the
failure to erase the data of some persons as they were supposed to be. The error was
fixed. On 26 November 2021, the complainant’s data was deleted by the company.
What the company states as a reason why the applicant’s request for erasure was not
handled automatically
During the summer of 2021, the company had a system problem that led to users
being stuck in a queue and not deleted as they would. The complainant was one of
those users, which resulted in the complainant’s data not being deleted on 18 August
Privacy Protection Authority Our ref: IMY-2022-9186 3(5)
Date:2023-03-23
2021 as intended. The problem was detected on 22 November 2021 and the error was
promptly addressed. The users stuck in the queue were then processed automatically.
Finally, on 26 November 2021, the complainant’s data was deleted. The error was not
detected until both the erasure deadline and the deadline for delay had expired. The
user should have been informed of the deletion once it occurred and has also been
informed retrospectively, on 30 October 2022.
The company will provide information to all affected persons they can still reach,
including the complainant, with an explanation of what happened, regret the delay and
provide a further confirmation that their data has been deleted.
The company also states that in connection with the discovery of the problem, they
also expanded their monitoring system to cover also this error case, which means that
the company’s operating staff receive a text message regardless of the time of day if a
similar problem occurs. There has not occurred any similar case since then.
Statement of reasons for the decision
Applicable provisions, etc.
Pursuant to Article 17(1) of the GDPR, the data subject shall have the right to obtain
from the controller the erasure of personal data concerning him or her without undue
dealy and the controller shall have the obligation to erase personal data without undue
delay where one of the conditions listed in this Article exists, for example if the data
are no longer necessary for the purposes for which they were collected or if the
consent for processing is withdrawn.
Pursuant to Article 12(3) of the GDPR, upon request, the controller shall provide the
data subject, without delay and in any event no later than within one month of receipt
of the request, with information on the measures taken pursuant to, inter alia, Article
17. That period may be extended by two months further, if necessary, taking into
account the complexity of the request and number of requests received. The controller
shall inform the data subject of such an extension within one month of receipt of the
request and shall state the reasons for the delay.
Assessment of IMY
MAG Interactive AB has stated that the request made by the complainant on 4 August
2021 was received on the same day and completed on 26 November 2021, i.e.
approximately 3 months and 3 weeks after it was made. It did not state that it had to
extend the time-limit for handling the complainant’s request, nor did the company notify
the complainant of such an extension.
MAG Interactive AB has thus acted in breach of Article 12(3) of the GDPR by failing to
comply with the complainant’s request for deletion made on 4 August 2021 without
undue delay as it was processed first on 26 November 2021. What MAG Interactive
AB have brought forward, that the reason for the delay concerns a system problem,
does not lead to any different assessment.
Choice of corrective measure
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
Privacy Protection Authority Our ref: IMY-2022-9186 4(5)
Date:2023-03-23
circumstances of the case, administrative fines shall be imposed in addition to or in
place of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be taken into account
when imposing administrative fines and when determining the amount of the fine. In
the case of a minor infringement, IMY may, as stated in recital 148, instead of
imposing a fine, issue a reprimand pursuant to Article 58(2)(b). Account needs to be
taken to the aggravating and mitigating circumstances of the case, such as the nature,
gravity and duration of the infringement as well as past infringements of relevance.
IMY notes the following relevant facts. The infringement in question, which the
supervision covers, has affected one person and has occurred due to a temporary
system problem at MAG Interactive AB. The company states that it has taken
measures to prevent similar problems from occurring. Against this background, IMY
considers that this are minor infringements within the meaning of recital 148 which
results in MAG Interactive AB being given a reprimand under Article 58(2)(b) of the
GDPR for the infringement found.
___________________________________________________
This decision has been taken by the specially appointed decision-maker, legal advisor
, following a presentation by legal advisor .
Privacy Protection Authority Our ref: IMY-2022-9186 5(5)
Date:2023-03-23
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority’s contact information is shown in the first page of the
decision.