CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 24/RECL11/2023 of 27 March 2023 of the National Data Protection Commission, in a plenary session, on complaint file No 6.342 lodged against the company [REDACTED] via IMI Article 61 procedure 174271
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the 'GDPR');
Having regard to the Act of 1 August 2018 on the organisation of the National Data Protection Commission and the General Data Protection Regime (hereinafter referred to as the 'Law of 1 August 2018');
Having regard to the Rules of Procedure of the National Data Protection Commission adopted by Decision No 3AD/2020 of 22 January 2020 (hereinafter referred to as the 'ROP');
Having regard to the complaints procedure before the National Data Protection Commission adopted on 16 October 2020 (hereinafter referred to as the 'Complaint Procedure before the CNPD');
Having regard to the following:
# I. Facts and procedure
1. In the framework of the European cooperation, as provided for in Chapter VII of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR), the Supervisory Authority of Bavaria (Germany) submitted to the National Data Protection Commission (hereinafter: "the CNPD") the complaint of [REDACTED] (national reference of the concerned authority: LDA-1085.3-10738/20-I) via IMI in accordance with Article 61 procedure -174271.
2. The complaint was lodged against the controller [REDACTED], who has its main establishment in Luxembourg. Under Article 56 GDPR, the CNPD is therefore competent to act as the lead supervisory authority.
3. The original IMI claim stated the following:
"The complainant states that since March 2020 she has been receiving parcels from [REDACTED] at regular intervals, all of which are sent from China.
She has contacted [REDACTED] and has repeatedly requested that all her accounts under her e-mail address be closed and her personal data deleted.
1
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 24/RECL11/2023 of 27 March 2023 of the National Data Protection Commission, in a plenary session, on complaint file No 6.342 lodged against the company [REDACTED] via IMI Article 61 procedure 174271
On August 22, 2020, she received an e-mail from [REDACTED] confirming that the process of closing the account and deleting the data for all accounts under the e-mail address mentioned above had been initiated.
Although she was subsequently able to determine that her [REDACTED] account had been blocked/closed on 23/08/2020, she did not receive any confirmation that her personal data had actually been deleted. Rather, she has continued to receive unwanted parcel deliveries from China.
Furthermore, she filed a complaint against the company [REDACTED] that unknown third parties were apparently able to create customer accounts and place orders using her personal data, so that she was requested by debt collection companies to pay for ordered products which she had not ordered and whose order date was after the closure/blocking of her customer account.
Furthermore, she demands the deletion of all her personal data from [REDACTED] and the commissioned collection agency, as well as the renouncement of the debt collection."
4. In essence, the complainant asks the CNPD:
i. To request [REDACTED] to close all her accounts and delete her personal data registered with [REDACTED] as well as make [REDACTED] renounce to any debt collection.
ii. To check on the lawfulness of the processing.
5. The complaint is therefore based on Articles 17 and 5 (1) (f) GDPR.
6. On the basis of this complaint and in accordance with Article 57(1)(f) GDPR, the CNPD requested [REDACTED] to take a position on the facts reported by [REDACTED] and in particular to provide a detailed description of the issue relating to the processing of the complainant's data, and in particular with regard to her request for erasure and the lawfulness of the processing in this particular case.
7. The CNPD received the requested information within the deadlines set.
## II. In law
### 1. Applicable legal provisions
2
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 24/RECL11/2023 of 27 March 2023 of the National Data Protection Commission, in a plenary session, on complaint file No 6.342 lodged against the company [REDACTED] via IMI Article 61 procedure 174271
8. Article 77 GDPR provides that “without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, (...) if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.”
9. In accordance with Article 5 (1) (f) of the GDPR “Personal data shall be [...] processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)”.
10. In accordance with Article 17 of the GDPR “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies (...)”
11. Article 56(1) GDPR provides that “(...) the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60”;
12. According to Article 60(1) GDPR, “The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other”;
13. According to Article 60(3) GDPR, “The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views”;
## 2. In the present case
14. Following the intervention of the Luxembourg supervisory authority, [REDACTED] confirmed that:
3
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation No 24/RECL11/2023 of 27 March 2023 of the National Data Protection Commission, in a plenary session, on complaint file No 6.342 lodged against the company [REDACTED] via IMI Article 61 procedure 174271
- it completed the complainant's request for account closure and deletion of her personal data in connection with the accounts relating to the e-mail address (xxx) in August 2020;
- it investigated the case and informed the CNPD that [REDACTED] placed nine orders in April 2020 with the seller from China, which [REDACTED] had identified as the sender of the unwanted packages;
- that the seller's conduct in this case appeared to be a form of 'brushing', meaning that concretely in this case, the seller collected the complainant's address from her previous orders and then started using the address abusively to send unwanted packages (because in similar cases, the orders are initiated by sellers who would like to obtain positive ratings and references for their seller profile);
- according to [REDACTED]'s communication with [REDACTED] (i.e. [REDACTED] went back to the complainant to ask additional information regarding her request to block sellers from China following the letter from the CNPD), these orders were not debited from her bank account;
- [REDACTED] took further action after corresponding with the complainant in 2020, so that the accounts of the identified selling parts were permanently blocked and excluded from offering on [REDACTED];
- [REDACTED] inferred that following the letter by the CNPD, it was working on compiling the information on the sellers responsible for the unwanted packages and assured that once this was complete, it would share it with [REDACTED];
- in addition, [REDACTED] confirmed that any bad debt on [REDACTED]'s account had been cleared so that there was no remaining financial damage and that [REDACTED] assured that in their announced communication with the complainant, [REDACTED] would provide clarification regarding the invoice.
### 3. Outcome of the case
15. The CNPD, in a plenary session, therefore considers that, at the end of the investigation of the present complaint, the controller has taken appropriate measures to demonstrate the lawfulness of the processing in accordance with Articles 5 and 6 GDPR and to grant the complainant's right to erasure of her personal data, in accordance with Article 17 GDPR.
16. Thus, in the light of the foregoing, and the residual nature of the gravity of the alleged facts and the degree of impact on fundamental rights and freedoms, it does not appear necessary to continue to deal with that complaint.
4
Deliberation No 24/RECL11/2023 of 27 March 2023 of the National Data Protection Commission, in a plenary session, on complaint file No 6.342 lodged against the company [REDACTED] via IMI Article 61 procedure 174271
17. The CNPD then consulted the supervisory authority of Bavaria (Germany), pursuant to Article 60(1), whether it agreed to close the case. The Supervisory Authority of Bavaria (Germany) has responded affirmatively, so that the CNPD has concluded that no further action was necessary and that the cross-border complaint could be closed.
In light of the above developments, the National Data Protection Commission, in a plenary session, after having deliberated, decides:
- To close the complaint file 6.342 upon completion of its investigation, in accordance with the Complaints Procedure before the CNPD and after obtaining the agreement of the concerned supervisory authority.
Belvaux, dated 27 March 2023
The National Data Protection Commission
Tine A. Larsen Chair
Thierry Lallemang Commissioner
Alain Herrmann Commissioner
Marc Lemmer Commissioner
### Indication of remedies
This Administrative Decision may be the subject of an appeal for amendment within three months of its notification. Such an action must be brought by the interested party before the administrative court and must be brought by a lawyer at the Court of one of the Bar Associations.
5