Kitap Sayfasındaki Biyografik Verilerin Silinmesi

EDPBI:LU:OSS:D:2023:810 — LU SA final decision (Article 17 (Right to erasure (‘right to be forgotten’)))

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

Deliberation No 40/RECL13/2023 of 9 June 2023 of the National Data Protection Commission, in a plenary session, on complaint file No 3.803 lodged against the company [REDACTED] via IMI Article 61 procedure 74653

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the 'GDPR');

Having regard to the Act of 1 August 2018 on the organisation of the National Data Protection Commission and the General Data Protection Regime (hereinafter referred to as the 'Law of 1 August 2018');

Having regard to the Rules of Procedure of the National Data Protection Commission adopted by Decision No 3AD/2020 of 22 January 2020 (hereinafter referred to as the 'ROP');

Having regard to the complaints procedure before the National Data Protection Commission adopted on 16 October 2020 (hereinafter referred to as the 'Complaint Procedure before the CNPD');

Having regard to the following:

# I. Facts and procedure

1. In the framework of the European cooperation, as provided for in Chapter VII of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR), the Supervisory Authority of France submitted to the National Data Protection Commission (hereinafter: "the CNPD") the complaint of [REDACTED] (national reference of the concerned authority: 19005231) via IMI in accordance with Article 61 procedure - 74653.
2. The complaint was lodged against the controller [REDACTED], who has its main establishment in Luxembourg. Under Article 56 GDPR, the CNPD is therefore competent to act as the lead supervisory authority.
3. The original IMI claim stated the following:

"The complainant asked [REDACTED] to remove the page dedicated to the book he wrote 12 years ago from its website. [REDACTED] did not comply with his request. [REDACTED] answered him that, even if his book was no longer published, the page dedicated to this book would still be displayed on the Website [REDACTED] in order to allow sells through the [REDACTED]."

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

4. In essence, the complainant asks the CNPD to request [REDACTED] to act on his erasure request, by removing from [REDACTED] websites the reference page of his book and his personal data related to his book and author status, in particular his name and biographical elements.

5. The complaint is therefore based on Article 17 GDPR.

6. On the basis of this complaint and in accordance with Article 57(1)(f) GDPR, the CNPD requested [REDACTED] to take a position on the facts reported by the complainant and in particular to provide a detailed description of the issue relating to the processing of the complainant's data, and in particular with regard to his right to erasure.

7. The CNPD received the requested information within the deadlines set.

## II. In law

### 1. Applicable legal provisions

8. Article 77 GDPR provides that "without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, (...) if the data subject considers that the processing of personal data relating to him or her infringes this Regulation."

9. In accordance with Article 17 of the GDPR "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies (...)";

10. Article 12(4) GDPR provides that "If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy."

11. Article 56(1) GDPR provides that "(...) the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60";

12. According to Article 60(1) GDPR, "The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other";

13. According to Article 60(3) GDPR, "The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views";

## 2. In the present case

14. Following the intervention of the Luxembourg supervisory authority, the controller, being [REDACTED], answered that:

- [REDACTED] is the author of a book published by a publisher company (the "Book"). This Book has been offered for sale by [REDACTED] or third-party sellers in [REDACTED]'s stores.

Detail pages for books or [REDACTED] include all offer details available for a particular product, including offers for new copies as well as used copies which are sold by third party selling partners via the [REDACTED].

Consistent with standard bookselling practice, the product detail page for each book displays identifying information (such as title, author name, and publisher) that is provided by the publisher and essential to enabling customers to find the book in [REDACTED]'s store, confirm its authenticity, and make an informed decision as to whether to purchase it.

Although [REDACTED] stopped distributing the Book, information about the Book remained visible on the detail page in order to enable listings of used copies.

In his request, [REDACTED], asked that [REDACTED] remove the Book from [REDACTED]'s store. He argued that the publisher company no longer has the right to distribute the Book. [REDACTED] followed the process for requesting removal based on copyright

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

infringement and, when he had done so, [REDACTED] determined that the removal of the Book was not required.

- Although [REDACTED] framed his request as an exercise of his rights as a data subject under the EU GDPR, [REDACTED] believes that both GDPR and copyright law are relevant to defining the scope of [REDACTED] rights and [REDACTED]'s obligations in this case.

i. Under EU copyright law, where a copyrighted work is legally purchased or acquired by another owner, it may subsequently be sold and resold without restriction (see Article 4 of Directive 2001/29/EC of 22 May 2001). The exhaustion of right principle applies to copies of [REDACTED]'s work legally put into circulation at his own request. Accordingly, any third-party sellers has the right to resell any of those copies of the Book legitimately acquired, including used copies of the Book, on [REDACTED]'s websites via the [REDACTED]. And [REDACTED] indeed offers customers the opportunity to find out-of-print books through [REDACTED], which is similar to a used bookstore and lists a wide selection of titles for customers' reference and convenience.

In particular, although [REDACTED] stopped distributing new copies of the Book, it remains possible that a third-party seller could wish to sell a used copy of the Book on [REDACTED]'s websites; in that case the Book detail page would be needed to enable that sale. And in fact this scenario was not hypothetical in this case: at the time of [REDACTED]'s answer, a third-party seller was currently offering for sale a used copy of [REDACTED] Book on [REDACTED].

For these reasons, [REDACTED] has not removed the Book reference from its store, and informed [REDACTED] that book reference pages are not removed, even for out of print books, in order to allow sales via [REDACTED].

ii. [REDACTED]'s name is displayed on the Book detail page only for informational purposes in association with the Book he has authored. This information was released to [REDACTED] and the public by [REDACTED] or his publisher for the purpose of commercially trading his Book. Under EU copyright law, the books may be described as having been written by an author even after the publishing agreement has ended. In fact, Directive 2001/29/EC contains provisions which require that the author's name is provided if a work is being referenced.

