In the matter of the General Data Protection Regulation
DPC Complaint Reference:
IMI Complaint Reference Number:
In the matter of a complaint, lodged by with Berliner Beauftragte für Datenschutz
und Informationsfreiheit (Berlin DPA) pursuant to Article 77 of the General Data Protection
Regulation, concerning Wayfair Stores Limited
Record of Amicable Resolution of the complaint and its consequent withdrawal pursuant to
Section 109(3) of the Data Protection Act, 2018
Further to the requirements of EDPB Guidelines 06/2022 on the practical implementation of
amicable settlements Version 2.0 (adopted on 12 May 2022)
RECORD OF AMICABLE RESOLUTION FOR THE
PURPOSE OF EDPB GUIDELINES 06/2022 ON THE
PRACTICAL IMPLEMENTATION OF AMICABLE
SETTLEMENTS VERSION 2.0, ADOPTED 12 MAY 2022
Dated the 19th day of June 2023
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
Background
1. On 23 June 2021, (“the Data Subject”) lodged a complaint pursuant to Article
77 GDPR with Berliner Beauftragte für Datenschutz und Informationsfreiheit (“the Recipient
SA”) concerning Wayfair Stores Limited (“the Respondent”).
2. In circumstances where the Data Protection Commission (“the DPC”) was deemed to be the
competent authority for the purpose of Article 56(1) GDPR, the Recipient SA transferred the
complaint to the DPC on 6 August 2021.
The Complaint
3. The details of the complaint were as follows:
a. Following a dispute with the Respondent in relation to a furniture order, the Data
Subject submitted an access request pursuant to Article 15 GDPR and also sought the
deletion of their data (the Data Subject submitted their requests via webform and did
not have a copy of the request; however, the Data subject stated that the request was
made on 16 May 2021).
b. The Respondent responded to the requests on 18 June 2021. The Data Subject was
dissatisfied with the data provided to them as certain data, related to their
interactions with the Respondent’s customer services teams, as well as a letter from
the Data Subject’s lawyer, was not included. The Data Subject also stated that they
had not been provided with information relating to profiling measures or transfers of
their data to third parties. The Data Subject further stated that they received no
confirmation regarding their deletion request.
Action taken by the DPC
4. The DPC, pursuant to Section 109(4) of the Data Protection Act, 2018 (“the 2018 Act”), is
required, as a preliminary matter, to assess the likelihood of the parties to the complaint
reaching, within a reasonable time, an amicable resolution of the subject-matter of the
complaint. Where the DPC considers that there is a reasonable likelihood of such an amicable
resolution being concluded between the parties, it is empowered, by Section 109(2) of the
2018 Act, to take such steps as it considers appropriate to arrange or facilitate such an
amicable resolution.
5. Following a preliminary examination of the material referred to it by the Recipient SA, the DPC
considered that there was a reasonable likelihood of the parties concerned reaching, within a
reasonable time, an amicable resolution of the subject matter of the complaint. The DPC’s
experience is that complaints of this nature are particularly suitable for amicable resolution in
circumstances where there is an obvious solution to the dispute, if the respondent is willing
to engage in the process. In this regard, the DPC had regard to:
a. The relationship between the Data Subject and Respondent (being, in this case, an
individual consumer and a service provider); and
2
b. The nature of the complaint (in this case, an unsuccessful attempt by the Data Subject
to exercise their data subject rights).
6. While not relevant to the assessment that the DPC is required to carry out pursuant to Section
109(4) of the 2018 Act, the DPC also had regard to EDPB Guidelines 06/2022 on the practical
implementation of amicable settlements Version 2.0, adopted on 12 May 2022 (“Document
06/2022”), and considered that:
a. the possible conclusion of the complaint by way of amicable resolution would not
hamper the ability of the supervisory authorities to maintain the high level of
protection that the GDPR seeks to create; and that
b. such a conclusion, in this case, would likely carry advantages for the Data Subject,
whose rights under the GDPR would be vindicated swiftly, as well as for the controller,
who would be provided the opportunity to bring its behaviour into compliance with
the GDPR.
Amicable Resolution
7. The DPC engaged with both the Data Subject (via the Recipient SA) and Respondent in relation
to the subject-matter of the complaint. On 26 November 2021, the DPC wrote to the
Respondent to address the Data Subject’s concerns and requested that it provide a
substantive response to their requests.
