To Good To Go ApS
Landskronagade 66
2100 København Ø
27 March 2023
Sent by Digital Post J.No. 2021-7320-2722
Doc.no. 495756
Caseworker
Draft decision: Complaint about the processing of personal data
The Danish Data
Protection Agency
The Danish Data Protection Agency (DPA) hereby returns to the case in which Carl Jacobsens Vej 35
(hereinafter referred to as ‘complainant’) has complained to the Dutch Data Protection Author- 2500 Valby
Denmark
ity that Too Good To Go (hereinafter TGTG) did not respond to his request for deletion of his
T 3319 3200
personal information. [email protected]
datatilsynet.dk
Pursuant to Article 56 of the Data Protection Regulation, the Dutch Data Protection Authority VAT No. 11883729
has forwarded this complain to the Danish Data Protection Agency, which has assumed the
role of leading supervisory authority in relation to TGTG’s cross-border processing activities.
1. Decision
Following an examination of the case, the Danish Data Protection Agency finds that there are
grounds to issue a reprimand as the processing of personal data done by TGTG was not
done in accordance with Article 12(3) of the General Data Protection Regulation.
As the data covered by the complainant’s request for erasure has been deleted, the Danish
Data Protection Agency has not considered the basis for notifying to delete the complainant’s
customer account.
The details of the case and the reasons for the decision of the Danish Data Protection Agency
are set out below.
2. Statement of the facts
The complainant sent e-mails containing a request for erasure of his personal data to TGTG
on December 20th 2019 and April 10th 2020. The e-mails were sent to [email protected].
As the complainant did not receive a response from TGTG the complainant lodged a complaint
with the Dutch Data Protection Authority on July 2nd 2020.
On July 12th 2021, the Danish Data Protection Agency sent the complaint in hearing asking
TGTG for an opinion on the matter.
On August 3rd 2021 TGTG made a statement to the Danish Data Protection Agency on the
matter.
The Danish Data Protection Agency forwarded the statement of TGTG to the complainant on Page 2 of 13
September 8th 2021, with a request for any additional comments. The Danish Data Protection
Agency did not receive a response from the complainant.
2.1. Remarks by the complainant
The complainant has generally stated that TGTG has not responded to his request for deletion.
2.2. Comments by Too Good To Go
TGTG has stated that the company did receive the complainant’s request for erasure by e-
mail of December 2019. TGTG elaborated, that due to a human error, no action was taken to
comply with the request and thus no reply was sent to the complainant.
Moreover, TGTG stated, that the company initiated their standard procedure for the erasure
of user data as a result of receiving the hearing from the Danish Data Protection Agency.
Furthermore, TGTG confirmed that the complainant’s user profile had been erased.
Furthermore, TGTG informed that the company had incorporated new measures to ensure
that similar error would not happen in the future.
3. Reasons for the decision of the Danish Data Protection Agency
It follows from Article 12(3) of the General Data Protection Regulation that the data controller
shall provide information on action taken on a request under amongst Article 17 regarding
erasure to the data subject without undue delay and in any event within one month of receipt
of the request. That period may be extended by two further months where necessary, taking
into account the complexity and number of the requests. The controller shall inform the data
subject of any such extension within one month of receipt of the request, together with the
reasons for the delay.
On basis of the facts presented in the case the Danish Data Protection Agency finds that TGTG
did not provide information to complainant on actions taken on basis of the request for erasure
within one month of receiving the request. In fact, the DPA finds that no actions were taken by
TGTG before the company received the DPA’s hearing of July 12th 2021.
On the basis of the above, the DPA issues a reprimand to TGTG as the controller did not
comply with their obligation under Article 12(3) in the General Data Protection Regulation.
4. Final remarks
The Danish Data Protection Agency considers the case closed and will not take further action
in the case.
Kind regards
Appendix: Legal basis
Extracts from regulation (EU) 2016/679 Of The European Parliament And Of The Council Page 2 of 13
of 27th of April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation).
Article 12. The controller shall take appropriate measures to provide any information referred
to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to
processing to the data subject in a concise, transparent, intelligible and easily accessible form,
using clear and plain language, in particular for any information addressed specifically to a
child. The information shall be provided in writing, or by other means, including, where appro-
priate, by electronic means. When requested by the data subject, the information may be
provided orally, provided that the identity of the data subject is proven by other means.
2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In
the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the
data subject for exercising his or her rights under Articles 15 to 22, unless the controller demon-
strates that it is not in a position to identify the data subject.
3. The controller shall provide information on action taken on a request under Articles 15 to 22
to the data subject without undue delay and in any event within one month of receipt of the
request. That period may be extended by two further months where necessary, taking into
account the complexity and number of the requests. The controller shall inform the data subject
of any such extension within one month of receipt of the request, together with the reasons for
the delay. Where the data subject makes the request by electronic form means, the information
shall be provided by electronic means where possible, unless otherwise requested by the data
subject.
4. If the controller does not take action on the request of the data subject, the controller shall
inform the data subject without delay and at the latest within one month of receipt of the request
of the reasons for not taking action and on the possibility of lodging a complaint with a super-
visory authority and seeking a judicial remedy.
5. Information provided under Articles 13 and 14 and any communication and any actions
taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a
data subject are manifestly unfounded or excessive, in particular because of their repetitive
character, the controller may either: a) charge a reasonable fee taking into account the admin-
istrative costs of providing the information or communication or taking the action requested; or
b) refuse to act on the request. The controller shall bear the burden of demonstrating the mani-
festly unfounded or excessive character of the request.
6. Without prejudice to Article 11, where the controller has reasonable doubts concerning the
identity of the natural person making the request referred to in Articles 15 to 21, the controller
may request the provision of additional information necessary to confirm the identity of the
data subject.
Article 17. The data subject shall have the right to obtain from the controller the erasure of
personal data concerning him or her without undue delay and the controller shall have the
obligation to erase personal data without undue delay where one of the following grounds
applies:
a) the personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to Page 2 of 13
point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal
ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no
overriding legitimate grounds for the processing, or the data subject objects to the
processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or
Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society
services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to para-
graph 1 to erase the personal data, the controller, taking account of available technology and
the cost of implementation, shall take reasonable steps, including technical measures, to in-
form controllers which are processing the personal data that the data subject has requested
the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing by Union or Member
State law to which the controller is subject or for the performance of a task carried out
in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with points (h)
and (i) of Article 9(2) as well as Article 9(3);
d) for archiving purposes in the public interest, scientific or historical research purposes
or statistical purposes in accordance with Article 89(1) in so far as the right referred
to in paragraph 1 is likely to render impossible or seriously impair the achievement of
the objectives of that processing; or
e) for the establishment, exercise or defence of legal claims.