[REDACTED] is thus entitled under copyright law to display [REDACTED] name on the product detail pages for purposes of enabling the legitimate, non-infringing sale of Mr. [REDACTED]'s Book.

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

[REDACTED] therefore believes GDPR permits it to continue to process [REDACTED]'s name for this purpose. Under GDPR, [REDACTED] is required to cease processing and erase personal data when one of the grounds set forth in Article 17(1) applies. In this case, no such ground applies: In particular, the processing of [REDACTED]'s name for this purpose is still "necessary in relation to the purposes for which [it was] collected or otherwise processed" as contemplated in Article 17(1)(a); the accurate identification of Book authored by [REDACTED], and lawfully offered for sale to consumers is an "overriding legitimate ground" for processing as contemplated in Article 17(1)(c); and none of the other grounds set forth in Article 17(1) is relevant in this case.

For these reasons [REDACTED] has not deleted [REDACTED]'s name from the Book's detail page.

iii. [REDACTED], or his publisher had included biographical information to describe the Book on the detail page. In response to [REDACTED]'s requests, [REDACTED] removed his biographical information from the detail page.

15. Following the intervention of the Luxembourg supervisory authority, [REDACTED] also sent an update to [REDACTED] containing additional information on its decision not to remove the reference page of his book and his name as author of this book from [REDACTED]'s websites, and the confirmation of the removal of his biographical information from this reference page.

16. Following the reception of this update from [REDACTED], [REDACTED], informed the Supervisory Authority of France that he was not fully satisfied with the solution proposed by [REDACTED]. While he is pleased with the removal of his biography, he would like the page about his book to be removed. He does not understand why [REDACTED] insists on keeping the page of his book, while other book selling platforms would have removed it. He would therefore like the investigation of his complaint to continue.

17. With regards to this communication of the complainant, the Luxembourg supervisory authority informed the Supervisory Authority of France of its conclusion that [REDACTED] did not commit an infringement to GDPR provisions, and in particular article 17 of the GDPR, by deciding not to remove the reference page of [REDACTED]'s book, including his name as author, on basis of the legal reasoning that [REDACTED] provided both [REDACTED] and the Luxembourg supervisory authority with.

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

In particular :

- The Luxembourg supervisory authority notes that [REDACTED] has provided the complainant with a comprehensive explanation on its decision not to remove the reference page of his book from its websites, based on copyright law and article 17 of the GDPR;
- The Luxembourg supervisory authority notes that this explanation is similar to the one provided in a previous complaint handled by it acting as Lead Supervisory Authority related to an author's request to remove his or her book from a sales website submitted to the cooperation procedure under article 60 of the GDPR which led to a final decision published on the EDPB website under the reference EDPBI:LU:OSS:D:2021:247 that concluded that the data controller did not infringe article 17 GDPR in this previous case;

The Luxembourg supervisory authority confirms that in this final decision, the conclusion of an absence of infringement covers both the general reasoning of the data controller that would justify not to act on authors requests to remove the reference page of their book from its website and the specific decision of the data controller in this particular case to "exceptionally and voluntarily" proceed to the requested removal.

The Luxembourg supervisory authority considers that the decision of data controllers operating book selling platforms to remove book reference pages on a voluntary basis in other individual cases has no incidence on that conclusion, as the abovementioned general legal reasoning based on copyright law would not be affected by these particular circumstances. Indeed, this reasoning applies every time a first copy of the concerned book has been purchased or acquired by a third party, meaning that data controllers may always refuse to remove the reference page of such books from their websites, without prejudice of their faculty to choose to remove it anyway on a voluntary basis in individual cases.

- The Luxembourg supervisory authority notes that the data controller provided [REDACTED] with a first answer containing its decision and the reason of it within the month of [REDACTED]'s request, which it specified to [REDACTED] following the intervention of the Luxembourg supervisory authority. The Luxembourg supervisory authority therefore considers that the data controller did not infringe its obligation under article 12(4) GDPR.

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

### 3. Outcome of the case

18. The CNPD, in a plenary session, therefore considers that, at the end of the investigation of the present complaint, the controller has taken appropriate measures to guarantee the complainant's right to erasure in accordance with Article 17 of the GDPR, by removing [REDACTED]'s biographical information from the reference page of his book on [REDACTED]'s websites, and informing him of the reason of its decision not to act on [REDACTED]'s request to remove the reference page of his book and his name as author of this book from [REDACTED]'s websites pursuant to Article 12(4) of the GDPR.

19. Thus, in the light of the foregoing, and the residual nature of the gravity of the alleged facts and the degree of impact on fundamental rights and freedoms, it does not appear necessary to continue to deal with that complaint.

20. The CNPD then consulted the supervisory authority of France, pursuant to Article 60(1), whether it agreed to close the case. The Supervisory Authority of France has responded affirmatively, so that the CNPD has concluded that no further action was necessary and that the cross-border complaint could be closed.

In light of the above developments, the National Data Protection Commission, in a plenary session, after having deliberated, decides:

- To close the complaint file 3.803 upon completion of its investigation, in accordance with the Complaints Procedure before the CNPD and after obtaining the agreement of the concerned supervisory authority.

Belvaux, dated 9 June 2023

The National Data Protection Commission

Chair

Commissioner

CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES

## Indication of remedies

This Administrative Decision may be the subject of an appeal for amendment within three months of its notification. Such an action must be brought by the interested party before the administrative court and must be brought by a lawyer at the Court of one of the Bar Associations.

Kitap Sayfasındaki Biyografik Verilerin Silinmesi

Türkçe özet

Hukuki mesele

Sonuç

Karar metni