8. In its response of 24 December 2021, the Respondent explained that it had already provided
the Data Subject with their full access file, and that information relating to chat and email
records, as well as the lawyer’s letter, was not provided because the Data Subject had this
information already and (in respect of their chat and email records) could also access same
via their account. The Respondent stated that it had confirmed this to the Data Subject on 22
June 2021. For completeness, the Respondent stated that it had since provided a copy of these
records, as well as the lawyer’s letter, to the Data Subject directly, and a copy of same was
also provided to the DPC.
9. The Respondent explained that it had responded to the Data Subject’s other concerns
regarding their access request on 17 June 2021. The Respondent stated to the DPC that it does
not process personal data for solely automated decision-making or profiling (and so had
nothing to provide to the Data Subject in this respect) and that it had provided the Data
Subject with information regarding transfers of personal data, including with reference to its
privacy policy. Regarding the deletion request, the Respondent explained that, due to the
threat of legal action in the context of its sale of goods dispute with the Data Subject, it was
relying on Article 17(3)(e) GDPR in refusing to action the deletion until such time as the claim
becomes statute-barred.
10. The DPC provided the Data Subject (via the Recipient SA) with the Respondent’s explanations
above and requested their views. In their response of 22 July 2022, the Data Subject indicated
3
that their complaint was not resolved and provided their reasoning. The Data Subject stated
that their access request was made on 16 May 2021 but was not actioned until 17 June 2021
and was therefore late. The Data Subject stated that information about the processing of their
data and about their rights was insufficient, and reiterated their dissatisfaction with the
responses provided by the Respondent regarding third party transfers. The Data Subject also
queried how details such as their email and telephone number could be retained in the
context of the Respondent’s reliance on Article 17(3)(e) GDPR.
11. On 7 September 2022, the DPC raised the Data Subject’s above concerns with the Respondent
and requested they be addressed in full. As directed by the DPC, the Respondent wrote to the
Data Subject directly on 21 September 2022, responding in detail to each of the points raised.
A copy of this correspondence was also provided to the DPC. The Respondent stated that its
records identified the date of the requests to be 17 May 2021 and that it had responded in
full on 17 June 2021. The Respondent explained that it had provided all required information
about its processing of personal data within that time and that its privacy policy (which it had
directed the Data Subject to) contained all requisite information (e.g. purposes and duration
of processing, retention periods and information about data subjects’ rights) pursuant to
Article 15 and Recital 63 GDPR.
12. Regarding the deletion request and the information retained, the Respondent explained that
the data points it uses to validate any requests made by a customer are the name and billing
address, phone number, email address, order number, and last four digits of the card used (if
applicable). Although no card details applied in this case as the Data Subject’s order was made
by a different means, the Respondent explained that “any future communications with [its]
Customer Service would require this information to be retained until the account has been
closed and no further liabilities remain”. The Respondent further explained that the Data
Subject’s ongoing sale of goods dispute presented “a real and imminent prospect of resulting
in litigation such that [the Respondent] would not be in a position to delete the relevant data”.
The Respondent agreed to delete the data on the expiry of the statutory limitation period.
13. The Respondent also provided a detailed overview of its technical and organisational
measures employed in dealing with data subject rights requests and explained their
appropriateness pursuant to Articles 24 and 25 GDPR.
14. In light of the detailed responses and explanations provided above, the DPC wrote to the Data
Subject (via the Recipient SA) on 11 November 2022 proposing an amicable resolution to their
complaint. The DPC asked the Data Subject to notify it, within a specified timeframe, if they
were not satisfied with the outcome, so that the DPC could take further action. The DPC did
not receive any further communication from the Data Subject and, accordingly, the complaint
has been deemed to have been amicably resolved.
15. On 16 May 2023, and in light of the foregoing, the DPC wrote to the Recipient SA noting that
the DPC considered the complaint to have been amicably resolved and withdrawn in
accordance with section 109(3) of the Act and that it would conclude the case and inform the
Respondent.
4
16. In circumstances where the subject-matter of the complaint has been amicably resolved, in
full, the complaint, by virtue of Section 109(3) of the 2018 Act, is deemed to have been
withdrawn by the Data Subject.
Confirmation of Outcome
17. For the purpose of Document 06/2022, the DPC confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties
concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
c. Having consulted with the supervisory authorities concerned on the information set
out above, as required by Document 06/2022 the DPC has now closed off its file in
this matter.
18. If dissatisfied with the outcome recorded herein, the parties have the right to an effective
remedy by way of an application for judicial review, by the Irish High Court, of the process
applied by the DPC in the context of the within complaint.
Signed for and on behalf of the DPC:
_____________________________
Deputy Commissioner
Data Protection Commission
5